Privacy Policy

Crest (“Crest”, “we”, “us”) is a revenue-management and service-operations platform for companies that sell, deploy, and support school technology, operated by the team behind Essentiel school software and available at crestcloud.app.

Crest is invitation-only. Accounts are created by a workspace Owner or Administrator for their own staff. This policy explains what we collect when you use the website or a Crest workspace, why, and the choices you have. It applies to the marketing site, the web application, and the Crest mobile app.

Account information. Name, work email, phone number, role, team and position, and authentication credentials (passwords are stored hashed, never in plain text).

Workspace records you or your colleagues enter. Client school records and contacts, pipeline opportunities, contracts and pricing, statements, payments, inventory and deployments, technical visits and expenses, and, for HR and payroll roles, attendance, leave, and payroll records. This is business data controlled by your organization.

Location and device data. If you use field features, the mobile app can read your device location when you check in to or start a visit, and use the camera or photo library when you attach visit or expense proof. This happens only after your device permission prompt and only for the action you start.

Usage and security logs. Sign-in events, IP address, browser or device type, and an append-only audit trail of who changed what and when. Logs exclude passwords, secrets, and session tokens.

Website enquiries. If you request a demo, we receive the name, email, organization, and message you submit.

Crest offers an optional Google Drive integration. It is off until a signed-in user chooses to connect their Google account, and can be disconnected at any time.

When you connect Google, Crest requests these scopes:

• openid, email, profile — to identify which Google account is connected and show it to you.
• https://www.googleapis.com/auth/drive — to let you browse, create, rename, and move the Drive folders and files that hold client documents (contracts, statements, visit and expense proof), and to link them to the correct school or record inside Crest.

What we do with it. Crest reads file and folder names, IDs, and the content of files you open or attach, solely to display them in the workspace and to save new documents where you ask. We store the OAuth tokens needed to keep the connection working on our servers, encrypted at rest when field encryption is configured, and never expose them to the browser. We store references (IDs, names, links) to Drive items; document bytes are fetched from Google when you open them.

You can revoke Crest's access at any time from your Google Account permissions page, or by disconnecting Google inside Crest. On disconnect we delete the stored tokens.

• Provide, secure, and support the workspace you were invited to.
• Authenticate you and enforce role-based permissions.
• Send transactional email such as invitations and renewal notices through authenticated SMTP.
• Keep the audit trail that financial and contractual accountability depends on.
• Diagnose faults, prevent abuse, and improve reliability.
• Respond to demo requests and support messages.

We do not sell or rent personal data. We share it only with:

• Your workspace. Colleagues see what their role permits. Confidential company-wide metrics are limited to Owners and Administrators.
• Infrastructure and integration providers that process data on our behalf: server hosting, email delivery (SMTP), Google (Drive, if you connect it) and Notion (task sync, if your workspace enables it). They may use the data only to deliver their service to us.
• Authorities, when required by law or to protect rights, safety, or the integrity of the service.

Every request is authorized on the server through layered controls: authenticated session, role and permission checks on every action, tenant scoping on every query, and database-level policies. Documents live in private storage and are served through short-lived signed links. Integration tokens are stored server-side and encrypted at rest when configured. Traffic is served over HTTPS.

No system is perfectly secure. If a breach affecting your data occurs, we will notify affected workspaces and, where required, the National Privacy Commission, without undue delay. See our Security page for the full model.

Financial, contractual, stock, document-version, and audit records are preserved by design and are corrected through void, reverse, or supersede rather than hard deletion, so that your organization's evidence stays intact. Unused drafts and dependency-free operational data may be deleted.

When a workspace ends, we delete or return its data on request, subject to records we are legally required to keep. Disconnecting Google removes the stored tokens immediately. Backups roll off on their normal cycle.

Under the Philippine Data Privacy Act of 2012 (RA 10173) and similar laws, you may request access to, correction of, or deletion of your personal data, object to or restrict certain processing, withdraw consent, and lodge a complaint with the National Privacy Commission. Because workspace records are controlled by your employer or client organization, we may route a request to them.

To exercise a right, write to privacy@crestcloud.app. We respond within 30 days. To delete your account, see how account deletion works or use Delete account in the mobile app's Settings & privacy.

Crest is a business tool for adults and is not directed at children. Student-level data is not the focus of the product; if a customer stores any, they are responsible for having a lawful basis to do so.

We will update this page when practices change and revise the “Last updated” date. For material changes we will also notify workspace Owners.

Questions or requests: privacy@crestcloud.app, or use the contact form. Crest · Manila, Philippines.