How we handle your personal data, in plain English. Written for humans, not just lawyers.
Credbase is a product of Aplera Labs Ltd, a company registered in Scotland (company number SC878012). In this policy, "Credbase", "we", "us" and "our" all mean Aplera Labs Ltd.
If you have any questions about privacy or your data, email privacy@credbase.app. We aim to respond within one working day.
Credbase plays two different roles depending on the type of data.
For account data (your name, email, workspace settings, billing info), we are the data controller, we decide why and how it is used.
For the documents and business information you upload about your suppliers, subcontractors, vendors or partners, we act as a data processor on your behalf. You (or your workspace) remain the controller and decide what to collect, keep and delete. Our Data Processing Agreement sets out exactly what that means.
We use personal data to run Credbase for you, keep it secure, bill correctly, respond to support and improve the product.
Our lawful bases under UK GDPR are: performance of a contract (running your account), legitimate interests (keeping the service safe and improving it), legal obligation (tax, accounting, security incidents) and consent (only where we ask for it, such as optional marketing).
Credbase uses AI to suggest things like document type and expiry dates so you can move faster. AI outputs are always suggestions, a human on your team approves before anything is saved.
We do not use your documents to train third-party foundation models, and we do not sell your data. See the AI page for the full statement.
We share personal data only with the subprocessors we need to run Credbase, hosting, database, transactional email, error monitoring, payment processing and AI-assisted document understanding. Each is bound by contract to protect your data.
We share with law enforcement only where we are legally required to, and we push back on requests that go beyond what the law requires.
We never sell your personal data.
Application data and uploaded documents are hosted on managed cloud infrastructure in the UK and EU. Some subprocessors (for example, AI providers) may process data outside the UK/EU. Where that happens we rely on the UK International Data Transfer Agreement, the EU Standard Contractual Clauses or an adequacy decision.
We keep account and usage data for as long as your workspace is active and for a short period after closure so we can handle billing, disputes and legal obligations.
You can delete documents, companies or entire workspaces at any time. Deleted data is removed from primary storage on request; encrypted backups age out on our standard retention cycle, after which residual copies are unrecoverable.
Under UK GDPR you have the right to access, correct, delete, restrict or object to processing of your personal data and to data portability. You can exercise most of these directly in the app; for anything you cannot self-serve, email privacy@credbase.app.
If we process data about you on behalf of another Credbase customer (for example, because they invited you to a workspace or sent you an upload link), please contact them first, they are the controller for that data. We will help them respond.
You have the right to complain to the UK Information Commissioner's Office (ico.org.uk).
We use TLS in transit and AES-256 at rest, private-by-default workspaces, role-based access, MFA for staff and least-privilege production access. See the Trust Centre for the full picture.
We use a small number of strictly necessary cookies to keep you signed in and to keep the service secure. See the Cookies page for the full list, including any analytics or search-console verification tags we use.
We may update this policy from time to time. If we make a material change, we will let you know in the app or by email before it takes effect.
This page is written to be easy to read. It is a real, binding document, but it is not legal advice for your business. If you need to check it against your own obligations, please speak to your own lawyer.
Credbase is a product of Aplera Labs Ltd, a company registered in Scotland (company number SC878012). Contact: hello@credbase.app.