Privacy Policy
Last updated 18 October 2026
Nectabl turns snapped and scanned paperwork into spreadsheets. That means you hand us documents — receipts, invoices, bank statements — that say a lot about you or your clients. This page explains exactly what happens to them.
The short version. We keep your documents for 30 days so you can come back to a batch, then they are deleted automatically. We send them to Anthropic to be read, and to nobody else. We do not use them to train AI models, and Anthropic's terms do not allow it to. We do not sell data. No ads are shown on this site, though we do measure whether our own ads brought you here.
Who we are
Nectabl is operated by E Jumbo Pty Ltd (ABN 56 600 704 916), trading as Nectabl. Nectabl is a business name of E Jumbo Pty Ltd. We are an Australian company, bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and E Jumbo Pty Ltd is the entity responsible for the personal information described on this page. Contact: privacy@nectabl.com.
What we collect
| What | Why |
|---|---|
| Your email address | It is your account. We have no passwords — signing in means clicking a link we email you, so the address is the login. |
| The documents you upload | To read them and return the data. This is the service. |
| Email you forward to your Nectabl address | If your plan includes forwarding, we keep each forwarded email's attachments, or the email's own text when it has none, with its subject, the address it came from and when it arrived. They wait in your account until you process or delete them. We never connect to your mailbox: only what you choose to forward reaches us. Mail from an address you have not allowed is not kept, except for that address, so you can see it was turned away and allow it. When Gmail asks you to confirm forwarding, we keep that one email so you can finish setting it up. |
| Addresses allowed to forward to you | The email addresses you allow to send to your Nectabl address, so we can accept their mail and turn away everyone else's. We email each one a link to confirm before it is allowed. |
| Your client list | The names and addresses you enter or import on the Account screen, so we can warn you when a document is addressed to someone who is not on it. They may be people's names and home addresses. We keep them with your account and do nothing else with them. An imported file is read for names and addresses and not kept. |
| The data extracted from them | To show you the review screen and build your exports. |
| Page counts and processing records | To meter your allowance and to have an accurate record of what you were charged for. |
| Your IP address | Rate limiting and abuse prevention only — stopping one person from creating unlimited free accounts. Kept for up to 30 days. |
| What you send through the contact form | Your name, email address, optional company and your message, so we can answer you. Sent to our support inbox and kept there with the rest of the correspondence. |
| Feedback you send from the app | The kind of feedback you chose, your message, the part of the app you were in and the language the app was shown in, so we can improve Nectabl and reply to you. It never includes your documents. We keep it with your account and send a copy to our support inbox. We also remember whether you chose to hide the feedback tab. |
| How you found us | When you create an account we record the website you arrived from and the
first page you landed on, so we know which of our pages and which mentions
elsewhere actually bring people here. We keep the site's name only, such as
google.com, and never the address you came from or anything you
searched for. If you answer the optional question asking how you heard about us,
we keep your answer. Your browser stores this on your own device until you sign
up, and it is never shared. |
One small script of our own notes the name of the website that sent you and keeps it in your browser; it reaches us only if you go on to create an account, and never if you do not.
We also run Google's advertising tag, so we can tell which of our own ads brought someone here and whether they went on to sign up or subscribe. It sets its own cookies, and it reports the addresses of the pages you visit to Google. The part of the address that identifies a batch is removed before it is sent, so Google is told that someone visited Nectabl and never which documents they were looking at. No ads are shown on this site, and nothing you upload reaches Google.
We also run Ahrefs' web analytics, so we can see which of our pages people visit and which websites sent them. It sets no cookies and stores nothing in your browser. It receives the addresses of the pages you visit, with the part that identifies a batch removed in the same way.
We also run Cloudflare's web analytics, so we can count the real people who visit our pages. It sets no cookies and stores nothing in your browser. It does not run while you have a batch open, so it never sees which documents you are looking at.
So the cookies here are the one that keeps you signed in, and Google's.
Who your data is shared with
We use six providers, and each one only receives what it needs.
- Anthropic, United States. Receives the contents of documents you upload, in order to read them. Its commercial terms do not allow it to train models on them. Security and compliance
- Cloudflare, Oceania. Hosting, file storage, the database, receiving email forwarded to Nectabl addresses, and counting visits to our pages. Both the files and the database sit in Cloudflare's Oceania region, in Australia. Pages are served from whichever location is nearest you; your documents are not stored there. Security and compliance
- Resend, United States company, sending from its Tokyo region in Japan. Receives your email address, to deliver sign-in links and replies. Security and compliance
- Stripe, United States. Receives your email address and billing details, to take payment. Stripe is the merchant of record and handles it under its own privacy policy. Card numbers are entered on Stripe's checkout and never reach us. Security and compliance
- Google, United States. Receives the addresses of the pages you visit on this site, so we can measure our own advertising. It receives no documents and nothing read from them, and the batch identifier is removed from the address first. Security and compliance
- Ahrefs, Singapore. Receives the addresses of the pages you visit on this site, so we can see which pages people use. It receives no documents and nothing read from them, and the batch identifier is removed from the address first. Privacy policy
Stripe, Google and Ahrefs receive no documents and no extracted data. We never send any of them anything you upload.
So your documents are stored in Australia, but they are read in the United States: sending one to Anthropic to be extracted is an overseas disclosure under Australian Privacy Principle 8. Your email address also reaches Stripe in the United States, and Resend, a United States company that sends our email from Japan. If that is not acceptable for the documents you handle, please do not upload them.
Anthropic's commercial terms say it may not train models on what we send it, and its privacy policy says how long it keeps it. That is their commitment rather than ours to make: if it changes, we will update this page and tell you. We do not sell, rent or share your documents or your extracted data with anyone else, and we will not start without asking you first.
The six providers above are our only subprocessors. If we add another that would handle your documents or personal information, we will update this table and email account holders before it starts.
MYOB and Xero
On Pro, Business and Enterprise, and during a free trial, you can connect MYOB or Xero so that Nectabl sends the bills you approve there. MYOB and Xero are not our providers: they are services you choose to connect, and what Nectabl sends them is then held under their own terms and privacy policies.
- You sign in at MYOB or Xero, not on Nectabl, so we never see your password there. They give Nectabl a key that lets it read your supplier list, your accounts and your tax codes, create bills and suppliers, and attach files to bills. We encrypt that key before we store it.
- We store the name of each business you connect and its identifier at MYOB or Xero, which client it is for, and your sending settings.
- For each vendor, we store the supplier and the account you chose for their bills, as identifiers at MYOB or Xero, so the next bill from that vendor already has them.
- For each bill we send, we store its identifier and link at MYOB or Xero, who sent it, when, and why it was not sent or why its file was not attached, if that happened.
- We read your suppliers' names and ABNs, your accounts, your tax codes and a supplier's default account when you need them, and we do not store them. When we read a supplier's default account from Xero, Xero sends the rest of that supplier's details too, which can include their bank account. We use that bank account for one thing only: while you review a bill, we compare it with the bank details printed on the bill, and warn you if they are different, because changed bank details are how fake invoices take payments. We do not keep it, and it is never shown to you or sent anywhere.
- What we send to MYOB or Xero is the bill as you approved it: the supplier, the dates, the number, the lines, the amounts and the tax, and, for Xero, the document's own file attached to the bill.
When you disconnect, we withdraw Nectabl's access at Xero where Xero allows it, and we delete the key, the business and the suppliers and accounts remembered for it at once. If your plan stops including connections, for example when a free trial ends without a subscription, Nectabl disconnects them for you in the same way. Bills already sent stay in MYOB or Xero, and deleting them there is up to you.
Teams
On Pro, Business and Enterprise, an account owner can invite other people to work on the account. Everyone on a team can see every batch and document on that account, including what the others uploaded, and sees each other's email addresses. When you invite someone, we store their email address to send the invitation and to recognise them when they sign in. If you are invited, you can ignore the invitation and nothing about you is kept beyond it.
Support access
We do not read your documents as a matter of course, and we never log their contents. If you contact us about a specific problem, we may need to look at the document involved to diagnose it — we will ask you before doing so.
How long we keep things
| Data | Kept for |
|---|---|
| Uploaded documents | 30 days from upload, then deleted automatically |
| Forwarded documents waiting to be processed | 30 days from arrival, then deleted automatically. Once processed, they are kept like uploaded documents |
| Addresses turned away from your forwarding address | The 20 most recent, until you clear the list, delete all your data, or close your account |
| Addresses allowed to forward to you | Until you remove them or close your account |
| Extracted data and review edits | Until you delete the batch or close your account |
| Your client list | Until you change it or close your account |
| MYOB and Xero connections, with their encrypted sign-in key | Until you disconnect or close your account |
| The supplier and account chosen for each vendor, for MYOB or Xero | Until you change them, disconnect, or close your account |
| The record of each bill sent to MYOB or Xero | Until you close your account |
| Feedback you send from the app | Until you close your account or remove your login. The copy in our support inbox is kept with the rest of the correspondence |
| Receipt categories you correct, remembered by vendor name | Until you forget them from the Account screen, delete all your data, or close your account |
| Account and billing records | As long as your account exists, then as required by Australian tax law (generally five years) |
| Sign-in links | The link works for 15 minutes and once only; the record of it, including the address it was sent to, is deleted within a day |
| IP addresses used for rate limiting | Up to 30 days |
| Team invitations, including the invited email address | Until accepted or cancelled, and no longer than 30 days |
Closing your account deletes your documents and extracted data. We keep the minimum billing record the law requires us to keep.
Backups. We keep no separate backup copy of uploaded documents, so when a document is deleted it is gone rather than lingering in an archive. Our database — which holds accounts, page counts and extracted data, but never the document files themselves — is covered by Cloudflare's own point-in-time recovery for up to 30 days. A deletion could therefore survive in that recovery window for up to 30 days before ageing out, and we only ever use it to restore from a failure.
How it is protected
- Everything is served over HTTPS.
- We store no passwords at all. Sign-in links are single-use, expire in 15 minutes, and are stored hashed, so even our own database cannot be used to log in as you.
- Files are stored under a prefix specific to your account, and every request for a document checks that it belongs to you.
- Document contents are never written to our logs.
No system is perfectly secure. If a breach occurs that is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.
Your rights
You can delete your own data without asking us. Every batch has a Delete button that erases the uploaded files and everything read from them straight away, rather than waiting for the 30-day expiry. The Account screen adds two more: Delete everything now, which clears every document without closing the account, and Close account, which erases everything, cancels any subscription and removes the account itself.
You can also ask us to give you a copy of the personal information we hold about you, or to correct it. Email privacy@nectabl.com and we will respond within 30 days.
If you are unhappy with how we have handled your information, you can complain to us first, and then to the Office of the Australian Information Commissioner at oaic.gov.au.
If you are in the UK or the European Economic Area
We are in Australia, but if you are in the UK or the EEA the UK GDPR and the EU GDPR apply to how we handle your information. This section says how.
Who is responsible. For your account details, E Jumbo Pty Ltd is the controller. For documents you upload about other people — your clients' invoices and receipts — you are the controller and we are your processor: we handle them on your instructions and for no purpose of our own.
Why we are allowed to hold it. Our lawful basis is performance of a contract: we cannot run your account without your email address, and we cannot extract your documents without processing them. Rate-limiting records rest on our legitimate interest in preventing abuse of a free tier.
Sending data outside your country. Processing a document involves a transfer to the United States, and sign-in emails are sent from Japan, by the providers listed above. We rely on the Standard Contractual Clauses those providers publish, together with their own security measures. If that is not acceptable for the documents you handle, please do not upload them.
Your rights. You can ask us for a copy of your personal information, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable form. Deletion and export you can already do yourself, without asking and without waiting. For anything else, email privacy@nectabl.com and we will respond within 30 days. You can also complain to your national data protection authority.
We have not appointed an Article 27 representative in the EU or UK. If you need one to exist before you can use Nectabl, please tell us — it is a question of demand, not principle.
Children
Nectabl is a business tool and is not intended for anyone under 16. We do not knowingly collect information from children.
Changes
If we change this policy in a way that materially affects you, we will email you before it takes effect. The date at the top always reflects the current version.