Privacy policy
Who we are
Cresaro is operated by ראויה אליאס, Nazareth 5070. Contact us at jeries9e@gmail.com.
Our two roles
We provide software to businesses — clinics, salons, veterinary practices and similar — so that they can answer WhatsApp messages and take appointment requests.
- For messages between a business and its customers we are a processor. The business decides what is collected and why; we act on its instructions. If you messaged a business and want your data removed, the business is the right first contact, and we act on its request.
- For the accounts of the businesses themselves we are a controller — the staff email addresses, subscription and billing records that let us run the service.
What we process, and why
| Data | Why | Kept |
|---|---|---|
| WhatsApp messages between a customer and a business, and the phone number and WhatsApp profile name attached to them | To answer the question, take the appointment request, and let staff read and continue the conversation | For the business’s retention period, and deleted when the business asks or closes its account |
| Appointment details: service, time, staff member, and any note the customer supplied | To hold, confirm and show the appointment, and to write it to the business’s calendar | As above |
| Business content: services, prices, opening hours, and documents the business uploaded or a website it asked us to read | To answer customer questions accurately | Until the business changes or removes it |
| Staff accounts: name, email address, role | To sign in and to record who changed a price or confirmed an appointment | Until the account is closed |
| Operational records: message delivery status, message cost, error reports | To bill correctly, diagnose failures and detect abuse | Up to 24 months |
Automated replies
Replies are generated automatically. Prices, opening hours and availability are read directly from what the business entered; they are not invented by a language model. A person at the business can take over a conversation at any point, and every appointment is confirmed by a person before it is final.
We do not use message content to train any AI model, and our AI provider is contractually prohibited from doing so.
Who else processes this data
| Sub-processor | Purpose |
|---|---|
| Meta Platforms | WhatsApp message delivery |
| Anthropic | Generating reply text |
| Supabase | Database hosting and sign-in |
| Fly.io, Vercel | Application hosting, and the queue that coordinates replies |
| OpenAI | Search over the business’s own documents: the text of a customer’s question and of the approved documents is turned into a search index. Where a business has switched on voice-note transcription, the audio of a voice note is sent to be turned into text. Not used to train models. |
| Resend | Email alerts to a business about new appointment requests and conversations handed to staff |
| Calendar, when a business connects one | |
| Paddle | Subscription billing (businesses only) |
| Sentry, Langfuse | Error and quality monitoring. Neither receives customer message text. |
Where data is held
Data is stored in the European Union. Some sub-processors are established in the United States; transfers rely on the European Commission’s standard contractual clauses.
Security
Every business’s data is isolated in the database, and access is enforced by the database itself rather than only by application code. Access tokens for WhatsApp and Google Calendar are encrypted with per-record keys; every use of one is logged. Encryption keys are stored outside the database, so a copy of the database alone cannot decrypt them.
Your rights
You may ask for a copy of your data, its correction, or its deletion. See Data deletion, or write to jeries9e@gmail.com. If you messaged a business that uses Cresaro, we will pass your request to that business and act on its instruction, and we will tell you that we have done so.
Changes
We will post any change on this page and update the date above. Material changes are also emailed to the businesses that use the service.