CREAM CONNECT / TRANSPARENCY

Privacy, with fewer surprises.

Effective 17 October 2026. This page explains the Cream Connect comparison website. The existing application privacy policy continues to describe the retained app. Contact creamconnect.in@gmail.com about privacy or deletion requests.

Searches and retailer connections

To retrieve products, we send your search phrase and chosen country to configured shopping providers. Depending on which accounts are connected, these may include Amazon Creators API, Flipkart Affiliate API, eBay Browse API and SerpApi. Avoid entering personal or sensitive information in product searches.

First-party measurement

When measurement is enabled, a random browser session identifier helps count daily visits, product searches and outbound product clicks. We store its daily keyed hash alongside search phrases, selected country, result counts, retailer name and timing. We record referring domains, without their URL paths or query strings. We do not persist raw IP addresses or user-agent strings in comparison analytics. Activity records automatically expire after 90 days. Temporary rate-limit checks use an in-memory keyed hash of the connecting IP.

Browser choices

The country preference is stored on your device. A random visit identifier is stored in session storage and is transformed before analytics storage. We honour supported Do Not Track and Global Privacy Control signals. If your browser blocks session storage, anonymous measurement is skipped. Server administrators can pause comparison measurement.

When you open a store

You leave Cream Connect and the retailer’s privacy and cookie policies apply. Affiliate links may contain the provider’s tracking information. Our signed product links include the product destination, search country and phrase, expire after ten minutes, and may carry a daily anonymous visit hash for counting outbound clicks. We do not receive your retailer password or payment details.

Images and fonts

Product images may load from a provider’s image servers. Fonts load from Google Fonts, and retailer icons may load from Google’s favicon service. Those services receive ordinary connection information, including your IP address. Images and outbound store links use a no-referrer policy.

Administrator access

Administrator sign-in uses Firebase email/password or Google sign-in and existing approved administrator permissions. The short-lived admin session is kept in your browser’s session storage. Product API credentials and approved affiliate link templates are encrypted before database storage and are not returned to public pages or the dashboard. PAN, bank information and payout verification should be submitted directly to the affiliate provider.

Security and operational records

Hosting and service providers may maintain security and access logs under their own operational settings. The 90-day deletion described above applies to our comparison activity collection. Contact us to ask about access or deletion of information you believe relates to you.