Privacy Policy

1. Introduction

This Privacy Policy describes how Fabrx ("we," "our," or "us") handles information across our products. It applies to this website at www.fabrx.ai, to the document extraction service we build and operate for clients, and to Fabrx Acquire at acquire.fabrx.ai.

We run two products, and they treat documents differently. Where a rule in this policy applies to only one of them, we name it.

Fabrx Extraction. We build document extraction for your documents, connect it to the systems you already use, and operate it. Documents you submit pass through for processing and are not retained by default.

Fabrx Acquire (acquire.fabrx.ai). An accounting firm registers a client company and issues a connect link. The owner of the mailbox opens that link and grants read-only access to their business mailbox, which may be Gmail or Google Workspace, Microsoft 365, or IMAP. Acquire captures invoices, receipts, credit notes and purchase orders from the attachments that arrive there, and delivers them to the accounting firm through a dashboard, a REST API and webhooks. Acquire retains the documents it captures, because they are accounting records the firm relies on.

By using our Service, you agree to this policy.

2. Information We Collect

We collect the following categories of information.

Documents you send us. During scoping you send a small number of representative documents so we can build and test the extraction. In production we receive the documents you submit for processing. These may contain personal data, depending on the document type. We accept redacted samples, and we will sign a non-disclosure agreement on request.

Data extracted from those documents. The structured values we return to you and to the systems you nominate.

Contact details. Name, email address and anything you write when you use our contact form, request pricing, or book a call. Bookings are handled by Calendly, whose own privacy policy applies to what you enter there.

Usage data. Standard analytics about how this website is used, such as pages viewed and approximate location derived from IP address.

Mailbox data, in Fabrx Acquire only. When a mailbox owner connects a mailbox, we collect the mailbox address, the provider, the connection status, and the access credentials for that mailbox. From the mail itself we collect only what section 12 describes: the attachment files we classify as financial documents, and a small set of message details that identify them. We do not collect message bodies.

3. How We Use Your Information

We use information to operate, maintain, and improve the Service, to communicate with you, and to comply with legal obligations.

4. Data Processing and Storage

Fabrx Extraction

We do not store your documents by default. Documents are processed and then discarded. We do not keep a copy once processing is complete, and we do not use your documents or the data extracted from them to train any AI model, ours or a provider's.

The one exception is data lineage, an optional feature you switch on yourself. When enabled, we retain fragments of the source document showing where each extracted value came from, so an extraction can be audited or proved correct later. Those fragments are encrypted at rest. The feature is off unless you turn it on, and you can turn it off again at any time.

Sample documents sent during scoping are deleted once the build is complete, unless you have asked us to retain them for further tuning.

Fabrx Acquire

Acquire retains the documents it captures. Persistent capture is the purpose of the product. The captured documents are accounting records that the accounting firm relies on, so we keep them for as long as that firm's account is active.

Attachments we do not capture are never written to disk. Acquire classifies every attachment before it stores anything. An attachment that is not a financial document, or whose buyer is not the business that owns the mailbox, is discarded in memory.

Disconnecting a mailbox stops all further capture immediately and revokes our access to the provider. It leaves the documents already captured in place, so the firm's records stay complete. Disconnection and erasure are two separate actions, described in section 12.

Erasure of captured documents is available on request. Write to privacy@fabrx.ai. We complete erasure within 30 days of the request, except where retention is required by law.

Downloads use signed links that expire after 15 minutes.

Processing for both products takes place on infrastructure in the European Union and with the sub-processors listed in section 11. Retention periods for contact and billing records follow our legal and accounting obligations.

5. Data Sharing and Disclosure

We do not sell your personal information. We may share information with service providers, business partners, or as required by law.

6. Security

We implement reasonable security measures to protect your information. However, no system is completely secure, and we cannot guarantee absolute security.

7. Your Rights and Choices

You may access, update, or delete your information through your account settings. You can manage cookie preferences through your browser. You may opt out of marketing communications at any time.

8. Privacy Rights

Depending on your location, you may have certain rights regarding your personal information, including rights to access, correct, delete, or port your data. To exercise these rights, contact us at privacy@fabrx.ai.

9. Children's Privacy

Our Service is not intended for individuals under 18. We do not knowingly collect information from children.

10. International Data Transfers

Your information may be transferred to and processed in various countries. We implement appropriate safeguards as required by applicable law.

11. Third-Party Services and Sub-processors

We use the sub-processors below. Our Service may also link to third-party services we do not control, and we are not responsible for their privacy practices.

Document processing and extraction

• OpenAI and Anthropic — model providers used to extract data from documents.
• Microsoft Azure — document text recognition and extraction.

Fabrx Acquire

• Supabase — database and file storage, European Union region.
• Vercel — hosting.
• Railway — background processing.
• Microsoft Azure — document text recognition and extraction.
• Resend — transactional email. Receives email addresses only, never document content.
• PostHog — product analytics. Receives counts and identifiers only, never message or document content.
• EU VIES — VAT number validation. Receives supplier VAT numbers only.

12. Google User Data

Fabrx Acquire can connect to a Gmail or Google Workspace mailbox to capture financial documents from the attachments that arrive in it. This section describes exactly what Google user data we access, what we do with it, and how you control it.

The scope we request

Acquire requests exactly one Google scope: https://www.googleapis.com/auth/gmail.readonly. It requests no other scope. It does not request openid, email or profile, and no Fabrx product offers "Sign in with Google". After you grant consent, we read the mailbox address from the Gmail profile API so that the connected mailbox can be identified in the dashboard.

What we read, and what we never do

We never send, reply to, forward, modify, label, archive, trash or delete mail. The scope we request does not permit those actions, and no part of our code attempts them.

We do not read message bodies. We read message structure to find the attachment parts, plus three headers: From, Subject and Date.

We ask Gmail for messages using a server-side filter: messages with attachments, in the inbox, within a date window. Messages without attachments are never returned to us. When a mailbox is first connected we look back 90 days. After that we receive only new mail, through Gmail push notifications.

What we store

Acquire classifies every attachment before it stores anything. An attachment that is not a financial document, or whose buyer is not the business that owns the mailbox, is discarded in memory and never written to disk.

For each document we do capture, we store: the attachment file itself; the sender address and display name; the subject line; the date received and the issue date printed on the document; the original filename, size and MIME type; a SHA-256 hash of the file bytes, used to detect duplicates; the supplier name, VAT number, country and bank details read off the document, used for bookkeeping and for payment-fraud checks; and a provider message identifier.

For each connected mailbox we store: the address, the provider, the connection status, and the OAuth tokens. Tokens are encrypted at rest with AES-256-GCM. They are never written to logs, never shown in the interface, and never returned by any API.

Document downloads are served through signed links that expire after 15 minutes.

How we use it

Google user data is used only to provide the features described above. We do not use Gmail data for advertising. We do not allow humans to read your Gmail data unless we have your explicit permission for a specific message, it is necessary for security purposes (such as investigating abuse), it is required to comply with applicable law, or the data has been aggregated and anonymized for internal operations. We do not use Google user data to develop, improve, or train generalized artificial intelligence or machine learning models.

Sharing

We do not sell Google user data and do not transfer it to third parties except as necessary to provide the features you requested, for security purposes, to comply with applicable law, or as part of a merger or acquisition with prior notice to you. The sub-processors that may receive it are listed in section 11.

Revoking access, and erasing data

These are two separate actions with different effects. Doing the first does not do the second.

Revoking access stops all further capture from that mailbox immediately, and we delete the stored credential for it. You can revoke at any time from your Google Account security settings, or by disconnecting the mailbox in Acquire. Revocation does not by itself delete the documents already captured, because the accounting firm relies on them as its records.

Erasure removes the documents already captured. Request it at privacy@fabrx.ai. We complete erasure within 30 days of the request, except where retention is required by law.

Limited Use disclosure

Fabrx's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

13. Changes to This Privacy Policy

We may update this policy at any time. Continued use of the Service after changes constitutes acceptance of the updated policy.

14. Contact Us

For questions about this Privacy Policy, contact us at: