Privacy Policy

Appabl is a product of Bulam Labs LLC (“Appabl”, “we”, “us”). This policy applies to this website, appabl.ai, and to the Appabl platform.

In this policy, Customer means the organization or individual holding an Appabl account, and End User means a person who uses an application that a Customer has published.

Questions concerning this policy, and requests concerning personal information, should be addressed to privacy@appabl.ai. Reports of security vulnerabilities should be addressed to security@appabl.ai; see reporting a vulnerability.

Appabl holds two categories of personal information. Responsibility for each is allocated as follows.

Customer and account information. We determine what is collected and the purposes for which it is used, and we are responsible for it. This policy describes our handling of it.

Information held in a Customer's application. The Customer determines what the application collects and the purposes for which that information is used. We hold it on the Customer's behalf, act only on the Customer's instructions, and make no use of it for our own purposes. The Customer is responsible for it.

This allocation determines to whom a request must be directed. A request concerning information held in a Customer's application is properly made to that Customer, who determines how it is answered. We will act on that Customer's instructions and assist in responding, and we will not grant, refuse or alter access to that information on the request of an End User alone. Where an End User is unable to identify or contact the Customer concerned, we will forward the request to that Customer.

• Account and identity. Name and email address, passkey credentials, the identity supplied by an organization's provider where single sign-on is used, and records of sessions and trusted devices.
• Organization. Organization name, member roles and grants, groups, and invitations issued and claimed.
• Customer content. Application source and published versions, uploaded files, and collection documents, including information submitted by the End Users of a published application.
• Billing. Plan, billing period, seat and usage expansion counts, subscription state, whether a subscription was purchased for business or personal use, and invoice references. For a purchase, the country from which it was made, as estimated from the IP address of the request, and the purchase terms the buyer accepted are recorded with it. Purchases are made through Link, operated by Stripe (“Link”) as merchant of record, which holds the payment relationship. Card details are not received or stored by us.
• Email. Service email sent to account holders, such as sign-in codes, invitations and billing notices, and email sent by a Customer's application to its own recipients.
• Usage. Usage counters and storage totals measured against the allowances of the applicable plan and, for a published application, the type of website from which a visitor arrived.
• Technical logs. Each request to the platform or to a published application is logged with the IP address it came from, the browser or device type, the address requested, the time and the result. An IP address also shows roughly where a request comes from.
• Activity log. A record of actions taken within an organization, such as access grants, invitations, member changes, publications, backups and plan changes.
• Support. Support tickets submitted by Customers and our replies to them.
• This website. Visits are counted in aggregate through Cloudflare Web Analytics. The Enterprise contact form collects the sender's name, email address, company and team size, and any message supplied, and records the sender's IP address and country. This website previously operated a waitlist, which collected an email address and recorded the plan selected, if any, the page from which the entry was submitted, and the sender's IP address and country.

Personal information is used to operate the service: to authenticate users and maintain their sessions; to store and serve the applications and information our Customers create; to apply the limits of a Customer's plan; to arrange purchases and apply the plan purchased; to send service email; to notify those who joined the waitlist that registration has opened; to respond to support requests and to inquiries submitted through the Enterprise contact form; to confirm that the service is used only where it is offered, which is the United States, for which the IP address of a request to make a purchase is used to estimate the country from which it is made, and the billing country of a purchase is checked; to detect and prevent abuse; to diagnose and correct faults; and to meet our legal, tax and accounting obligations.

We do not sell personal information. We do not use a Customer's content for advertising. We do not use a Customer's content to train any AI model, and Appabl does not transmit it to any AI provider on its own initiative. The circumstances in which a Customer's content reaches an AI provider are set out in AI assistants.

This website sets no cookies. It uses Cloudflare Web Analytics, which sets no cookies, to count visits in aggregate. It contains no advertising and nothing that follows visitors across other websites.

Cloudflare Turnstile, an automated abuse-prevention check, is loaded when a visitor opens the Enterprise contact form, and not on page load.

The Appabl platform sets cookies that are necessary for its operation: to maintain a signed-in session, to record a device the user has marked as trusted, to keep the sessions of separate published applications isolated, and to carry short-lived state through sign-in and connector processes. None of these cookies is used for profiling or advertising, and the service cannot operate without them.

We disclose personal information to the service providers required to operate Appabl, and to no other party. We do not sell or otherwise trade personal information. Those providers supply hosting and network infrastructure, storage for uploaded files and backups, outbound email and, where an organization uses single sign-on, the identity provider it has selected. Each handles the information only as required to provide its service to us.

Purchases are an exception to that arrangement. They are made through Link, which acts as merchant of record: Link sells the subscription in its own right, collects payment and billing details directly from the purchaser, and handles that information under its own terms and privacy policy rather than on our instructions. To set up a purchase, we provide Stripe, which operates Link, with the name of the organization and the email address of the administrator making the purchase and, where that administrator makes it through the service, the country from which it is made and the version of the purchase terms accepted.

We may also disclose personal information where required by law, or where necessary to establish or defend a legal claim, and will notify the affected Customer where permitted to do so.

Appabl is designed to be operated through an AI assistant selected by the Customer, such as Claude or ChatGPT, or any other client supporting the Model Context Protocol.

Where a Customer connects an assistant, that assistant reads and writes the Customer's information held in Appabl at the Customer's direction. We are not the provider of that assistant and are not party to the Customer's agreement with it. What that provider retains, for how long, and whether it uses submitted information to train models are governed by that provider's terms and privacy policy rather than by this one. Appabl makes no requests to any AI provider.

Information that a Customer directs an assistant to read from Appabl is accordingly disclosed by that Customer to the assistant's provider.

Appabl is offered only in the United States. This website is reachable from other countries, and its availability elsewhere is not an offer to provide the service in those countries.

• Activity log. 90 days, after which entries are deleted automatically.
• Backups. Retained on a rotating schedule determined by the plan, the oldest removed as a new one is taken. The number retained is set out on the pricing page. The backups of an application that has been deleted are not rotated; see below.
• A deleted application. Its versions, files, collections and documents are deleted with it. On a paid plan, a snapshot is taken immediately before deletion, unless the Customer declines one when deleting the application from the dashboard; on the Free plan, none is taken. The backups of a deleted application, including that snapshot, are not rotated and are retained until the Customer deletes them, and the files they refer to remain restorable for 30 days.
• Collection documents. Until deleted by the Customer, or automatically on a rolling window where the Customer has configured one.
• Stored files. Until deleted by the Customer. Earlier versions of a file are removed on a rotating schedule determined by the plan, set out on the pricing page. Where an organization moves to the Free plan, files stored by its applications are retained but not served, other than files supplied with an application from the marketplace, and may be deleted once the organization has been on the Free plan for 30 days.
• Sign-in state. Sessions expire according to the policy set by the organization, and in any event within 14 days. Access opened from an email invitation lasts until the invitation expires, which is no more than one year after it is sent, or any shorter limit the organization sets.
• Technical logs. Up to 14 days in our central log store. Copies on individual servers are deleted as newer logs replace them.
• Support tickets. Retained for as long as the record of the request and our response may be required.
• Contact requests. Up to 24 months from the date of submission.
• Waitlist entries. Up to 24 months from the date of joining.
• Account and organization records. For the life of the account, and thereafter only as required for tax, accounting and legal purposes.

Deletion takes effect immediately in the live system. Information contained in a backup taken before deletion remains in that backup until it is removed on the schedule stated above.

Subject to verification, you may request a copy of the personal information we hold concerning you, the correction of anything inaccurate, an export of it, or its deletion. Several of these may be exercised directly within the service: export and backup tools are provided, and the deletion of an application or a document takes effect immediately.

These rights are extended to all users regardless of location.

Requests should be addressed to privacy@appabl.ai. We will verify that the requester controls the account concerned before acting on a request, and will respond within 30 days. No charge is made for a request, and the making of a request will not affect the account concerned or the service provided under it.

Where the information concerned was submitted to an application published by a Customer, that Customer determines how the request is handled and the request should be directed to them, as stated in Responsibility for information.

Residents of certain states have additional rights under applicable state law. Nothing in this policy limits those rights.

Our handling of access, authority and storage is described on the security page, including passkeys, roles and grants, encryption in transit and at rest, tenancy, and the process for reporting a vulnerability.

In the event of a breach affecting personal information for which we are responsible, we will notify the affected users, and any authority we are required to notify, without unreasonable delay. In the event of a breach affecting information held on a Customer's behalf, we will notify that Customer.

Appabl is not intended for children. Account holders must be 18 or over. We do not knowingly collect personal information from any person under that age, and will delete such information on becoming aware of it. Any person who believes that a child's information has been provided to us should contact privacy@appabl.ai.

Where a Customer's application collects information from children, that Customer is responsible for it and for the obligations arising from it.

Where this policy is amended, the date stated at the top is updated accordingly. Where an amendment materially affects the handling of personal information, we will give notice by email or within the product before it takes effect.

Bulam Labs LLC operates the Appabl service. Correspondence may be addressed as follows.

• Privacy and information requests — privacy@appabl.ai
• Vulnerability reports — security@appabl.ai
• Legal notices — legal@appabl.ai
• All other correspondence — support@appabl.ai