1. Introduction
Welcome to Crema ("we", "our", or "us"), available at https://crema.supply. Crema is a multi-tenant platform empowering independent coffee roasteries to host storefronts and connect with specialty coffee enthusiasts.
This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website, use our merchant storefronts, or sign in using third-party identity providers such as Google.
2. Information We Collect
We collect information you provide directly to us, including:
- Account Information: Name, email address, phone/WhatsApp number, and password (if creating a direct account).
- Transaction & Order Details: Items purchased, shipping address, recipient contact details, billing history, and delivery tracking information.
- Technical Information: IP address, browser type, device information, and interaction logs collected via essential cookies for session management.
3. Google OAuth User Data
To offer a convenient sign-in experience, Crema allows customers to sign in using their Google Account ("Continue with Google"). When you choose to authenticate with Google, we request access only to basic, non-sensitive identity scopes:
openid— To authenticate your identity..../auth/userinfo.email— To read your primary Google email address..../auth/userinfo.profile— To access your public display name and avatar picture.
Data Retrieved from Google:
- Google User ID (
sub): A unique, permanent account identifier used to securely recognize your return visits. - Email Address: Used to identify your account and send transactional notifications.
- Full Name: Used to personalize your storefront experience and pre-fill checkout forms.
- Profile Picture URL: Used optionally to display your avatar in your customer account profile.
4. How We Use Google User Data
We process data received from Google OAuth strictly for the following purposes:
- Creating and authenticating your customer profile across Crema roastery storefronts.
- Associating your orders, invoices, and shipping details with your verified identity.
- Delivering order status updates and customer service communications.
- Preventing fraudulent orders and maintaining platform security.
5. Google API Services User Data Policy ("Limited Use") Compliance
Crema's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy , including the Limited Use requirements:
- No Sale of Data: We do not sell, lease, or trade Google user data to any third parties, advertisers, or data brokers.
- No Advertising Use: We do not use or transfer Google user data for serving advertisements, retargeting, or interest-based profiling.
- No AI Model Training: Google user data is not used to train or fine-tune generalized artificial intelligence or machine learning models.
- Strict Transfer Boundaries: We only transfer Google user data to third-party service providers (e.g. database hosting or delivery couriers) when strictly necessary to fulfill the services requested by you.
6. Data Storage and Security
We implement industry-standard security safeguards to protect your personal data. All communications between your browser, our servers, and Google APIs are encrypted using Transport Layer Security (TLS/HTTPS). Sensitive access credentials and database storage are protected with restricted access controls.
Your data is retained for as long as your account remains active or as required by applicable commercial, tax, and accounting statutory recordkeeping obligations.
7. User Rights & Data Deletion Instructions
We respect your right to control your personal information. You have the right to access, update, or request complete deletion of your data at any time.
How to Request Account & Data Deletion:
- Send an email from your registered email address to hello@crema.supply with the subject line:
Data Deletion Request. - Specify whether you wish to delete your entire customer profile or specific transaction history.
- Our support team will verify your identity and permanently delete your account, saved addresses, and social authentication links within 30 calendar days.
How to Revoke Google Account Access:
You can instantly revoke Crema's access to your Google Account at any time by visiting your Google Account Security & Third-Party Permissions page and removing access for Crema.
8. Changes to This Policy
We may update this Privacy Policy periodically to reflect technological, operational, or legal changes. Any revisions will be posted on this page with an updated Effective Date.
9. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or how your data is handled, please reach out to us at: