Privacy Policy

1. Who We Are

Cresora Commerce ("we", "us", "our") operates the ROI Calculator application at roic.cresoracommerce.com. This policy explains how we collect, use, and protect your personal data when you use our service.

2. Data We Collect

We collect the following personal data when you create an account and use the application:

• Email address — used for account creation, email verification, and password reset
• Name — used for display in the application
• Password — stored as a one-way bcrypt hash, never in plain text
• ROI scenario data — the financial inputs you enter into the calculator, stored to let you save and revisit scenarios
• Session data — server-side session tokens used to keep you logged in

3. How We Use Your Data

• To create and manage your account
• To send email verification and password reset emails
• To save and retrieve your ROI calculator scenarios
• To authenticate your sessions

We do not use your data for marketing, advertising, or profiling purposes. We do not sell your data to third parties.

4. Third-Party Services

We use the following third-party services to operate the application:

• Vercel — hosting and deployment (processes requests and serves the application)
• Neon — database hosting (stores your account and scenario data)
• Resend — transactional email delivery (sends verification and password reset emails)

These providers process data on our behalf under their respective privacy policies. Data is stored in the United States.

5. Cookies

We use a session cookie to keep you logged in and, with your consent, collect anonymous performance metrics to improve the application.

We do not use advertising cookies or third-party tracking.

6. Data Retention

Your account data and saved scenarios are retained for as long as your account is active. Session data expires automatically after the session timeout period. If you delete your account, all associated data (profile, scenarios, sessions) is permanently removed.

7. Your Rights

Under applicable data protection laws (including GDPR), you have the right to:

• Access your personal data
• Correct inaccurate data (via your account settings)
• Delete your account and all associated data
• Export your data in a portable format
• Object to processing of your data

To exercise any of these rights, contact us at privacy@cresoracommerce.com.

8. Security

We protect your data with encryption in transit (HTTPS/TLS), bcrypt password hashing, server-side session management, and rate-limited API endpoints. Access to production systems is restricted and requires multi-step approval.

9. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via the application. The "Last updated" date at the top reflects the most recent revision.

10. Contact

For privacy-related questions or requests, contact us at privacy@cresoracommerce.com.