Privacy Policy
Last updated 11 September 2026
Nectabl turns photographed and scanned paperwork into spreadsheets. That means you hand us documents — receipts, invoices, bank statements — that say a lot about you or your clients. This page explains exactly what happens to them.
The short version. We keep your documents for 30 days so you can come back to a batch, then they are deleted automatically. We send them to Anthropic to be read, and to nobody else. Neither we nor Anthropic use them to train AI models. We do not sell data, and there is no advertising on this site.
Who we are
Nectabl is operated by E Jumbo Pty Ltd (ABN 56 600 704 916), trading as Enjett. We are an Australian company, bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and E Jumbo Pty Ltd is the entity responsible for the personal information described on this page. Contact: privacy@nectabl.com.
What we collect
| What | Why |
|---|---|
| Your email address | It is your account. We have no passwords — signing in means clicking a link we email you, so the address is the login. |
| The documents you upload | To read them and return the data. This is the service. |
| The data extracted from them | To show you the review screen and build your exports. |
| Page counts and processing records | To meter your allowance and to have an accurate record of what you were charged for. |
| Your IP address | Rate limiting and abuse prevention only — stopping one person from creating unlimited free accounts. Kept for up to 30 days. |
There is no analytics script, no advertising network, and no third-party tracker on this site. The only cookie we set is the one that keeps you signed in.
Who your data is shared with
We use a small number of providers, and each one only receives what it needs:
| Provider | Receives | Where |
|---|---|---|
| Anthropic | The contents of documents you upload, in order to read them | United States |
| Cloudflare | Hosting, file storage and the database | Oceania. Both the file storage and the database sit in Cloudflare's Oceania region, in Australia. Pages are served from whichever Cloudflare location is nearest you, but your documents are not stored there. |
| Resend | Your email address, to deliver sign-in links | United States company; emails are sent from its Tokyo region, in Japan |
| Stripe | Your email address and billing details, to take payment. Stripe is the merchant of record for your purchase and handles it under its own privacy policy. Card numbers are entered on Stripe's checkout and never reach us. | United States |
Stripe receives no documents and no extracted data. We never send it anything you upload.
So your documents are stored in Australia, but they are read in the United States: sending one to Anthropic to be extracted is an overseas disclosure under Australian Privacy Principle 8. Your email address also reaches Stripe in the United States, and Resend, a United States company that sends our email from Japan. If that is not acceptable for the documents you handle, please do not upload them.
Anthropic does not use data submitted through its API to train its models, and deletes it within 30 days. That reflects Anthropic's commercial terms as they stand on the date at the top of this page; it is their commitment rather than ours to make, and if it changes we will update this page and tell you. We do not sell, rent or share your documents or your extracted data with anyone else, and we will not start without asking you first.
The four providers above are our only subprocessors. If we add another that would handle your documents or personal information, we will update this table and email account holders before it starts.
Support access
We do not read your documents as a matter of course, and we never log their contents. If you contact us about a specific problem, we may need to look at the document involved to diagnose it — we will ask you before doing so.
How long we keep things
| Data | Kept for |
|---|---|
| Uploaded documents | 30 days from upload, then deleted automatically |
| Extracted data and review edits | Until you delete the batch or close your account |
| Account and billing records | As long as your account exists, then as required by Australian tax law (generally five years) |
| Sign-in links | The link works for 15 minutes and once only; the record of it, including the address it was sent to, is deleted within a day |
| IP addresses used for rate limiting | Up to 30 days |
Closing your account deletes your documents and extracted data. We keep the minimum billing record the law requires us to keep.
Backups. We keep no separate backup copy of uploaded documents, so when a document is deleted it is gone rather than lingering in an archive. Our database — which holds accounts, page counts and extracted data, but never the document files themselves — is covered by Cloudflare's own point-in-time recovery for up to 30 days. A deletion could therefore survive in that recovery window for up to 30 days before ageing out, and we only ever use it to restore from a failure.
How it is protected
- Everything is served over HTTPS.
- We store no passwords at all. Sign-in links are single-use, expire in 15 minutes, and are stored hashed, so even our own database cannot be used to log in as you.
- Files are stored under a prefix specific to your account, and every request for a document checks that it belongs to you.
- Document contents are never written to our logs.
No system is perfectly secure. If a breach occurs that is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.
Your rights
You can delete your own data without asking us. Every batch has a Delete button that erases the uploaded files and everything read from them straight away, rather than waiting for the 30-day expiry. The Account screen adds two more: Delete everything now, which clears every document without closing the account, and Close account, which erases everything, cancels any subscription and removes the account itself.
You can also ask us to give you a copy of the personal information we hold about you, or to correct it. Email privacy@nectabl.com and we will respond within 30 days.
If you are unhappy with how we have handled your information, you can complain to us first, and then to the Office of the Australian Information Commissioner at oaic.gov.au.
If you are in the UK or the European Economic Area
We are in Australia, but if you are in the UK or the EEA the UK GDPR and the EU GDPR apply to how we handle your information. This section says how.
Who is responsible. For your account details, E Jumbo Pty Ltd is the controller. For documents you upload about other people — your clients' invoices and receipts — you are the controller and we are your processor: we handle them on your instructions and for no purpose of our own.
Why we are allowed to hold it. Our lawful basis is performance of a contract: we cannot run your account without your email address, and we cannot extract your documents without processing them. Rate-limiting records rest on our legitimate interest in preventing abuse of a free tier.
Sending data outside your country. Processing a document involves a transfer to the United States, and sign-in emails are sent from Japan, by the providers listed above. We rely on the Standard Contractual Clauses those providers publish, together with their own security measures. If that is not acceptable for the documents you handle, please do not upload them.
Your rights. You can ask us for a copy of your personal information, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable form. Deletion and export you can already do yourself, without asking and without waiting. For anything else, email privacy@nectabl.com and we will respond within 30 days. You can also complain to your national data protection authority.
We have not appointed an Article 27 representative in the EU or UK. If you need one to exist before you can use Nectabl, please tell us — it is a question of demand, not principle.
Children
Nectabl is a business tool and is not intended for anyone under 16. We do not knowingly collect information from children.
Changes
If we change this policy in a way that materially affects you, we will email you before it takes effect. The date at the top always reflects the current version.