Privacy Policy

1. Who we are

Cribble is operated by Abbika LLC, 30 North Gould Street, Sheridan, WY 82801, United States. For privacy matters, contact privacy@cribble.co.

Cribble wears two hats under data protection law. For your account, billing, and usage data, we are the controller — we decide how that data is used. For the personal data inside the documents you send us (supplier names, bank details, invoice contents), we are a processor acting on your instructions; you (or your client, if you are a bookkeeping practice) are the controller. Our Data Processing Agreement governs that processing.

If you use the public demo on our website without an account, we are the controller for the email address you enter there. The document you upload to the demo is a separate matter and is covered in section 4a: it is read in memory and never stored.

The same applies if you ask us for an integration on our integrations page: we are the controller for anything you enter there, which is covered in section 4b.

2. Data we collect

• Account data: your name, email address, and workspace membership, managed through our authentication provider WorkOS.
• Billing data: subscription and payment details, handled by Stripe. We never see or store full card numbers.
• Document data (as processor): the documents you forward or upload, and the structured data extracted from them — which can include names, addresses, bank account details, and transaction information about your suppliers, customers, and employees.
• Document history (as processor): a record of who handled each document and when — the workspace member who uploaded, approved, or exported it, and the sender address of any document emailed to your workspace. This history is deleted with the document it belongs to.
• Service logs: technical logs (timestamps, request metadata, error details) needed to run and secure the service.
• Website analytics: aggregate page-view and page-speed measurements across our website, including the signed-in app, using Cloudflare Web Analytics — our existing hosting provider, not a separate advertising company. It records the page address visited, referrer, browser, operating system, and country. It sets no cookies, stores nothing in your browser, and does not fingerprint you or build a profile, so it cannot follow you between sites or identify you. We run no advertising trackers anywhere, and we do not sell or share this data.
• Referral tag: if you arrive through a link carrying a campaign tag (for example ?ref=partner), that short tag is stored once on the workspace you create so we can tell which channels work. Nothing is stored in your browser.
• Public demo (as controller): the email address you enter, the type of document the demo classified (for example "invoice"), whether the extraction succeeded, and a one-way salted hash of your network address used only to enforce the one-document-per-day limit. We do not store the document itself or any field extracted from it.
• Integration requests (as controller): the integration you asked for on our integrations page, the name of the system you typed if you named one yourself, the email address you gave us if you asked to be told when it ships, and a one-way salted hash of your network address used only to keep one visitor to one request per integration.

3. How we use data

• To provide the service: receiving, storing, classifying, and extracting your documents, and posting results to integrations you connect.
• To run your subscription: billing, seat management, and renewal through Stripe.
• To secure and support the service: authentication, abuse prevention, debugging, and responding to your requests.
• We do not use your documents or extracted data to train AI models, and we do not sell personal data or share it for advertising.

4. AI processing

Document classification and extraction use Google's Gemini models, accessed exclusively through Cloudflare's AI Gateway with Zero Data Retention enabled: prompts and document contents are not retained by the gateway or the model provider beyond what is needed to return a response, and are not used for model training. Structured e-invoice formats (Factur-X, XRechnung, Peppol) are parsed deterministically without any AI involvement.

4a. The public demo

Our website offers a demo that reads one document you upload, without an account. The document is held in memory for the length of that single request and is passed to the same AI extraction described above. It is never written to our document storage, never becomes a record in any workspace, and is gone the moment the result is returned to your screen — there is no copy for us to retrieve, disclose, or delete later. Do not upload a document you are not entitled to share with a processor.

The email address you enter is different: we keep it, and we are the controller for it. Our lawful basis is legitimate interests — following up with someone who has actively asked to see how our product handles their own document — balanced against the fact that you chose to enter it and can have it removed at any time. We use it to contact you about Cribble and for nothing else. We do not sell it, we do not share it for advertising, and it is not added to any list you cannot leave.

We keep a demo email address for 24 months from the day you enter it, then delete it. To have it deleted sooner, email privacy@cribble.co and we will remove it and confirm.

To stop the demo being abused we also keep a one-way salted hash of your network address for the rest of the day it was used, which lets us enforce the one-document-per-day limit without holding the address itself. It is erased automatically after that.

The upload sits behind Cloudflare Turnstile, a bot check that receives your IP address and browser characteristics so it can tell a person from a script. Cloudflare is our hosting provider and is named on our subprocessor list. It sets no cookies and stores nothing in your browser.

4b. Integration requests

Our integrations page lets you tell us which accounting or document system you want Cribble to connect to. Asking for one takes no email address and no account: we record the integration itself, and a one-way salted hash of your network address so that one visitor counts once per integration rather than as many times as they click. That hash cannot be turned back into your address, and we keep it for no other purpose.

If you additionally ask to be told when an integration ships, we keep the email address you gave us and are the controller for it. Our lawful basis is legitimate interests — telling someone the thing they asked for now exists — balanced against the fact that you chose to enter it. We use it to email you about that integration and about Cribble, nothing else, and every message we send you carries an unsubscribe link. We do not sell it or share it for advertising, and you can have it deleted at any time at privacy@cribble.co.

We keep an integration request, and any address attached to it, for 24 months and then delete it.

5. Who we share data with

We share data only with the subprocessors needed to run the service — hosting, AI extraction, authentication, billing, and the accounting integrations you choose to connect. The current list, and what each one does, is published on our Subprocessors page. We will update that page at least 30 days before adding a new subprocessor.

We may also disclose data where the law requires it, or as part of a merger or acquisition, in which case this policy continues to apply to the transferred data.

6. Data retention

Retention is covered in detail in our Data Retention Policy. In short: your documents and data are kept while your workspace is active; documents posted to your accounting software are automatically deleted after a retention period you configure (1, 7, 30, or 60 days); workspace deletion takes effect after a 7-day grace window; and if your subscription ends, the entire workspace is permanently deleted 90 days later. A document uploaded to the public demo is never stored at all; the email address entered there is kept for 24 months.

7. Your rights

Depending on where you live — including under the EU and UK GDPR, US state privacy laws such as the CCPA/CPRA, and the Australian Privacy Act 1988 — you may have the right to access, correct, delete, export, or restrict the processing of your personal data, and to complain to a supervisory authority. To exercise any of these rights, email us and we will respond within the timeframe the applicable law requires.

If your personal data appears inside a document that one of our customers processed with Cribble, that customer is the controller of that data. Per standard processor practice, please direct your request to them; we act on our customers' instructions and provide them the tools to delete and export their data.

8. International transfers

Abbika LLC is based in the United States, and our subprocessors operate globally. Where personal data protected by EU, UK, or Swiss law is transferred internationally, the transfer is safeguarded by the European Commission's Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, or another lawful safeguard, incorporated into our Data Processing Agreement and into our agreements with each subprocessor.

9. Security

Documents and data are stored with Cloudflare (R2 object storage and D1 database) and encrypted in transit and at rest. Accounting integration tokens are additionally encrypted at the application layer with AES-256-GCM. Access within a workspace is controlled by roles, and every server action is authorization-checked. If a breach affects your personal data, we will notify you without undue delay and no later than the law requires.

10. Cookies

Cribble sets exactly one cookie: an encrypted session cookie from our authentication provider, WorkOS, which keeps you signed in. It is strictly necessary for the service to function. Our website analytics is cookieless and stores nothing in your browser.

The bot check in front of the public demo — Cloudflare Turnstile — sets no cookies either. We checked that in a clean browser rather than assuming it. We use no advertising, profiling, or other non-essential cookies anywhere, which is why you don't see a cookie consent banner.

11. Children

Cribble is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 18.

12. Changes to this policy

We will post any changes on this page and, for material changes, notify you in the app or by email at least 30 days in advance. The date at the top shows the latest revision.

13. Contact

privacy@cribble.co · Abbika LLC, 30 North Gould Street, Sheridan, WY 82801, United States