Privacy Policy

This Privacy Policy explains how CrescaX collects, uses, stores and protects information when you visit crescax.com, become a client, or connect your social accounts so we can manage and publish content on your behalf.

CrescaX is a trading name of RETIRE YOUNG RETIRE RICH LIMITED, a company registered in New Zealand (Company number 6246130, NZBN 9429045982491), with its registered office at 22b Kain Street, Mount Eden, Auckland 1024, New Zealand (“CrescaX”, “we”, “us”, “our”). We are the data controller responsible for your information under the New Zealand Privacy Act 2020.

1. Information we collect

We only collect what we need to provide our service. Depending on how you interact with us, this may include:

• Contact & enquiry details — your name, business name, email address, phone number and the message or brief you send us through our website forms or by email.
• Onboarding details — information you choose to share about your business so we can create on-brand content for you: your services, offers, opening hours, tone of voice, target customers and similar.
• Connected account data — when you connect a Facebook Page or Instagram account, the information described in Section 2 below.
• Content you provide — photos, logos, copy, links and other assets you give us to publish on your behalf.
• Technical data — basic, non-identifying information such as your browser type and the pages you visit, used to keep the website secure and working.

2. Facebook & Instagram connections

If you ask us to manage your social channels, you can connect your Facebook Page and linked Instagram account using Facebook Login for Business by Meta. You are always shown exactly what you are granting before you confirm, and connecting is entirely optional.

With your permission, we access only what is needed to draft, schedule and publish the content you approve:

What we access	Why
Your Page & Instagram profile basics	To identify the correct account and show it to you in your dashboard.
A Page access token	A secure key, issued by Meta, that lets us publish approved posts to your Page and Instagram.
Permission to publish & manage posts	To post the content you have reviewed and approved, and to schedule it.
Basic performance figures (insights)	To report back to you on how your posts performed.

3. How we use information

We use the information we collect to:

• Create, schedule and publish content you have approved;
• Respond to your enquiries and provide customer support;
• Set up and run your account and the services you have asked for;
• Report back to you on how your content and campaigns are performing;
• Keep our service secure, reliable and improving;
• Meet our legal and accounting obligations in New Zealand.

Every post is prepared for you and held for your approval. Nothing is published to your channels until you say so.

4. Why we are allowed to use it

We process your information where it is necessary to perform our agreement with you, where you have given consent (for example, by connecting an account), where we have a legitimate interest in running and improving our service, and where we must comply with the law.

5. When we share information

We do not sell your information. We share it only in these limited cases:

• Service providers who help us operate — for example, secure hosting and infrastructure providers — under agreements that require them to protect your data and use it only on our instructions.
• The platforms you ask us to publish to — such as Meta (Facebook and Instagram) — strictly to carry out your approved work.
• Legal & safety — if required by law, regulation or a valid legal request, or to protect the rights and safety of people and property.

6. Storage, security & location

Access tokens and connection details are stored encrypted and are restricted to the systems that need them to publish your approved content. We apply access controls, encryption in transit, and least-privilege practices. Some of our infrastructure providers may store data outside New Zealand; where this happens, we take reasonable steps to ensure your information remains protected to a comparable standard.

7. How long we keep it

We keep your information only for as long as needed to provide the service and to meet our legal and accounting obligations. When you disconnect an account or end your engagement, we remove the associated access tokens and connection records, and delete or anonymise other personal data once it is no longer required.

8. Your choices & rights

Under the New Zealand Privacy Act 2020 you may ask us to:

• Access the personal information we hold about you;
• Correct information that is wrong or out of date;
• Disconnect any connected social account at any time;
• Delete your personal information, subject to any legal retention we must observe.

To make a request, email [email protected]. We will respond within a reasonable time.

9. Revoking access & deleting your data

You are always in control of any connected account:

• Disconnect at any time — email [email protected] and we will revoke the connection and delete the stored access token and connection record.
• Remove us from Facebook directly — in your Facebook settings, go to Settings & Privacy → Settings → Business Integrations, then remove CrescaX. This immediately invalidates our access.

For full step-by-step instructions, see our Data Deletion Instructions.

10. Cookies & analytics

Our website uses only the cookies and similar technologies needed to keep it secure and working. We do not use advertising or cross-site tracking cookies. Web fonts are loaded from Google Fonts to render the site; their use is governed by Google’s own privacy terms.

11. Children

Our service is for businesses and is not directed at children. We do not knowingly collect personal information from anyone under 16.

12. Changes to this policy

We may update this policy from time to time. When we do, we will change the “Last updated” date above and, where the change is significant, take reasonable steps to let affected clients know.

13. How to contact us