# Privacy Policy — CrabiX > Published: June 13, 2026 · Last updated: June 30, 2026 · Operator: VISIONER PTE. LTD., D-U-N-S 599420573, UEN 202314121N, Singapore This policy explains what personal data CrabiX processes, what stays local, and how billing data is handled when you buy through Paddle. ## Controller VISIONER PTE. LTD., UEN 202314121N, Singapore, is the controller for personal data processed through the CrabiX website, account, support, and product services we operate. You can contact us at support@crabix.ai. Paddle acts as merchant of record and authorized reseller for paid purchases. Paddle processes checkout, payment, tax, invoice, subscription, refund, and fraud-prevention data under its own privacy terms. ## Data we may collect - Website data, such as IP address, browser type, device information, pages visited, approximate location, referrer, and security logs. - Account data, such as name, email address, authentication data, plan status, preferences, and workspace settings if you create an account. - OAuth sign-in data, such as your basic profile and email address when you choose to sign in with Google, GitHub, or Apple. CrabiX uses this data only to create, secure, and manage your account, dashboard access, subscriptions, invoices, referrals, product entitlements, support, and account recovery. - Billing-related data received from Paddle, such as customer ID, subscription status, purchased plan, renewal status, country, tax status, and transaction metadata. We do not receive or store full card numbers. - Support data, such as messages, diagnostics, screenshots, attachments, and contact details you send to us. - Optional product telemetry, such as app version, operating system, crash reports, feature usage, and routing health metrics if enabled or required for security and reliability. ## What stays local CrabiX is designed as local-first software. API keys, provider credentials, prompts, model responses, project files, local chat history, MCP server configuration, and local routing configuration are intended to remain on your device unless you choose to transmit them to a provider, sync service, support channel, or other integration. AI providers you connect may receive prompts, files, outputs, metadata, or other data you send through them. Their handling of that data is governed by their own terms and privacy policies. ## How we use data - Provide, secure, maintain, and improve CrabiX. - Create and manage accounts, subscriptions, access rights, product updates, and support requests. - Authenticate users who choose social sign-in or email sign-in. For Google sign-in, CrabiX requests basic profile and email only and does not request Gmail, Drive, Calendar, contacts, or other restricted Google scopes. For email sign-in, CrabiX uses your email address and a one-time code for account access and recovery. - Process billing events, entitlement changes, cancellations, refunds, tax records, and fraud-prevention signals with Paddle. - Send service emails, security notices, product updates, and marketing messages where permitted by law or with consent where required. - Comply with legal obligations, enforce our terms, prevent abuse, and protect users, CrabiX, Paddle, and third parties. ## Legal bases Where GDPR, UK GDPR, or similar laws apply, we rely on contract performance, legitimate interests, consent, and legal obligations depending on the processing activity. You may withdraw consent where processing is based on consent. ## Sharing We may share data with service providers that help us host, secure, analyze, support, communicate, and operate CrabiX. We may also share data with Paddle for billing and compliance, with AI providers you choose to connect, with professional advisors, or with authorities where legally required. We do not sell personal information for money. We do not use personal data to build third-party advertising profiles. ## Retention We retain personal data only as long as reasonably needed for the purposes described in this policy, including account operation, support, security, legal, tax, audit, and dispute requirements. Local app data stored on your device remains under your control unless you share or sync it. ## Cookies and analytics The CrabiX website may use essential cookies or similar technologies for security, preferences, and basic operation. If we add non-essential analytics or marketing cookies, we will disclose them and provide consent controls where required. ## Your rights Depending on where you live, you may have rights to access, correct, delete, export, restrict, or object to processing of your personal data. You may also have the right to withdraw consent or lodge a complaint with a data protection authority. California residents may have additional rights under the CCPA/CPRA, including rights to know, delete, correct, and opt out of certain sharing. CrabiX does not currently sell personal information. ## Security, children, and updates We use reasonable administrative, technical, and organizational safeguards designed to protect personal data. No method of transmission or storage is completely secure. CrabiX is not intended for children under 13, and we do not knowingly collect personal data from children under 13. We may update this policy from time to time. The updated version will be posted on this page with a new "Last updated" date.