Privacy

Cresard Desk is a desktop application maintained by Cresard (“we”). This page covers the Cresard Desk desktop app, the API behind it and this website. It describes what we hold, not what a third party does with data you choose to send somewhere else.

Your account. Name, email address, role, status and a password hash. The hash is produced with Argon2id - we never hold your password and we cannot recover it. We also keep a record of sign-in attempts (time, address, IP, whether it succeeded) so that a locked account can be diagnosed properly.

Business records you create. Clients, documents, line items, amounts, tax details and any media you point at. This is your data; we hold it on your behalf so that your team sees the same records.

An audit trail. Administrative actions - an account created, a role changed, a password reset - are recorded with who did it and when.

No advertising or analytics cookies on this site. No analytics or usage telemetry from the desktop app. No crash reports unless the desktop application is later given an explicit, opt-in reporting switch.

Your letterhead, logo, seal and signature files stay on your machine unless you deliberately store one at a remote address. Local files are read to render a document and are not uploaded.

Cresard Desk works completely without AI. No model is bundled and nothing is downloaded without asking you first.

If you configure a model, inference happens wherever you chose to run it - on your own machine, on a server you host, or through a third-party API you supplied a key for. In the third case the text you send is handled by that provider under their terms, not ours. We do not proxy it and we do not receive a copy.

This website sets one cookie, cresard_refresh, to keep you signed in. It is httpOnly - scripts on the page cannot read it - and it is scoped to the authentication routes. There are no third-party or advertising cookies. The desktop app stores its equivalent credential in the Windows Credential Manager rather than a cookie jar.

We use a small number of service providers: MongoDB Atlas for storage, Vercel for hosting the website and API and Resend for sending email. They process data on our instructions and are not permitted to use it for their own purposes. We do not sell data and we do not share it for advertising.

Sign-in sessions expire after 30 days of inactivity. Records of failed sign-in attempts are deleted after 90 days. Invitations are deleted 30 days after they expire. Business records and the audit trail are kept until you or an administrator removes them, because they underpin documents that may need to be produced years later.

Passwords are hashed with Argon2id. Session and reset tokens are stored only as keyed hashes, so a copy of the database cannot be replayed to sign in. Traffic is HTTPS only. Access to production data is restricted to the credentials the API runs under, which are not distributed in the desktop application.

No system is perfectly secure. If you believe an account has been compromised, ask an administrator to revoke its sessions and change the password.

You can ask to see, correct or delete the personal data on your account. Because Cresard Desk accounts are created by an administrator, the fastest route is usually that administrator. You can also write to contact@cresard.com.

Deleting your account does not automatically delete business records, since those may be shared with your team and are needed for tax and accounting purposes. An administrator can decide what to remove.

If this page changes in a way that materially affects you, we will say so in the product release notes.