Privacy Policy

1. Who we are

Cribble is operated by Abbika LLC, 30 North Gould Street, Sheridan, WY 82801, United States. For privacy matters, contact privacy@cribble.co.

Cribble wears two hats under data protection law. For your account, billing, and usage data, we are the controller — we decide how that data is used. For the personal data inside the documents you send us (supplier names, bank details, invoice contents), we are a processor acting on your instructions; you (or your client, if you are a bookkeeping practice) are the controller. Our Data Processing Agreement governs that processing.

2. Data we collect

• Account data: your name, email address, and workspace membership, managed through our authentication provider WorkOS.
• Billing data: subscription and payment details, handled by Stripe. We never see or store full card numbers.
• Document data (as processor): the documents you forward or upload, and the structured data extracted from them — which can include names, addresses, bank account details, and transaction information about your suppliers, customers, and employees.
• Service logs: technical logs (timestamps, request metadata, error details) needed to run and secure the service. We do not run analytics or advertising trackers.

3. How we use data

• To provide the service: receiving, storing, classifying, and extracting your documents, and posting results to integrations you connect.
• To run your subscription: billing, seat management, and renewal through Stripe.
• To secure and support the service: authentication, abuse prevention, debugging, and responding to your requests.
• We do not use your documents or extracted data to train AI models, and we do not sell personal data or share it for advertising.

4. AI processing

Document classification and extraction use Google's Gemini models, accessed exclusively through Cloudflare's AI Gateway with Zero Data Retention enabled: prompts and document contents are not retained by the gateway or the model provider beyond what is needed to return a response, and are not used for model training. Structured e-invoice formats (Factur-X, XRechnung, Peppol) are parsed deterministically without any AI involvement.

5. Who we share data with

We share data only with the subprocessors needed to run the service — hosting, AI extraction, authentication, billing, and the accounting integrations you choose to connect. The current list, and what each one does, is published on our Subprocessors page. We will update that page at least 30 days before adding a new subprocessor.

We may also disclose data where the law requires it, or as part of a merger or acquisition, in which case this policy continues to apply to the transferred data.

6. Data retention

Retention is covered in detail in our Data Retention Policy. In short: your documents and data are kept while your workspace is active; documents posted to your accounting software are automatically deleted after a retention period you configure (1, 7, 30, or 60 days); workspace deletion takes effect after a 7-day grace window; and if your subscription ends, the entire workspace is permanently deleted 90 days later.

7. Your rights

Depending on where you live — including under the EU and UK GDPR, US state privacy laws such as the CCPA/CPRA, and the Australian Privacy Act 1988 — you may have the right to access, correct, delete, export, or restrict the processing of your personal data, and to complain to a supervisory authority. To exercise any of these rights, email us and we will respond within the timeframe the applicable law requires.

If your personal data appears inside a document that one of our customers processed with Cribble, that customer is the controller of that data. Per standard processor practice, please direct your request to them; we act on our customers' instructions and provide them the tools to delete and export their data.

8. International transfers

Abbika LLC is based in the United States, and our subprocessors operate globally. Where personal data protected by EU, UK, or Swiss law is transferred internationally, the transfer is safeguarded by the European Commission's Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, or another lawful safeguard, incorporated into our Data Processing Agreement and into our agreements with each subprocessor.

9. Security

Documents and data are stored with Cloudflare (R2 object storage and D1 database) and encrypted in transit and at rest. Accounting integration tokens are additionally encrypted at the application layer with AES-256-GCM. Access within a workspace is controlled by roles, and every server action is authorization-checked. If a breach affects your personal data, we will notify you without undue delay and no later than the law requires.

10. Cookies

Cribble sets exactly one cookie: an encrypted session cookie from our authentication provider, WorkOS, which keeps you signed in. It is strictly necessary for the service to function. We use no analytics, advertising, or other non-essential cookies — which is why you don't see a cookie consent banner.

11. Children

Cribble is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 18.

12. Changes to this policy

We will post any changes on this page and, for material changes, notify you in the app or by email at least 30 days in advance. The date at the top shows the latest revision.

13. Contact

privacy@cribble.co · Abbika LLC, 30 North Gould Street, Sheridan, WY 82801, United States