Privacy policy

Who we are and what this covers

This notice explains how CREAssets (“we”, “us”) handles personal information when you visit the marketing website at creassets.com or contact us through it.

It covers the website only. The CREAssets platform at app.creassets.com — used by sponsors, their investors and residents — has its own privacy policy and terms, which cover use of the platform and the data held in it (those documents are currently being finalised by counsel).

What we collect

When you use the contact or migration form. We collect what you type in:

• your name, work email and company;
• your phone number, if you choose to give it;
• your role, assets-under-management range and the tools you use today;
• your message.

With each submission we also record the page it was sent from and your IP address. We use the IP address to limit how often a form can be submitted, which keeps spam and abuse out.

When you visit any page. Our server and proxy logs record your IP address, browser user agent, the URL you requested and the time of the request. Every website receives this information in order to deliver its pages.

When you email us. If you write to support@creassets.com or privacy@creassets.com, we receive your email address and whatever your message contains.

The website assistant (AI chat)

If you use the “Ask CREAssets” chat, the messages you type and the page you are on are sent from our server to our AI model provider, DeepInfra, to generate the answer. Do not type passwords, bank details or other sensitive information. We do not use your messages to train models.

The conversation is kept in your browser’s session storage so it survives page changes, and is deleted when you close the tab. We do not store it on our servers unless you send it to us: if you submit the assistant’s contact form, your name, email, any company or note you add, and the conversation are stored in the website’s request log on our server and emailed to our team so we can reply.

Cookies, analytics and tracking

This website sets no cookies for visitors. It runs no analytics, advertising or tracking scripts. The only cookie is a strictly necessary sign-in cookie for our own staff on the website’s private administration pages.

Our fonts are served from our own server, and the pages make no requests from your browser to third parties (the assistant calls our own server, which calls the AI provider). Because nothing on this site tracks you, there is no cookie banner and nothing to opt out of.

How we use it

• Form submissions, chat requests and emails — to reply to you, help with your account or migration, and follow up with you about CREAssets.
• Server logs — to keep the site secure and running: detecting abuse, investigating incidents and fixing errors.
• IP address on form submissions — to rate-limit submissions and prevent abuse.

Legal bases (EEA and UK visitors)

If the EU or UK General Data Protection Regulation applies to you, we rely on these legal bases:

• Steps prior to entering a contract — when you ask for help, a migration or information about using CREAssets.
• Legitimate interests — in replying to enquiries, following up about our product, and keeping the website secure and free of abuse. You can object to processing based on legitimate interests at any time (see your rights).

Who we share it with

We use two service providers to run this website. They process data on our behalf:

• Hosting. The site runs on a Hetzner virtual private server operated by our infrastructure provider. Server and proxy logs are stored there, and so is a copy of each form and assistant contact request, so that no request is lost if an email fails.
• Email. Form submissions are delivered to our team as an email through Gmail. Google LLC acts as our email provider, so form messages may be processed in the United States and other countries where Google operates.
• Text alerts. When you send a request, a short text message with only the kind of request and your name, company and email is also texted to a team member’s phone, so we can reply sooner. The text goes through an SMS gateway service (SMS Gateway for Android, which relays it encrypted to our own phone) and the mobile carriers that deliver it.

We may also disclose information where the law requires it, or to protect the rights, safety and security of CREAssets, our users or the public.

We do not sell your personal information. We do not share it for cross-context behavioural advertising.

Text messages

You can sign up to receive text messages from CRE Assets about our software (product updates, demo and meeting reminders, webinar and event invitations, and replies to your inquiries) on our text updates sign-up form. Signing up is optional and is not a condition of any purchase. Message frequency varies; message and data rates may apply. Reply STOP to any message to opt out, or HELP for help.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties.

How long we keep it

• Server and proxy logs are kept for a limited period for security and operations, then deleted.
• Form submissions, assistant contact requests and emails — in our mailbox and in the website’s request log — are kept for as long as we need them to reply and to follow up about CREAssets. Ask us to delete them at any time.

Your rights

You can ask us to give you access to your personal information, correct it, or delete it. You can also object to how we use it, including to follow-up about CREAssets. Email privacy@creassets.com. We respond within 30 days. We may need to confirm your identity before acting on a request.

California residents. The California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), gives you the right to know what personal information we collect, use and disclose. It also gives you the right to delete it, to correct it, and to opt out of its sale or sharing for cross-context behavioural advertising. We do not sell personal information or share it for that kind of advertising, so there is nothing to opt out of. We will not treat you differently for exercising these rights. You may use an authorised agent to make a request on your behalf.

EEA and UK visitors. Under the GDPR and the UK GDPR you also have the right to restrict processing and to data portability. You can also complain to your local data protection supervisory authority. We would appreciate the chance to deal with your concern first.

Security

The site is served only over HTTPS, with a content security policy and other security headers. Form submissions are rate-limited. Access to form messages and logs is limited to the CREAssets team and the providers named above. No method of transmission or storage is perfectly secure, but we work to protect what you send us.

Children

This website is not directed to anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has sent us information, email privacy@creassets.com and we will delete it.

Changes to this notice

If we change how the website handles personal information, we will update this page and the “Last updated” date above. If the change is significant, we will say so here.

Contact

Privacy questions and requests: privacy@creassets.com. Anything else: support@creassets.com. See also our terms of use and disclosures.