Privacy Policy

Who we are

Crema is event and customer management software for businesses that sell and deliver events. It is operated by Crema Labs LLC (“Crema”, “we”, “us”). This policy covers cremacrm.com, the Crema app, and the pages Crema shows to the clients and staff of businesses that use it, such as inquiry forms, quote pages, booking pages and staff links, including when those pages are shown on a business’s own web address.

Questions about this policy or your information can go to info@cremacrm.com.

Our role for businesses and their clients

Businesses sign up for Crema and use it to manage their own inquiries, clients, events and staff. For the account itself — the people who sign up and the team members they invite — Crema decides how that information is used, as described here.

The information a business puts into Crema or collects through it about its own clients and staff belongs to that business. Crema processes it on the business’s behalf, only to provide Crema to that business and to keep Crema secure and working properly. If you are a client or staff member of a business that uses Crema, that business’s own privacy practices apply too, and it is the best first contact for requests about your information. We will help it respond.

Information we collect

Information you give us when you create or use an account:

Your name, email address, phone number, password, business details, state, ZIP code and time zone, and the team members you invite. Passwords are stored by our authentication provider in hashed form; we never see them in plain text.
If you sign in with Google: your name, email address and basic profile information from your Google account.
How you found us. If you arrive through a referral link or an ad, we record the referral code, campaign tags, ad click identifier and referring website. Your browser keeps these for up to 30 days, until you sign up.
A payment card when a new account books its onboarding call, used to check that the sign-up is genuine. The card is handled by Square and is not charged; Crema keeps only its brand, last four digits and expiry date.
People you refer. If you invite another business to Crema, we use the name and email address you give us to send them that invitation.
Messages you send us: feedback and support requests (with any screenshots you attach, and the page and browser you sent them from), and demo requests (name, work email, company, phone, team size, preferred times and the details you choose to include).

Information a business stores in Crema about its own work, which can include personal information about its clients and staff:

Inquiries and client contact details (name, email, phone, company), event details and venue addresses, quotes, invoices and payment status, notes, messages, files and photos.
Staff names and contact details, availability, assignments, hours and pay records.

Information clients give a business through Crema’s pages: inquiry forms, quote pages (including accepting a quote and its terms, paying, chatting with the business and answering checklists) and booking pages. Card payments on these pages are processed by Square on the business’s behalf; Crema does not receive or store full card numbers.

Information collected automatically:

Technical and log data such as IP address, browser and device type, and the pages and requests involved, which we use for security, abuse prevention and reliability. When a client accepts a quote, pays or books a call, we also keep their IP address and browser as a record of that transaction.
Error reports. When the Crema app hits an error, our error-monitoring provider may receive a technical report and a recording of the screen from shortly before to shortly after it, which can include information that was on screen. Screens that show data from a connected Google Ads account are left out of these recordings. It also receives performance timings from a sample of sessions.
Quote views. When a client opens a quote a business has shared, Crema records that it was opened, and when, and shows this to the business.
Email activity. For emails sent through Crema, we record the recipient, subject, delivery and bounces and, for campaign emails, link clicks. Unsubscribes and spam complaints are kept so the address is not emailed again.
Usage measures on inquiry forms and quote pages (for example, whether a photo was enlarged). They are stored without a name or IP address; on quote pages they are linked to the quote. We also record which Crema features signed-in team members use.

Advertising attribution. When a business places Crema’s inquiry form on its own website, the form can read Google Ads click identifiers and campaign tags (such as gclid and utm parameters) from that website’s address or from Google’s cookies on that website, plus the page the visitor landed on and the site that referred them. It keeps them in that website’s browser storage until the browser tab is closed, so the business can see which ad led to an inquiry. On that business’s instructions, the form can also tell the business’s own Google tag when an inquiry is sent or a booking is paid, and the business can export ad-click records to upload to Google Ads. Crema itself sets no advertising cookies.

Information from services a business connects to Crema: payments, orders, refunds, invoices and receipts from Square; customer, invoice and payment records it sends to QuickBooks; and advertising data from Google Ads, described below.

How we use information

To provide Crema: storing and showing each business’s data to its own team, sending the emails and text messages the business asks Crema to send, taking payments through Square, and syncing with the services the business connects.
To keep Crema secure and reliable: verifying new accounts, limiting abuse, investigating errors and protecting our users and systems.
To support you and to tell you about your account and changes to Crema.
To improve Crema, using information about how the product is used.
To comply with the law and enforce our agreements.

We do not sell personal information, and we do not use a business’s client or staff information to market our own products. Our team accesses a business’s data only to provide support with that business’s permission, to investigate errors, to keep Crema secure, or when the law requires it.

AI features

Some Crema features use artificial intelligence, for example to help draft text. They run only when you choose to use them. The information needed for that request is sent to Anthropic, which provides the AI model, and is used to return the result to you.

Google user data

If a business connects a Google Ads account, Crema accesses it through the Google Ads API with the permission of the person who connects it. Crema receives the email address and Google account ID of the login that connects it. It reads the names, IDs, currencies and time zones of the Google Ads accounts that login can access, so the person connecting can choose one, and, for the chosen account, its monthly advertising cost, clicks and impressions for the last 13 months, plus the last 90 days’ performance of its campaigns, ad groups and keywords and of the search terms that showed its ads (cost, clicks, impressions, conversions, impression share and Quality Score). For an inquiry that came from a Google ad, Crema looks up which campaign, ad group and keyword the ad click came from, using the click identifier the inquiry carried. That list of accounts is deleted once an account is chosen; an unused list expires after 30 minutes and is then deleted. The campaign, keyword and search-term figures are replaced each time Crema reads them, about once a day, and the campaign and keyword found for an inquiry are kept while that inquiry exists in Crema, for at most about 13 months. Crema uses this only to show advertising results inside that business’s own Crema workspace, such as comparing ad spend with the bookings it brought in and suggesting which campaigns and keywords to look at; Crema never changes the Google Ads account. People on the business’s Crema team can see which Google Ads account is connected and which Google login connected it; only the workspace owner sees the cost, campaign, keyword and search-term figures.

Crema stores the access Google grants in encrypted form. Disconnecting Google Ads in Crema (Admin → Integrations) deletes the stored connection and the data read from it, and revokes Crema’s access at Google unless the same Google login is still connected to another Crema workspace. You can also remove Crema’s access at any time from your Google Account permissions.

If you sign in with Google, Crema uses your name, email address and profile information only to sign you in and set up your account.

Crema does not sell Google user data, use it for advertising, share it with other Crema customers, or let people read it except with your permission, for security, or to comply with the law. Crema’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Text messages

Crema sends text messages for the businesses that use it, from Crema’s own phone number: today, shift reminders and availability requests to a business’s staff. Message frequency varies. Message and data rates may apply. Reply STOP to stop receiving messages, or HELP for help.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent will not be shared with any third parties.

We share information only as described here:

With the business you are dealing with. Information a client or staff member gives through Crema goes to the business that uses Crema.
With service providers that run parts of Crema for us, under contracts that limit their use of it: Supabase (database, sign-in and file storage), Netlify (hosting), Resend (email delivery), Twilio (text messages), Square (payments, including Apple Pay and Google Pay), Anthropic (AI features), Sentry (error monitoring), address-lookup providers such as Google and Mapbox (suggesting addresses as you type), Google Fonts (typefaces on some quote pages, inquiry forms and emails, which means your browser contacts Google to load them), and Google Analytics (visits to our marketing website).
With services a business chooses to connect, such as Square, QuickBooks and Google Ads, as that business directs.
With browser push services, such as those run by Apple, Google and Mozilla, if you turn on notifications for the Crema app.
When the law requires it, to protect the rights, safety and security of our users, the public or Crema, or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply to the information transferred.

Cookies and browser storage

The Crema app uses your browser’s storage to keep you signed in and to load your data faster, and our sign-up page uses it to remember how you found us (see above). Our marketing website may use Google Analytics cookies to measure visits; it does not load them while you are signed in to Crema. Crema sets no advertising cookies. Your browser settings let you clear or block cookies and storage, though the app needs browser storage to keep you signed in.

How long we keep information

We keep account and business information for as long as the account is active. When a business asks us to delete its account, we delete its workspace and the information it stored, including its clients’ and staff’s information, except records we must keep for legal, tax, accounting or dispute purposes, and our own records of our dealings with the account, such as its onboarding call. Copies held by our providers, including email, text-message and error-monitoring logs and backups, are removed on their own schedules. Disconnecting a connected service deletes the connection Crema stored for it; you can also remove Crema’s access from your Google, Square or QuickBooks account.

Security

Crema uses encrypted connections (HTTPS), encrypts the credentials of connected services at rest, keeps each business’s data separate from every other business’s, and lets each business control what its team members can see and do. No system is perfectly secure; if a breach affects your information, we will notify you as the law requires.

Your choices and rights

Account owners can view, correct and export much of their business’s information inside Crema. To ask for access to, correction of, or deletion of your information, email info@cremacrm.com. We may need to confirm your identity first, and if you are a client or staff member of a business that uses Crema, we may refer your request to that business.

Depending on where you live, for example in California or the European Union, you may have further rights, such as to receive a copy of your information, to object to or restrict certain uses, and to complain to a data protection authority. We will not treat you differently for using these rights. Emails a business sends you through Crema’s campaign feature include an unsubscribe link.

Where information is processed

Crema is operated from the United States, and its data is stored and processed primarily in the United States; our hosting provider serves pages from locations around the world. If you use Crema from elsewhere, your information is transferred to the United States.

Children

Crema is a business tool and is not directed to children under 13. We do not knowingly collect information from children under 13; if you believe a child has given us information, contact us and we will delete it.

Changes to this policy

We will update this page when our practices change and revise the “Last updated” date above. If a change is significant, we will also tell account owners by email or in the Crema app.

Contact us

Crema Labs LLC — info@cremacrm.com.