This policy explains what Cabin collects, why, where it goes, and what you can do about it. It covers the hosted Cabin service: the app at cabincms.com, the sites it hosts for you, and the emails it sends. A Cabin you run on your own server is yours, and this policy doesn't apply there. It is written to be read, not skimmed past. If anything is unclear, email us and we'll explain it in plainer words and fix the wording here.
What we collect
Your account: your name, your email address and your password, which we store only as a hash. If you set them up, a passkey and two-factor codes. Your preferred language, the teams you belong to and the sites you can open.
Billing: your team's name and billing email. Card details go straight to Stripe, our payment provider, and never reach our servers. We keep what Stripe tells us: which plan a site is on, what it has been charged, and whether a payment failed.
Your sites: everything you put into them. Pages, articles, photos, menus, settings, themes, the people you invite, API tokens (we keep a hash, never the token itself) and the answers visitors send through your forms.
Activity: each site has an activity log that records who signed in, published, deleted, invited someone or changed a setting, and when. It doesn't record IP addresses or browsers. We also keep ordinary server logs for a short time to keep the service running and to investigate abuse.
We don't buy data about you from anyone else, and there is no advertising in any of this.
How we use it
To run your sites and the app: signing you in, drawing your pages, storing your photos, delivering your forms and sending the emails you set up.
To send the mail you asked for or need: sign-in links, invitations, form notifications and autoresponders, receipts, failed-payment notices, security notices, and notice of changes to this policy. We don't send marketing email unless you opt in, and every marketing email has an unsubscribe link.
To bill you, through Stripe, for the plans and the metered AI usage described on the pricing page.
To answer support. When you email us, we read what you send and look at the relevant parts of your account to help.
To keep Cabin safe: rate limits, spam checks, Safe Browsing checks on hosted sites, and takedowns when a site is used for abuse.
We don't sell your data, share it with advertisers, or use your content or your visitors' data to train AI models, ours or anyone else's.
Where it's stored
Cabin runs on cloud infrastructure in the United States, in data centres run by our hosting providers. Your sites' database, media files and backups live there.
Backups are taken every night and kept for thirty days. They exist so we can recover from a failure; we don't open them for anything else.
Everything travels over HTTPS, including every site we host, and is encrypted at rest on our providers' storage. Sites are kept apart at the database level, so one site's data is never read in another's context.
Payment details are held by Stripe under Stripe's own privacy policy. We never see your full card number.
AI and other services
Cabin has three AI features: alt text for photos, a spam check on form submissions, and the assistant that helps build a site. They run only when the team that pays for a site switches AI on, and they are metered and billed by use.
Requests go through Cabin's own account with OpenRouter, which passes them to the model named for each feature; today those are models from Anthropic and Google. Each feature sends the least it needs:
- Alt text: a small thumbnail of the photo, never the original, with its filename, the site’s title and the words around the picture.
- Spam check: the text answers of a submission, which can include a name, email address or phone number the visitor typed. Choices, dates, numbers, consent ticks, hidden fields and files are never sent.
- The assistant: the messages you write to it, any pictures you attach, and the parts of your site it needs to read to do what you asked.
We choose providers whose terms say that requests made through their API aren't used to train their models, and we'll say so here if that changes. Nothing is sent to an AI provider from a site whose AI is switched off.
Other services we rely on: Stripe for payments; a transactional email provider for the mail Cabin sends; Cloudflare Turnstile, if you turn it on for a form, which checks the visitor’s browser (Cabin sends it no address); and the embed providers (YouTube, Vimeo, X, SoundCloud, Spotify and TikTok) when you embed something, in which case a visitor’s browser loads the player from that provider. Visitors’ countries come from a database that runs on our own servers and sends nothing out.
Webhooks and API tokens send your content wherever you point them, under whatever terms apply there. When you install a font from Google, Cabin's server downloads the files once and serves them itself, so your visitors' browsers never contact Google.
Your rights
You can see and change your account details in the app's settings, export your site's content and photos at any time, and download your form submissions as a file.
Wherever you live, you can ask us to tell you what we hold about you, correct it, give you a copy, or delete it. Email privacy@cabincms.com and we'll do it within a week. In the EU, the UK and other places with a data protection law these are rights you have by law; elsewhere we extend them anyway.
If you sent something through a form on a site Cabin hosts, the site's owner is responsible for that data and is the person to ask. They have a tool that finds, exports and erases everything you submitted. If you can't reach them, email us and we'll help.
You can complain to your local data protection authority at any time. We'd appreciate the chance to put things right first.
Retention and deletion
Your content stays for as long as your site does. When you delete something in Cabin, it goes from the app at once and from backups within thirty days.
Form submissions follow the retention each form sets, from thirty days to forever. Spam and the trash are emptied thirty days after a submission lands there. Pictures attached to the assistant are deleted about an hour after the conversation ends.
Activity logs are kept for a year, webhook delivery logs for thirty days, and server logs for up to ninety days.
When you close your account, the same applies to everything in it. We keep invoices and receipts for the period tax law requires, and nothing else.
Processing on your behalf
For your own account, we decide what to collect and are the controller. For the data in your sites, and above all the personal data your visitors send through your forms, you decide and we act on your instructions: you are the controller and we are your processor. This section is our data processing agreement with you, and it applies whenever you use Cabin for a business or an organisation.
We process that data only to run the service as you've set it up and as this policy describes, never for our own purposes. We keep it confidential, give access only to the people who need it to run Cabin and support you, and protect it with the measures in “Where it's stored”: encryption in transit and at rest, sites kept apart at the database level, nightly backups and hashed secrets.
We use these sub-processors, each under its own contract and only for what is named:
- Our cloud hosting providers in the United States, for servers, databases, file storage and backups.
- Stripe, for payments and invoices.
- Our transactional email provider, for the mail Cabin sends.
- OpenRouter, and through it the model providers named for each feature, for the AI features, only while AI is switched on for a site.
- Cloudflare, for Turnstile, only on forms where you turn it on.
We'll email you at least thirty days before adding or replacing a sub-processor. If you object and we can't offer another way, you can cancel and export your data before the change takes effect.
We help you meet your own obligations: the Privacy requests tool finds, exports and erases everything a visitor submitted, by their email address; the activity log shows who did what; and we'll tell you without undue delay, and within seventy-two hours, if we learn of a breach affecting your data. If a visitor contacts us directly, we'll pass them to you.
Your data is stored in the United States. If you or your visitors are in the EU, the UK or Switzerland, the transfer is covered by the standard contractual clauses, which form part of this agreement, and by the UK addendum where it applies. When you delete a site or close your account, or when this agreement ends, we delete the data as “Retention and deletion” describes, and on request we'll confirm it in writing.
Changes to this policy
If we change something that matters, we'll email you before it takes effect and keep the previous version available. Small wording fixes are listed at the bottom of this page.
Contact
Cabin is made by Polite Labs. Questions about any of this go to privacy@cabincms.com. If you're in the EU or UK and want to raise a complaint, you can also contact your local data protection authority.
Questions about your data?
A person answers, usually within a working day.
Previous versions
- First version.