Privacy Policy

This Privacy Policy explains how Crema Manager (the “Service”), operated by SP Hospitality Group on behalf of Crema Gourmet (“we”, “us”, or “our”), collects, uses, and protects information. Crema Manager is an internal business platform used by authorized Crema Gourmet staff and franchisees to manage stores, customers, reviews, and related operations.

Information we collect

• Account information. Your name, email address, role, and authentication credentials, used to sign you in and control access.
• Business data. Information about Crema Gourmet stores and franchises, and content you create in the Service such as notes, to-dos, requests, and broadcasts.
• Customer data. Customer records you import (for example, from Square point-of-sale exports), which may include names, email addresses, phone numbers, and purchase history. This data is used solely for the marketing and operational purposes of Crema Gourmet.
• Google account data. When you connect a Google Business Profile, we access certain Google data on your behalf (see below).
• Usage and technical data. Basic logs needed to operate and secure the Service.

Google user data

When you choose to connect a store’s Google Business Profile, we request the business.manage scope through Google OAuth. With your authorization, we use this access to:

• read the Google Business Profile locations available to your account;
• read reviews for your connected locations; and
• post replies to those reviews on your behalf when you choose to.

To provide these features, we store the reviews we retrieve and the OAuth tokens required to keep your connection active. You can revoke this access at any time from your Google Account permissions page or by disconnecting the store inside the Service.

Limited Use disclosure.Crema Manager’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, and we do not sell it or transfer it to third parties except as necessary to provide the Service, comply with law, or with your consent.

QuickBooks data

When an authorized administrator connects a store’s QuickBooks Online company, we request the com.intuit.quickbooks.accounting scope through Intuit’s OAuth. We use this access only to read that company’s profit and loss report by month, its chart of accounts, its company name and its books’ closing date, so authorized staff can compare each store’s estimated results with its books. We never create, change or delete anything in QuickBooks.

We store the figures we read and the OAuth tokens needed to keep the connection active; the tokens are encrypted at rest and never shown in the Service. The data is visible only to authorized Crema Gourmet staff, is not sold, and is not used for advertising. An administrator can disconnect a company at any time inside the Service, which revokes the connection with Intuit, or from QuickBooks (Apps, then My apps).

How we use information

• To operate, maintain, and improve the Service.
• To display reviews, customer insights, and operational tools to authorized users.
• To send transactional and operational communications.
• To secure the Service and prevent abuse.

How we share information

We do not sell personal information. We share information only with service providers that help us run the Service, and only as needed for them to perform their functions:

• Supabase — application database and authentication hosting.
• Google — Business Profile data for connected stores.
• Square — source of customer data you choose to import.
• Resend — delivery of operational email.

We may also disclose information if required by law or to protect our rights, users, or the public.

Data retention

We retain information for as long as needed to provide the Service and for legitimate business or legal purposes. You may request deletion of data you control by contacting us, and disconnecting a Google connection stops further syncing for that store.

Security

We use industry-standard safeguards, including encrypted transport and access controls, to protect information. No method of transmission or storage is completely secure, but we work to protect your data and restrict access to authorized users.

Your choices

• Disconnect a Google Business Profile at any time from the store page.
• Revoke Crema Manager’s Google access from your Google Account permissions page.
• Request access to or deletion of data you control by contacting us.

Children

The Service is intended for business use by authorized adults and is not directed to children.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above.

Contact us

If you have questions about this Privacy Policy or your data, contact us at joser@sphospitalitygroup.com.