Privacy Policy

1. Who we are

The data controller is HeartQuake Sagl, the company behind Cresci.

HeartQuake Sagl
Via Rivascia 11
6518 Gorduno, Switzerland
Contact: privacy@cresci.kids

2. What we collect and why

This page covers data collected through cresci.kids (this website) and through the Cresci Device ordering flow. Data processing inside the Cresci application is described separately inside the app.

When you browse this website

• Basic technical data (browser, device type, locale, page visited) collected via privacy-respecting analytics to measure traffic and improve the site.
• Consent preferences, if cookies are used.

When you order a Cresci Device

• Contact details (email address, name) to confirm and fulfil the order.
• Shipping address to dispatch the device.
• Payment information is collected and processed directly by Stripe. We do not store your card details.
• Order history (what you bought, when, at what price) for accounting and customer-support purposes.

When you email us

The content of your message and your email address, to respond and for a reasonable period afterwards in case you contact us again about the same topic.

3. Legal bases

• Contract performance (GDPR Art. 6(1)(b)) — processing order, shipping, and customer-support data.
• Legal obligation (GDPR Art. 6(1)(c)) — keeping invoicing records for the period required by Swiss and applicable EU law.
• Legitimate interest (GDPR Art. 6(1)(f)) — basic analytics and fraud prevention, balanced against your privacy.
• Consent (GDPR Art. 6(1)(a)) — for any non-essential cookies or marketing communications, where applicable.

4. Who processes your data

• Stripe (payment processor). See stripe.com/privacy.
• Our shipping carrier (to deliver the device). Carrier will change depending on destination country.
• Infrastructure and email providers used to run the website and send transactional emails.
• We do not sell, rent, or trade your personal data.

Blog post images are served from substackcdn.com. Visiting a blog page discloses your IP address and Referer to Substack as a third party.

5. International transfers

HeartQuake Sagl is established in Switzerland. Your data may be transferred between Switzerland and the European Union for order fulfilment, and to other jurisdictions where our service providers operate. The European Commission recognises Switzerland as providing an adequate level of data protection.

6. Retention

• Order and invoicing records: kept for the period required by Swiss accounting law (currently 10 years).
• Customer-support correspondence: kept as long as needed to resolve the matter and for a reasonable period afterwards.
• Marketing data: kept until you unsubscribe or withdraw consent.

7. Your rights

Under GDPR and Swiss data-protection law you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion, subject to legal retention obligations.
• Restrict or object to certain types of processing.
• Receive your data in a portable format.
• Withdraw consent at any time, without affecting past lawful processing.
• Lodge a complaint with your national data-protection authority.

To exercise any of these rights, email privacy@cresci.kids. We respond within one month.

8. Security

We use reasonable technical and organisational measures to protect your data, including transport encryption (HTTPS) and limiting access to authorised personnel. No system is perfectly secure; we do our best, and if a breach affects you we will notify you in line with applicable law.

9. Changes

We may update this policy. Material changes will be indicated by the "Last updated" date at the top of the page.