Privacy policy
Last updated 19 September 2026.
Cresaro writes and designs marketing for small businesses. This page says what we store, why we store it, and how to have it removed. It describes what the software actually does, not what a template says it might.
Who this is about
Cresaro is operated by Nexlution. It is used by business owners, who sign in and give us access to their own accounts. If you are a customer of one of those businesses and reached us through a link or a WhatsApp message, the section on conversations below is the one that concerns you.
When you visit our website
When you visit Cresaro's website we count what the visit did, so we can tell which of our ads and pages bring businesses that become customers. A random visit number is kept in your browser tab while it is open. It is not a cookie, it is not shared with anyone, and it ends when you close the tab. With it we record which pages you opened, which kind of business you picked, whether you watched the demo or tried the assistant, and which campaign link brought you. We never record your internet address or anything you typed. When you tap a WhatsApp button, a six-character code is added to the end of the message, so that if you send it we know which visit it came from. If you leave your details in the form, they are kept with that visit. We keep these records for about thirteen months, in the European Union.
What we store about your business
Your name and email address, held by our sign-in provider; your business's name, city, website, languages and timezone; everything the product writes for you, and every version of it; the pictures and videos it draws; and a record of what each generation cost. We also store what we read from the sources you point us at — your website, your uploaded documents, and your own posts — because that is what the writing is built from.
Your Instagram and Facebook accounts
When you connect an account we store its access token, encrypted; the account's public details — username, name, picture, bio, follower count; the permissions you granted; and, if you ask us to, the last ninety days of your posts with their captions and their likes and comments. We never post anything without your approval, and we do not read your direct messages. You can disconnect an account at any time, and disconnecting deletes its tokens.
Conversations with your customers
If you connect a WhatsApp number, we record that a conversation happened, when it opened, and which post or link it came from. A customer's phone number is never stored as a number: it is stored as a one-way digest that is different for every business, so the same person cannot be recognised across two of our customers. The opening message is kept as a short excerpt for ninety days and then deleted automatically.
The AI services in the chain
Writing, pictures, voice and music are produced by third-party model providers, which means your business profile and your brief are sent to them to be processed. They act as our processors: your content is not used to train their models under the terms we contract on. A public Instagram profile you ask us to read may be fetched through a third-party reader.
Cookies
We set the cookies our sign-in provider needs to keep you signed in, and one that remembers the language you chose. If our website asks you about ad measurement, Meta's pixel runs only if you allow it, and not allowing is the default. If you allow it, Meta sees the pages you open and your WhatsApp taps, and if you later become a lead or a customer we send Meta a hashed copy of your phone number or email, which cannot be turned back into the original, so it can match you to the ad you saw. You can change your choice at any time from "Ad measurement" at the bottom of the site. Fonts are served from our own domain.
How long we keep it
Your content stays while your account is open. Job records are pruned automatically, keeping only the most recent per kind. Conversation excerpts expire after ninety days. If your organization is deleted, everything it owns is erased after a thirty-day grace period, which exists so an accidental deletion can be undone.
Deleting your data
Every business has a settings page that counts everything it owns — facts, campaigns, posts, pictures, publications — and deletes all of it behind a confirmation you have to type. Removing our app from your Facebook or Instagram settings also reaches us: Meta calls us, we delete the data connected to that account, and we hand back a link that reports the deletion. You can also simply ask us, using the contacts below.
Your rights
You may ask what we hold about you, ask for it to be corrected, ask for a copy, or ask for it to be deleted. Write to us and we will answer. We store data in the European Union. These are your rights under the Israeli Privacy Protection Law and, for visitors in the European Union, the GDPR.
Reaching us
For anything on this page — a question, a correction, or a request to delete your data — write or call. We answer in Hebrew, Arabic and English.