Privacy Policy

This Privacy Policy explains how Cresion AI, Inc., the company behind Ceres ("we", "us"), collects, uses, and shares information when you visit our website, sign up for an account, or use the Ceres service.

We are the data controller for the information we collect about you directly (for example, when you create an account or contact us). When you use the service to process data on your behalf, we act as the data processor and you are the controller — that arrangement is governed separately by our Data Processing Addendum.

We collect three buckets of data:

Account data. When you sign up, we collect your name, work email, company name, and a password. If you pay, Stripe collects your payment details — we never see card numbers.

Usage data. When you use the Portal, we collect IP address, browser type, pages visited, and timestamps, so we can run the service, detect abuse, and improve the product. To limit how many free trials one person can start, when you sign in with Google or set up a workspace we also store a keyed hash of the network you connect from (your IP address, or for IPv6 its /64 prefix) alongside your account — never the address itself — and delete it 30 days after we last see it. We use first-party product analytics (PostHog) to understand how the site and product are used; other than Google's advertising tag (see Advertising measurement), we do not load third-party ad-tracking scripts. If you arrive from one of our ads, we also store the ad's click identifier and campaign parameters in a first-party cookie to measure ad performance (see Advertising measurement).

Customer data. Anything the service collects on your behalf — competitor research, briefings, approvals, evidence chains, IM channel IDs, connector tokens, and the content of outbound messages. This data belongs to you. We process it only to operate the service.

We use the data we collect to:

• Provide, operate, and secure the service.
• Authenticate you and detect fraudulent or abusive activity.
• Bill you, and give you receipts.
• Send you product updates, security notices, and service-related messages (you cannot opt out of security notices while you have an account).
• Respond to your support requests.
• Improve the service — for example, by measuring which features get used.
• Comply with legal obligations and enforce our Terms.

We do not sell your personal information. We do not use Customer Data to train shared AI models. We advertise Ceres to potential customers and measure which ads lead to sign-ups (see Advertising measurement below), but we never use your Customer Data to target advertising.

We share data only with vendors who help us run the service, and only to the extent they need it. Every vendor is under a written data-protection agreement and is listed on our Security page.

We may disclose data if required by a valid legal process. When we can, we will notify you first — unless the law prohibits notice — so you can seek protective action.

• Account data: kept while you have an account, then deleted 30 days after cancellation.
• Customer data: kept while you have an account, then deleted 30 days after cancellation, unless a longer period is required by law.
• Usage logs: 90 days (access and audit logs), 365 days (aggregated).
• Billing records: 7 years from the relevant transaction, for tax and accounting.
• Members-area records for site visitors: see Visitors to members areas below.

You can:

• Access a copy of the personal data we hold about you.
• Correct inaccurate data.
• Delete your account and associated data.
• Export your data in a portable format (JSON).
• Object to or restrict certain processing, where the law allows.

To exercise any of these rights, email [email protected] and we will respond within thirty days.

If you are in the EU, UK, or European Economic Area, we process your personal data under the following lawful bases:

• Contract: to provide the service to you after you sign up.
• Legitimate interest: to keep the service secure and to improve it.
• Legal obligation: to meet tax and regulatory requirements.
• Consent: for optional marketing emails (never for operational messages).

You have the right to lodge a complaint with your local supervisory authority. For any GDPR request or question, contact us at [email protected].

If you are a California resident, you have the right to know what personal information we collect, to request deletion, to opt out of sale (we do not sell), and to non-discrimination for exercising those rights.

To exercise any of these rights, email [email protected] with the subject line CCPA Request. We verify identity through the email address on file.

We host on cloud infrastructure that may process your data in the United States, the European Union, or Singapore. When we transfer personal data out of your region, we rely on the EU Standard Contractual Clauses (SCCs), the UK's International Data Transfer Agreement, or other mechanisms recognized by applicable law.

We use a signed session cookie for authentication. Our analytics provider (PostHog) sets first-party cookies so we can measure how the site and product are used. We load Google's advertising tag, which sets advertising cookies to measure ad conversions (see Advertising measurement), and if you arrive from one of our ads we also set a first-party ceres_attr cookie that records the ad's click identifier. When you sign in or set up a workspace we set a first-party ceres_did cookie holding a random identifier for your browser (nothing derived from your device), which we store alongside your account to limit how many free trials one browser can start; it is kept for up to 400 days and is not used for advertising or to track you on other websites. You can disable or delete cookies in your browser settings, but you will not be able to sign in to the Portal without the session cookie.

When you reach our site from one of our ads — for example a Google Ads link — we store that ad's click identifier and campaign parameters (such as Google's gclid and utm_ tags) in a first-party cookie named ceres_attr for up to 90 days.

If you then start a trial or subscribe, we report that conversion to Google Ads using Google's conversion tag (gtag.js), so we can measure which ads actually bring in customers. To improve measurement accuracy we may include a securely hashed, irreversible form of your email address (Enhanced Conversions) — never your name, your plaintext email, or any Customer Data.

Google's tag sets advertising cookies (such as _gcl_*) to attribute conversions to the ad you clicked. The ceres_attr cookie is first-party and is not used to profile you across other websites. You can control ad personalization in your Google Account's ad settings (adssettings.google.com) and block or delete cookies in your browser settings.

We also measure ad-click landings in aggregate on our own servers — the landing page, pages viewed, time on page, and campaign labels — without cookies and without persistent identifiers; these measurements are not linked to your account or to later visits.

If you connect a TikTok account, we receive from TikTok, with your permission: your TikTok account identifier, display name and profile picture; your follower, following, like and video counts; and the details of your public videos (title, description, date, duration, link and view, like, comment and share counts). We use them only to show you your TikTok numbers and to let your agents report on them.

When an agent prepares a video for TikTok, we send it to your TikTok inbox as a draft only after you approve that specific video. We never post to TikTok for you: you finish and post the draft yourself in the TikTok app.

Your TikTok sign-in tokens are stored encrypted. Disconnecting TikTok on its connector page asks TikTok to revoke our access and deletes them; you can also remove AgentCeres at any time in the TikTok app's settings, under Manage app permissions. Deleting your AgentCeres account deletes all TikTok data we hold.

A customer can restrict pages on a site we host to people they list (a "members area"). For the people on that list we are the customer's data processor: the customer decides whom to admit and why, and we process the data only to run the sign-in for them, under our Data Processing Addendum. To see, correct or delete the data held about you in a members area, ask the site's owner; you can also write to [email protected] and we will pass your request on.

What we process for a members area:

• Your email address, as the site owner listed it or as it came with a paid order, and which pages that address may open.
• Sign-in records: a one-time sign-in link we email to you, and the sessions it opens. We store only a hash of each link and each session, never the link or the cookie value itself.
• A log of sign-in events (links requested, emails sent, sessions started and ended). It holds a keyed hash of your email address, not the address in readable form.

When you sign in, we set one first-party cookie, __Host-mas_member, on that site's own address. It keeps you signed in to that one site for 30 days from sign-in, is not renewed by use, is not shared with any other site, and is not used for advertising or analytics.

How long we keep it:

• A person the owner removed, or who has no access left, is deleted 90 days after their access was last revoked, or 90 days after they were added if they never had access.
• Sign-in links are deleted 7 days after they expire, and sessions 7 days after they expire or are ended.
• The sign-in event log is deleted after 400 days.

Ceres is a business product. We do not knowingly collect data from children under 16. If you believe a child has provided us with personal data, email [email protected] and we will delete it.

We describe our security program in detail on our Security page. Short version: encryption in transit and at rest, per-customer isolation, scrypt password hashing, device-paired auth for operator actions, and continuous monitoring.

We may update this policy as the service evolves. Material changes are announced by email at least thirty days before they take effect. The "Last updated" date at the top of this page always reflects the most recent revision.

For privacy questions, email [email protected]. For data subject requests (GDPR, CCPA, or otherwise), use the same address with a clear subject line describing the request.