Privacy Policy
Last updated October 17, 2026
This explains what Aardvark Business Services (“we”) collects when you use APWrangler, why, who else handles it, and your choices.
We do not sell your data and we do not show ads.
What we collect
- Account information: your name, email address, role, and your organization’s name. If you set a password we store
only a scrambled (hashed) version of it, never the password itself. If you sign in with Google, we receive your verified email address and
name from Google.
- Your organization’s invoice data: the invoice files you upload (PDF or images), the details read from or typed
into them (vendor, invoice number, dates, amounts, payment terms, currency), vendor names, payment records you enter (such as a check number),
and a history of who approved, edited or paid each invoice and when.
- Invoices sent by email: if you email an invoice to our receiving address we process the message the same way as an upload,
and keep a short log of it (sender address, time, outcome). Mail from addresses we do not recognize is not processed, and only that log entry is kept.
- Technical information: your IP address and basic request details in server logs, used to keep the Service secure and
to limit abuse, and error logs to fix problems.
- Cookies: one session cookie that keeps you signed in, and security tokens that protect forms. We do not use advertising
or tracking cookies.
How we use it
To run the Service for you: sign you in, read and store your invoices, show what is due, send invitation and password-reset emails, keep the
Service secure, fix problems, and answer your questions. We do not use your invoices for anything else.
Who else handles your data
We use these providers to run the Service. They process data on our behalf:
- Supabase: database and private file storage for accounts, invoice data and uploaded files.
- Render: hosts the application.
- Anthropic: when you upload an invoice, the file is sent to Anthropic’s API so its AI can read the details. Under
Anthropic’s commercial terms, prompts and outputs are not retained by default, with exceptions such as content flagged for safety
review, and retained data is not used to train its models without permission.
- Resend: sends our emails (invitations, password resets) and receives invoices you email to us, including the sender’s address and attachments.
- Cloudflare: domain name and email forwarding for our support address.
- Google: only if you choose Sign in with Google.
We may also disclose information if the law requires it or to protect the Service and its users. If our business is sold or merged, data may
transfer to the new owner under these same commitments.
Who in your organization can see what
Organization administrators and reviewers can see all of the organization’s invoices. Submitters see only the invoices they submitted.
People in other organizations cannot see your data.
How long we keep it
We keep your organization’s data while its account is active. If you ask us to delete your organization, we delete its invoices, files,
user accounts and history within 30 days. Copies in provider backups expire on the provider’s normal schedule, and
server logs are kept only for a short, limited time. We may keep a minimal record that a deletion happened, and anything we are legally required to keep.
If an organization has had no sign-in for 12 months we may delete it too, after giving its administrators at least 30 days’ notice by email.
Your choices
- Access and export: download your invoice files and an index from the Export page, or ask us for a copy of your data.
- Correction: edit invoice details in the app, or ask us to fix account information.
- Deletion: ask us to delete your organization, or ask an organization administrator to remove your user account.
Email us at support@apwrangler.com to make a request. We may need to confirm that you are the organization’s administrator first.
Security
Files are kept in private storage, every connection to the Service is encrypted in transit, passwords are hashed, and each organization’s
data is kept separate. No system is perfectly secure; if we learn of a breach affecting your data we will notify you as the law requires.
Children
The Service is for businesses and is not intended for anyone under 18.
Changes
We may update this policy and will change the date above. For significant changes we will tell you in the Service or by email.
Contact
Privacy questions or requests: support@apwrangler.com.
Terms · Privacy · Log in