Privacy Policy

Controller

VISIONER PTE. LTD., UEN 202314121N, Singapore, is the controller for personal data processed through the CrabiX website, account, support, and product services we operate. You can contact us at support@crabix.ai.

Paddle acts as merchant of record and authorized reseller for paid purchases. Paddle processes checkout, payment, tax, invoice, subscription, refund, and fraud-prevention data under its own privacy terms.

Data we may collect

• Website data, such as IP address, browser type, device information, pages visited, approximate location, referrer, and security logs.
• Account data, such as name, email address, authentication data, plan status, preferences, and workspace settings if you create an account.
• OAuth sign-in data, such as your basic profile and email address when you choose to sign in with Google, GitHub, or Apple. CrabiX uses this data only to create, secure, and manage your account, dashboard access, subscriptions, invoices, referrals, product entitlements, support, and account recovery.
• Billing-related data received from Paddle, such as customer ID, subscription status, purchased plan, renewal status, country, tax status, and transaction metadata. We do not receive or store full card numbers.
• Support data, such as messages, diagnostics, screenshots, attachments, and contact details you send to us.
• Optional product telemetry, such as app version, operating system, crash reports, feature usage, and routing health metrics if enabled or required for security and reliability.

What stays local

CrabiX is designed as local-first software. API keys, provider credentials, prompts, model responses, project files, local chat history, MCP server configuration, and local routing configuration are intended to remain on your device unless you choose to transmit them to a provider, sync service, support channel, or other integration.

AI providers you connect may receive prompts, files, outputs, metadata, or other data you send through them. Their handling of that data is governed by their own terms and privacy policies.

How we use data

• Provide, secure, maintain, and improve CrabiX.
• Create and manage accounts, subscriptions, access rights, product updates, and support requests.
• Authenticate users who choose social sign-in or email sign-in. For Google sign-in, CrabiX requests basic profile and email only and does not request Gmail, Drive, Calendar, contacts, or other restricted Google scopes. For email sign-in, CrabiX uses your email address and a one-time code for account access and recovery.
• Process billing events, entitlement changes, cancellations, refunds, tax records, and fraud-prevention signals with Paddle.
• Send service emails, security notices, product updates, and marketing messages where permitted by law or with consent where required.
• Comply with legal obligations, enforce our terms, prevent abuse, and protect users, CrabiX, Paddle, and third parties.

Legal bases

Where GDPR, UK GDPR, or similar laws apply, we rely on contract performance, legitimate interests, consent, and legal obligations depending on the processing activity. You may withdraw consent where processing is based on consent.

Sharing

We may share data with service providers that help us host, secure, analyze, support, communicate, and operate CrabiX. We may also share data with Paddle for billing and compliance, with AI providers you choose to connect, with professional advisors, or with authorities where legally required. Current providers include Cloudflare (hosting, security, web analytics) and Microsoft (Clarity usability analytics and AI-crawler traffic analytics based on Cloudflare traffic data).

We do not sell personal information for money. We do not use personal data to build third-party advertising profiles.

Retention

We retain personal data only as long as reasonably needed for the purposes described in this policy, including account operation, support, security, legal, tax, audit, and dispute requirements. Local app data stored on your device remains under your control unless you share or sync it.

Cookies and analytics

The CrabiX website sets no advertising cookies and no analytics cookies. Essential first-party cookies or similar technologies may be used for security, preferences, and basic operation, including a download attribution cookie (crabix_signup_attribution, 30 days) that records which download link you used so that a later account sign-up can be attributed to it.

For traffic and usability analytics we use two services that work without cookies: Cloudflare Web Analytics (page views, referrers, and Core Web Vitals measured in the browser; no cookies, no fingerprinting, no cross-site tracking) and Microsoft Clarity in cookieless mode (aggregated heatmaps, click and scroll data, session replays with text and form fields masked, browser and device type, and approximate country derived from your IP address). Clarity is configured not to set cookies, so no persistent identifier is stored in your browser and separate page views are not stitched into a profile. Microsoft processes this data on our behalf under the Microsoft Privacy Statement; we do not use it for advertising or profiling.

Separately from the browser script, Microsoft Clarity's AI Visibility feature reads server-side traffic analytics for crabix.ai from Cloudflare through an API connection we authorised: aggregated request statistics (request counts by URL path, user agent, response status, country, and Cloudflare's bot classification) that show how AI crawlers and other automated systems access the site. This is edge-level data about requests to the site rather than data collected in your browser; it involves no cookies, and we use it only to measure automated and AI-crawler traffic.

You can block these analytics scripts with a content blocker or your browser's privacy settings without affecting the website. If we add analytics or marketing cookies in the future, we will disclose them here and ask for consent where required.

Your rights

Depending on where you live, you may have rights to access, correct, delete, export, restrict, or object to processing of your personal data. You may also have the right to withdraw consent or lodge a complaint with a data protection authority.

California residents may have additional rights under the CCPA/CPRA, including rights to know, delete, correct, and opt out of certain sharing. CrabiX does not currently sell personal information.

Security, children, and updates

We use reasonable administrative, technical, and organizational safeguards designed to protect personal data. No method of transmission or storage is completely secure.

CrabiX is not intended for children under 13, and we do not knowingly collect personal data from children under 13.

We may update this policy from time to time. The updated version will be posted on this page with a new "Last updated" date.