Privacy policy

Last updated 2 November 2026.

This policy explains what personal data abracodabra collects when you use www.abracodabra.ai and the abracodabra workspace, why we collect it, who we share it with and the choices you have. "abracodabra", "we" and "us" mean the business that runs abracodabra. Questions go to hello@abracodabra.ai.

What we collect

Account details. Your name, email address and password. The password is stored only as a secure hash. We also record which workspaces you use: client, vendor or agency.
Sign in with Google. If you choose Google, Google shares your name, email address and profile picture and a Google account identifier with us. The section on Google user data below explains how we use them.
What you put into projects. Ideas, requirements documents and your notes on them, answers to project questions, messages, meeting notes, files you upload, quotes, statements of work and signatures, milestone evidence and decisions.
Agency details. Company details, the services you claim, code samples and other proof of your work, and the names and contact details of the customer references you give us. Only give us a reference who has agreed to be contacted.
Payments. Stripe collects card and bank details directly. We receive confirmations, amounts and payout status, never full card numbers.
Technical data. IP address, browser type and request logs, used for security, rate limiting and fixing faults.
Early access list. If you join it, your email address and anything you write to us.

How we use it

To run your account and your projects: signing you in, matching a project with agencies, quotes, contracts, milestone payments and disputes.
To send service emails: confirming your address, password resets, notifications and reference requests to the customer references agencies give us.
To keep abracodabra safe: preventing abuse, fraud and spam, including refusing disposable email addresses.
To improve our estimates and cost guides from anonymised figures across finished projects. A published cost guide only uses projects whose clients agreed.

We do not sell personal data and we do not use it for advertising.

AI processing

abracodabra uses AI models to write requirements with you, check answers, match projects and draft documents. The text involved is sent to our AI providers, Anthropic (Claude) and TypeSafe (Jev), who process it to return the answer under their business terms. Before text is sent, an automatic check masks email addresses, phone numbers, card and bank numbers and similar identifiers. The check does not catch everything, people's names for example, so please leave out personal details a project does not need.

Google user data

When you sign in with Google we ask only for your basic profile: your name, email address and profile picture. We use this data only to create your account, sign you in and show your name and picture in your workspace. We do not use Google user data for advertising, we do not sell it, and we share it only with the service providers that host abracodabra. Signing in with Google does not give us access to your Gmail, Drive, Calendar or contacts.

abracodabra's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can remove abracodabra's access at any time from the security settings of your Google Account. Your abracodabra account stays open; you can set a password and keep signing in with your email address.

Who we share it with

The people on your project. A client sees the quotes, profiles and verification status of the agencies it invites. An agency sees the accepted requirements and the client's notes for projects it is invited to. Each side sees only what its role needs.
Service providers that run abracodabra for us: Vercel (website hosting), Contabo (servers for the application, database and files), Resend (email), Stripe (payments) and Anthropic and TypeSafe (AI).
Customer references. We contact the references an agency gives us to confirm its work.
When the law requires it, or to protect the rights and safety of our users and of abracodabra.
If the business changes hands, the data moves with it and this policy keeps applying.

Cookies

A session cookie keeps you signed in. abracodabra does not work without it.
abra_ref and abra_vid are set only when you arrive through a partner's referral link, so the partner is credited. abra_ref lasts for that partner's attribution period and abra_vid for 180 days.

We do not use advertising cookies or third-party analytics cookies.

Where data is stored

Our providers may store and process data outside your country, including in the European Union and the United States. When data moves between countries, we rely on the data processing terms our providers offer, which include standard contractual clauses where the law requires them.

How long we keep it

We keep account and project data while your account is open. When you ask us to delete your account, we delete or anonymise your personal data, except records we must keep: signed statements of work, payment and payout records and dispute decisions, which we keep for as long as tax, accounting and legal obligations require.

Your rights

Depending on where you live, you can ask to see, correct, download or delete your personal data, object to how we use it, or withdraw a consent you gave. You can change most account details in Settings. For anything else, email hello@abracodabra.ai and we will answer within 30 days. You can also complain to your local data protection authority.

Children

abracodabra is a service for businesses and is not meant for anyone under 18.

Security

Passwords are hashed, every connection is encrypted, and staff access is limited by role. No system is perfectly secure. If you find a problem, tell us at hello@abracodabra.ai.

Changes

When we change this policy we update the date at the top. If a change matters, we tell you by email or in your workspace before it applies.

Contact

hello@abracodabra.ai