Trust · Last updated 28 September 2026
Privacy policy
What personal data Four Nibbles collects when you use this website and the hosted Fabric service, why, who else handles it, and how to exercise your rights. We collect little, and we don't use advertising or analytics trackers.
This document is a working draft and has not yet been reviewed by counsel. If you need a signed copy or have questions, write to legal@fournibbles.com.
Who is responsible
Four Nibbles, [to be completed], of [to be completed] is the controller of the personal data described here. Contact: legal@fournibbles.com.
The data that flows through your pipelines — the rows in your sources and destinations — is different: there we act only on your instructions, as your processor, under the data processing agreement. This policy doesn't cover it.
What we collect and why
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Email address | To create your account, send sign-in links, and send messages about the service (such as your workspace being ready, or changes to these terms) | Performing our contract with you |
| Workspace name and account settings | To run your workspace | Performing our contract with you |
| IP address, browser details, and request times | To keep the service secure: rate-limiting sign-in attempts, bot protection on the sign-in form, and investigating abuse | Our legitimate interest in a secure service |
| What you write to us | To answer you | Our legitimate interest in answering; or contract |
| Billing details (name, organisation, address, tax number) | To invoice you, if you are on a paid plan | Contract; legal obligation to keep accounting records |
We don't sell personal data, use it for advertising, or build profiles.
Cookies and local storage
We set only the cookies the service needs to work: a session cookie that keeps you signed in and a security cookie that protects forms against cross-site request forgery. Your browser also stores your light/dark theme choice locally. No tracking or advertising cookies are used, so there is no cookie banner.
Who else handles it
These service providers process personal data for us, under contracts that require them to protect it and use it only to provide their service:
| Subprocessor | Purpose | Location |
|---|---|---|
| DigitalOcean, LLC | Hosting of the platform, its databases and the pipeline runners | |
| Cloudflare, Inc. | Website hosting and bot protection on the sign-in form (Turnstile) | Global network |
| Resend, Inc. | Delivery of sign-in links and account emails | United States |
We will update this list before adding a new provider. We may also disclose data when the law requires it, or to a successor if our business is transferred.
International transfers
Four Nibbles is based in India, the platform is hosted in the European Union, and some providers above are in the United States. When personal data from the EU, the UK or Switzerland is transferred to a country without an adequacy decision, the transfer is covered by the European Commission's Standard Contractual Clauses (and the UK addendum), which are part of our DPA and of our providers' terms.
How long we keep it
- Account data: while your account is open, and deleted within 60 days of closing it.
- Sign-in links: valid for 15 minutes and single-use; the records of them are kept only as long as needed to detect abuse.
- Security logs: up to 90 days, unless needed for an investigation.
- Invoices and billing records: as long as tax and accounting law requires.
Your rights
Depending on where you live — including under the EU and UK GDPR and India's Digital Personal Data Protection Act, 2023 — you may have the right to access your personal data, correct it, delete it, receive a copy in a portable form, object to or restrict how we use it, and withdraw consent where we rely on it. Write to legal@fournibbles.com; we will answer within 30 days. You may also complain to your data protection authority, though we'd like the chance to fix it first.
Security
How we protect the service and your connection settings is described on the security page. If we become aware of a breach affecting your personal data, we will notify you and the authorities as the law requires.
Children
The service is for businesses and is not directed at anyone under 18.
Changes
We will post changes here and update the date above; for significant changes we will also email account holders.