Crescript
Legal document

Privacy Policy

How Crescript collects, uses, stores, and protects personal data when users browse the website, create an account, use the service, or purchase a subscription.

Last updated · June 7, 2026Version · 1.0

1. Who is responsible for your personal data

This Privacy Policy explains how Crescript processes personal data when users visit the website, create an account, use the service, subscribe to updates, contact Crescript, or purchase a subscription.

Data Controller

Crescript is established in Spain and processes personal data in accordance with applicable Spanish and European data protection law, including Regulation (EU) 2016/679 (GDPR), as applicable.

2. Scope of this Privacy Policy

This Privacy Policy applies to personal data collected or generated when users:

  • visit or browse crescript.com;
  • sign up for newsletters or updates;
  • create and manage an account;
  • use the script-generation service;
  • contact Crescript by form or email;
  • purchase or manage a subscription; or
  • exercise privacy rights or interact with support.

3. Personal data Crescript collects

3.1 Data provided directly by the user

  • Full name.
  • Email address.
  • Postal address where required for account, billing, or invoicing purposes.
  • Any information included in contact messages or support requests.
  • Newsletter subscription details.
  • Prompt text, instructions, preferences, and options chosen by the user when requesting a script.

3.2 Account and service data

  • Account identifiers and subscription status.
  • Plan tier and usage limits.
  • Script request history.
  • Generated script outputs and related timestamps.
  • Preferences such as tone, duration, language, and other generation settings.

3.3 Technical and usage data

  • IP address.
  • Browser and device data.
  • Log data relating to access, requests, response times, errors, and security events.
  • Connection metadata.
  • Analytics data, where enabled.
  • Cookie and similar technology data, as described in the Cookie Policy.

3.4 Payment-related data

Payments are processed by Stripe. Crescript does not store full payment card details. Crescript may store Stripe customer identifiers, subscription identifiers, billing status, and related payment metadata necessary to administer the subscription and provide support.

4. Sources of personal data

Crescript collects personal data:

  • directly from users;
  • automatically from the use of the website or service;
  • from payment providers such as Stripe;
  • from infrastructure or security providers such as Cloudflare; and
  • from third-party service providers involved in delivery of the service.

5. Why Crescript processes personal data

Crescript processes personal data for the following purposes:

  • To provide access to the website and user account.
  • To generate and deliver scripts requested by the user.
  • To maintain user history and account functionality.
  • To manage subscriptions, billing, invoicing, renewals, and payment-related support.
  • To send transactional, service, security, and administrative communications.
  • To respond to enquiries, contact requests, and support requests.
  • To monitor reliability, detect abuse, maintain security, and troubleshoot incidents.
  • To carry out limited quality review of prompts and outputs in order to verify service quality, detect malfunction, and prevent misuse.
  • To send newsletters or product communications where permitted by law or based on consent.
  • To comply with legal obligations and defend legal claims.

6. Legal bases for processing

Crescript relies on the following legal bases, depending on the processing activity:

  • Performance of a contract: to create accounts, provide the service, generate scripts, manage subscriptions, and deliver customer support linked to the service.
  • Pre-contractual measures: to respond to questions, product interest, or onboarding requests initiated by the user.
  • Consent: for newsletters, non-essential cookies, and other processing where consent is legally required.
  • Legitimate interests: to secure the service, prevent abuse, maintain logs, perform limited quality assurance review, improve operational reliability, and manage ordinary business communications.
  • Legal obligation: to comply with tax, accounting, consumer, fraud-prevention, and other legal requirements.

Where processing is based on consent, users may withdraw consent at any time without affecting prior lawful processing.

7. AI-related processing and service content

Crescript processes prompts, generation parameters, and outputs only to provide the service, maintain the user’s script history, support account functionality, carry out limited quality assurance review, prevent abuse, and ensure the service works properly.

Crescript does not use user prompts or outputs to train its own models.

Because script generation may rely on one or more third-party AI providers, user requests may be transmitted to those providers to generate the requested result. Crescript may also query external data sources, such as market or finance sources, in order to assist generation.

Prompts and outputs may be reviewed by authorized personnel or automated systems on a limited basis for quality assurance, misuse detection, service debugging, and operational review.

8. Payment processing

Subscriptions are billed online through Stripe. Renewal is automatic unless cancelled before the next renewal date.

Crescript uses payment-related information only to administer subscriptions, monitor billing status, issue invoices, address billing incidents, and comply with tax or accounting obligations.

9. Who Crescript shares personal data with

Crescript may share personal data with service providers acting on its behalf, including where necessary:

  • Cloudflare, for infrastructure, security, and content delivery.
  • Stripe, for payment processing and subscription administration.
  • OpenAI and Anthropic, where used as generation providers.
  • Google, where used for analytics, email, or related business tools.
  • Hosting, server, database, monitoring, support, anti-spam, or security providers.
  • Public authorities, courts, regulators, or law enforcement bodies where legally required.
  • Professional advisers where reasonably necessary.

Crescript will use contractual or other appropriate safeguards where required when providers process personal data on its behalf.

10. International data transfers

Some service providers used by Crescript may process personal data outside the European Economic Area. Where that happens, Crescript will rely on appropriate safeguards required under applicable law, such as adequacy decisions, Standard Contractual Clauses, or other lawful transfer mechanisms.

11. How long data are kept

Crescript keeps personal data for as long as necessary to provide the service, maintain the account, comply with legal obligations, and protect legitimate interests, and thereafter for the applicable legal limitation periods.

  • Account data are kept while the account remains active and for a reasonable period afterwards where required by law or to handle disputes.
  • Billing and invoice data are kept for the periods required under applicable tax and accounting law.
  • Prompts and outputs are kept as part of the user history unless deleted by the user or removed following account deletion, subject to backups and legal retention requirements.
  • Contact and support data are kept for the time needed to manage the request and any follow-up.
  • Logs and security data are retained for limited periods proportionate to security, operational, and compliance needs.
  • Newsletter data are kept until the user unsubscribes or consent is otherwise withdrawn.

12. User rights

Subject to applicable law, users may have the right to:

  • access their personal data;
  • request rectification of inaccurate or incomplete data;
  • request deletion of their personal data;
  • request restriction of processing;
  • object to certain processing;
  • receive portable data where applicable;
  • withdraw consent where processing is based on consent; and
  • lodge a complaint with the competent supervisory authority, including the Spanish Data Protection Agency (AEPD), where applicable.

Rights requests may be sent to legal@crescript.com.

Crescript may request information reasonably necessary to verify identity before responding to a request.

13. Account deletion and script history

Users may request deletion of their account by contacting Crescript. Users may delete their own script history through the service where that functionality is available.

Deletion requests may be subject to reasonable verification, technical backup cycles, and legal retention obligations.

14. Security

Crescript applies technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access.

However, no system or transmission over the Internet can be guaranteed to be completely secure.

15. Minors

Crescript is intended only for users aged 18 or older.

16. Third-party services and websites

The service may contain links to third-party services or may rely on third-party providers. Crescript is not responsible for the privacy practices of third-party websites or services outside its control.

17. Changes to this Privacy Policy

Crescript may update this Privacy Policy from time to time. The latest version will be published on the website with the updated date.

18. Contact

For privacy or legal matters, contact legal@crescript.com.