Data Retention Policy

This policy explains how long Cribble keeps each category of data and what happens when it is deleted. Deletion means permanent removal of the underlying records and files — not archiving or soft-deletion. Residual copies may persist in our database provider's point-in-time recovery system for up to 30 days before expiring. Where a deletion job runs on a schedule, it runs at least daily. We retain specific data longer only where, and for as long as, the law requires.

Documents and extracted data

• Active workspace: documents you have submitted, and the data extracted from them (including any bank or payment details found in them), are kept for as long as your workspace is active, so that your records remain available to you.
• Exported documents: once a document has been posted to your connected accounting software, it is automatically and permanently deleted after a retention period you choose in workspace settings — 1, 7, 30, or 60 days (default 7) from confirmed posting. Only a content-free audit event remains.
• Extracted bank and payment details exist only inside the document record they were read from, and are deleted with it.

Workspace deletion

• A workspace Admin can delete the workspace from settings at any time. Deletion enters a 7-day grace window during which any Admin can cancel it; the workspace stops accepting new documents immediately.
• When the grace window ends, everything is permanently deleted: original document files, all extracted data and document links, accounting connections and coding, approval history, workspace memberships, and the forwarding address. The workspace's subscription is cancelled at the same time.
• Stripe retains billing records (invoices and payment history) only as far as financial record-keeping laws require.

End of subscription

• If your subscription ends and is not renewed, your data is retained for 90 days so you can re-subscribe and pick up where you left off. During this period the workspace shows a prominent deletion warning.
• 90 days after the subscription ends, the workspace and all of its data are permanently deleted, exactly as in a workspace deletion.

Account and billing records

• Your user account (name, email) is handled by our authentication provider WorkOS and is retained until you ask us to delete it at privacy@cribble.co.
• Billing records are kept by Stripe as long as tax and accounting laws require, typically seven years.
• Technical service logs are retained for a short operational window and then discarded; they do not contain document contents.

Public demo

• A document uploaded to the demo on our website is never stored. It is held in memory for the length of that one request, passed to extraction, and discarded when the result is returned — it is not written to document storage and never becomes a record in any workspace.
• The email address entered on the demo is kept for 24 months and then deleted, or sooner on request. We also keep the type of document the demo classified and whether extraction succeeded, which say nothing about the document's contents.
• The one-way salted hash of the visitor's network address used to enforce the one-document-per-day limit is erased the day after it was used.

Integration requests

• A request made on our integrations page — the integration asked for, the system named if the visitor typed one, and the email address given if they asked to be told when it ships — is kept for 24 months and then deleted, or sooner on request.
• The one-way salted hash of the visitor's network address that holds one visitor to one request per integration is kept for as long as the request it belongs to, because it is what stops the same request being counted twice.

AI processing

Document contents sent to AI models for extraction pass through Cloudflare's AI Gateway with Zero Data Retention enabled and are not retained by the gateway or the model provider. This applies equally to documents run through the public demo.

Requests

Deletion and export beyond the self-serve tools — including data portability requests — can be requested at privacy@cribble.co. We respond within the timeframe applicable law requires.