1. Scope and our different roles
This policy describes how we handle personal information when you visit our website, create an account, connect a database or other supported source, use Databrush's hosted analytics service (the "Service"), or contact us. Personal information includes information that identifies, relates to, or can reasonably be linked to an individual. "Customer Data" means information customers or their authorized users provide or make available through the Service, including source credentials, source records, prompts, and related workspace content. "Customer Personal Data" is the personal information within that data that we process on a customer's behalf.
We act as a controller, or an equivalent business under applicable law, when determining how to handle our own account, website, support, security, and business-administration information. When a customer connects a database or supplies personal information for analysis, we generally process that information on the customer's instructions as a processor or service provider. The customer's privacy notice and the Data Processing Addendum incorporated into our Terms also govern that processing. If the customer is itself a processor, we act as its subprocessor where agreed.
If your information is in a customer's database or organizational workspace, contact that customer first about its purposes, legal basis, and your rights. We assist our customers with requests as required by law and contract. These different roles do not remove any rights you have against us under applicable law.
If you use Databrush personally, contact us directly about your own account information, content, or privacy requests. The organizational-customer process above applies when a separate customer controls the information concerned; it does not require a personal user to find an organizational administrator.
2. Information we collect
We collect information directly from users, from their organizations and authentication providers, from connected databases at the customer's direction, and automatically through use of the Service.
| Category | Examples and source | Main purposes |
|---|---|---|
| Account and organization information | Email address, authentication identifier, profile information supplied during authentication, organization or workspace identifiers, membership and role, account settings | Sign-in, workspace administration, access control, account communications |
| Connection information | Database host, port, name, connection settings, username, password, or an API key for another supported source submitted through connection controls; connection health | Establish, authenticate, troubleshoot, and manage an authorized connection |
| Connected-source information | Schema, table and column names, types and relationships, database metadata, query results, sample or distinct values, and records made available by the customer's permissions | Understand data, generate and run analysis, answer questions, create and refresh results |
| Workspace content and AI interactions | Prompts, conversation history, generated SQL, answers, titles, charts, tables, settings, revisions, persisted results, and contextual inferences | Deliver the requested work, generate starting views, support follow-ups, save and display work |
| Service, device, and security information | IP address processed for requests and abuse controls, IP-derived country, browser/device information, timestamps, request or account identifiers, error and performance events, model/token usage and execution metadata | Operate and secure the Service, enforce country availability for new accounts and purchases, investigate failures, monitor capacity and usage |
| Support and correspondence | Contact details, messages, and information you choose to provide in a support or privacy request | Respond, troubleshoot, verify authority, and document the resolution |
| Transaction information, if you purchase a paid offering | Contact and billing details, plan, transaction identifiers, payment status, and receipts received through the payment process disclosed at purchase | Process the purchase, administer entitlements, handle disputes, and meet accounting duties |
The personal information in connected records depends on what the customer exposes. It may include customer or employee identifiers, contact details, product usage, purchases, subscription history, or other business information. Schema names, free-text fields, SQL literals, and generated results can themselves contain personal or confidential information. We do not assume that a result is anonymous simply because it is a chart or an aggregate.
If a customer connects its own Clerk source, the available records can include its users' identifiers, names, email addresses, profile and public or private metadata, and session identifiers, status, and timestamps. This is separate from using Clerk to sign in to Databrush. Source capabilities differ; connecting Clerk does not mean every PostgreSQL AI or SQL feature is available for that source.
The Service is not intended to receive the restricted information described in the Terms without an additional agreement. That restriction is not a claim that every sensitive value is automatically detected or removed.
3. Connecting sources, including a database before signup
If you submit a database connection string through the website, we receive it even if you have not created an account. The onboarding flow can temporarily retain the connection information in encrypted form in the configured Redis infrastructure and use a browser cookie to continue setup. After you complete an authorized connection, database credentials or supported-source API keys are held by the Service's credential-management infrastructure so it can make future authorized requests.
Connecting a database permits inspection of accessible schema and data for setup and analysis, including generation of a starter canvas. The Service reads connected data on our servers; it is not a tool that operates entirely within your browser or exclusively within your database. Some retrieved information is sent to AI providers, cached, or stored as described below.
Only connect a source you are authorized to expose for these purposes. Use appropriately restricted credentials, API keys, or database views and omit unnecessary personal information. Send credentials only through the designated connection controls. Disconnecting or deleting a source does not revoke its password or API key and can leave retained credential copies as well as information already saved in conversations, charts, results, or provider systems. Revoke or rotate credentials at the source when their validity should end.
4. AI processing and stored outputs
We use OpenAI's API to support schema interpretation, analytical reasoning, SQL generation, answers, titles, and related product functions. Depending on the feature, the information sent may include your prompt, relevant conversation and canvas context, schema and business metadata, generated SQL, and retrieved query results or selected records. The main analysis may therefore disclose personal information from source rows to the AI provider; it is not limited to schema or anonymous totals.
Connection secrets are handled by the connection infrastructure and are not intended AI inputs. If you put a secret in a prompt or expose it in a database field available for analysis, it can become part of processed content. Do not rely on automatic redaction to make that safe.
The Service uses provider-stored responses to continue some AI interactions. Provider storage, operational security logs, and our saved workspace data are separate. We do not represent the Service as providing zero data retention at the AI provider. Retention depends on the API feature, applicable provider settings, and legal or security requirements. OpenAI describes its API data handling in its data controls documentation.
We do not use Customer Data to train general-purpose AI models or opt Customer Data into provider model training. OpenAI states that API data is not used for model training unless its customer explicitly opts in. Processing a request, retaining it, and using it for training are different activities.
Authorized personnel may access relevant content when necessary for requested support, security investigation, or legal obligations, subject to appropriate restrictions. We do not promise that customer content can never be accessed by a person. Customer Personal Data remains subject to the purposes and instructions in the applicable DPA.
5. How we use personal information
We use information to provide and maintain the Service; authenticate users and enforce workspace permissions; establish connections; generate, save, and refresh analysis; respond to support and privacy requests; send administrative notices; prevent misuse and investigate incidents; measure performance and usage; and meet legal obligations or establish and defend claims.
For improvements to reliability and performance, we use operational information and appropriately deidentified or aggregated information. We do not obtain permission through this policy to reuse identifiable customer database records for unrelated purposes or general-purpose model training. Where we process Customer Personal Data on a customer's behalf, our use is limited by its instructions and the applicable DPA.
If we send optional marketing messages, we will do so only on a lawful basis and provide an unsubscribe method. Unsubscribing does not stop essential security, account, or transaction messages. If a new purpose is incompatible with the purpose for which information was collected, we will provide the required notice and obtain a new legal basis or consent where required before that use.
6. Who receives information
We disclose information as necessary to:
- Authorized workspace members and administrators. Content is available according to workspace access controls. Your organization's authorized users may view or manage its content; a work account is not necessarily a private personal account.
- Service providers. Providers support the functions in the table below and receive the categories needed for those functions, not necessarily every category we collect. They are subject to appropriate contractual restrictions for the role they perform.
- Services selected by the customer. A customer's database host receives queries and connection activity and may keep its own logs. Information sent to a separately selected service is also governed by that customer's arrangement with it.
- Professional advisers and legally authorized recipients. We may disclose limited information to advisers, auditors, insurers, courts, regulators, or law enforcement as reasonably necessary for legal duties, incident response, or protecting lawful rights. We assess the legal basis and scope rather than treating any request as sufficient authority.
- Business successors. Information may be transferred in a merger, financing diligence, acquisition, reorganization, or asset sale, subject to appropriate confidentiality and data-protection restrictions. A transaction does not automatically authorize a materially incompatible use.
- Other recipients you direct or validly authorize. We may share specific information at your direction, subject to access controls and applicable law.
We do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising as those terms are defined in applicable US privacy laws. Ordinary disclosures to our providers for the specified service purposes are different from advertising-related sharing. We do not exchange customer database content for advertising value.
| Provider | Function | Information relevant to that function |
|---|---|---|
| Clerk | Databrush authentication | Account/profile identifiers and authentication, session and security information; distinct from a customer's own Clerk source records. Databrush stores its workspace membership records in its application database. |
| OpenAI | AI processing and response continuity | Relevant prompts, context, schema/metadata, SQL, selected source values/results, generated output, and usage metadata |
| Supabase | Application database and object storage | Account/workspace records, schemas, conversations, generated work, and stored result data |
| Amazon Web Services | Credential management | Source connection details, database credentials or API keys, and limited management metadata |
| Vercel | Hosting and server execution | Request/network information and account, source, and workspace information handled during Service execution |
| Upstash or the configured Redis provider | Temporary encrypted connection-setup storage, quotas and related coordination | Encrypted onboarding connection information, limited security/quota identifiers, and necessary coordination metadata where enabled |
| Sentry | Error monitoring and support report triage | Filtered technical events, execution identifiers, error classifications, performance metadata, and messages you submit through Report a problem. Reports include basic canvas and app details and, when you choose to include diagnostics, recent chat messages, generated SQL, and execution details. |
| Stripe | Payments, recurring billing, receipts, and subscription management | Billing contact details, payment details entered directly into Stripe, transaction and subscription identifiers, amounts, payment status, and purchase acceptance records. Databrush receives billing records but does not receive full card numbers or card security codes. |
| Google Workspace | Support and business email | Contact details and the correspondence you send to our support or business email addresses |
| Resend | Transactional email delivery | Recipient and sender email addresses, notification content such as withdrawal statements and receipt references, and delivery information |
Our Data Processing Addendum forms part of the Terms for customer-directed personal-data processing and lists our authorized providers. The Service does not promise that all processing stays in the United States. Contact support@databrush.ai before connecting information that requires additional transfer instruments or specialized safeguards. Other disclosures to authorized workspace users, customer-selected services, advisers, legally authorized recipients, and business successors remain limited to their purposes described above.
8. Retention and deletion
We retain personal information only as long as reasonably necessary for the purposes described here, our instructions and contracts with customers, and applicable legal requirements. The criteria differ by category:
| Information | Retention criteria |
|---|---|
| Account and membership records | Needed to maintain access, administer the customer relationship, resolve account disputes, and satisfy applicable recordkeeping duties |
| Connection credentials and setup records | Needed to complete setup and maintain the authorized connection; credential copies can remain after disconnect or deletion while associated records and provider recovery processes remain; source-side revocation is separate from our cleanup and your deletion rights |
| Chat, schemas, generated SQL, saved artifacts, and result data | Needed to deliver saved work, follow-ups, refreshes, and customer-directed use; deleting an item from active view is not necessarily immediate physical erasure of every related record |
| Temporary caches and session state | Needed for the operation they support, subject to expiration or replacement; expiration of one cache does not erase durable copies of the same information |
| Security, support, and operational records | Needed to investigate issues, maintain security, establish and defend claims, and document required actions, considering sensitivity and relevant legal periods |
| Transactions, when applicable | Needed for accounting, taxation, dispute handling, and other applicable legal retention requirements |
| Withdrawal declarations and acknowledgments | Needed to handle the request, establish when notice was received, document refunds and delivery, and resolve relevant disputes or legal obligations; reviewed separately from ordinary account deletion |
| Backup and disaster-recovery copies | Retained for applicable backup cycles or legal preservation; subject to restricted access and removal or overwriting through the applicable lifecycle |
| AI-provider copies | Retained according to the feature, contractual arrangements, settings, and provider legal/security obligations described in Section 4 |
Some deletion controls deactivate or hide records before permanent erasure. Deleting a chart, canvas, workspace, or individual account does not necessarily delete related revisions, saved results, organizational records, or provider copies at the same time. Contact support@databrush.ai for a privacy deletion request or, if the information belongs to an organizational customer, contact that customer's administrator. We will explain applicable exceptions and fulfill verified requests within the time required by law.
We may retain limited information required for legal compliance, fraud prevention, dispute resolution, or a valid preservation obligation. Retained information remains protected and restricted to those purposes. Where a DPA requires return or deletion of Customer Personal Data, that obligation applies. We do not promise indefinite storage or an immediate purge of all backups.
9. Security and breaches
We use safeguards intended to protect information against unauthorized access, alteration, disclosure, and loss. These include authentication, workspace authorization, protected credential handling, network and query controls, and restrictions on operational logging. The effectiveness of these measures also depends on configuration, maintenance, and the customer's own access choices. We do not claim that encryption prevents every form of access or that a read-only connection prevents a confidentiality breach.
No service can guarantee absolute security. If a personal-data breach occurs, we will investigate, take appropriate action, and provide notices to customers, individuals, and authorities as required by applicable law and contract. Notice obligations and deadlines depend on the affected information, our role, and the applicable jurisdiction; we do not wait for every fact to be confirmed if an earlier notice is required.
Report a suspected security issue to support@databrush.ai. Provide a description and contact details, not passwords, connection strings, or unnecessary personal records. This policy does not limit mandatory breach remedies or your right to complain to a regulator.
10. International processing
We and our providers may process information outside your country, including in the United States. Those countries may have different data-protection laws. We do not offer a customer-specific residency commitment unless it is expressly included in a written agreement.
Where applicable law requires a safeguard for an international transfer, we use an applicable adequacy decision or an appropriate contractual mechanism, together with any required assessment and supplementary measures. Which mechanism applies depends on the exporter, importer, provider, and processing location; a provider's certification does not mean Databrush itself is certified. Contact support@databrush.ai to request information about the safeguards applicable to your data and a copy where available, with necessary protection of confidential information.
11. Your rights and choices
Depending on the law that applies and our role, you may have rights to access or obtain a copy of personal information, know its categories and sources and the purposes and recipients of processing, correct it, delete it, receive portable information, restrict processing, or object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. You may also have rights to opt out of sale, targeted advertising, or specified profiling, and to limit certain uses of sensitive information. We do not engage in the advertising practices described in Section 6.
Submit requests to support@databrush.ai. You can also use available account controls. We may ask for information reasonably needed to verify identity and authority, proportionate to the risk of disclosure; do not send a government ID or password unless a secure and necessary verification process has specifically been arranged. Where permitted, an authorized agent may act for you with appropriate proof of authority.
We respond within applicable legal deadlines and explain a denial or extension where required. If applicable law provides an appeal, reply to our decision or contact the privacy address with "Privacy appeal" and the request reference. You may contact your applicable regulator or attorney general, including where an appeal is denied. We do not unlawfully discriminate or retaliate for exercising privacy rights. Necessary processing may nevertheless be required to provide the requested Service.
You can also raise a privacy complaint without charge through support@databrush.ai, including concerns about how we handled a request, and request assistance with an accessible submission method. Where UK law requires it, we acknowledge complaints within 30 days, investigate appropriately, keep you informed of progress, and communicate the outcome without undue delay. This complaint process is separate from the deadlines for exercising privacy rights and does not prevent you from contacting a regulator.
If your request concerns data we process for a customer, we generally refer or forward it to the customer and assist with its response, rather than changing its records without authority. This does not prevent us from complying with a legal obligation that applies directly to us.
12. Additional information for Europe, the UK, and Switzerland
Where the relevant law applies, our legal bases for controller activities are:
| Purpose | Legal basis |
|---|---|
| Providing an account or service you personally contract for and taking requested pre-contract steps | Performance of that contract |
| Administering your employer's or organization's account, support, and business communications | Legitimate interests in operating the business relationship, subject to your rights |
| Maintaining security, investigating abuse, and improving reliability using appropriate operational data | Legitimate interests in a secure and reliable service, balanced against individuals' rights |
| Required accounting, responding to legally binding demands, and fulfilling statutory obligations | Compliance with applicable legal obligations |
| Optional activities that require consent, such as certain cookies or marketing | Consent, where required |
| Establishing, exercising, or defending legal claims | Applicable legal obligations or legitimate interests, as appropriate |
Customers determine the legal bases for data we process on their behalf. Accepting our Terms does not itself establish a lawful basis for all information in a customer's database.
Providing necessary account and connection information is required to deliver the corresponding feature; without it, we cannot provide that feature. We use AI to assist analytics, but do not use the Service to make solely automated decisions about individuals with legal or similarly significant effects. Customers must separately assess their own use of the outputs.
You can lodge a complaint with the authority in your habitual residence, workplace, or location of the alleged infringement. Contacts are available through the European Data Protection Board, the UK Information Commissioner's Office, and the Swiss Federal Data Protection and Information Commissioner.
13. Additional information for California and other US states
To the extent an applicable US state privacy law covers our processing, the following table summarizes collection and business-purpose disclosures during the preceding 12 months, or the period since the Service began operating if shorter. Sections 2, 5, and 6 explain sources and purposes; Section 8 explains category-specific retention criteria. The conditional transaction category in Section 2 describes paid purchases only if offered and is not a statement that the Service has already collected payment details.
| Categories collected | Business-purpose recipient categories |
|---|---|
| Account identifiers, contact/profile and professional information, and organizational membership | Authentication and hosting/database providers; authorized organizational administrators; advisers or legally authorized recipients when necessary |
| Connection identifiers, credentials and API keys, which may be sensitive information | Hosting, credential-management and encrypted onboarding-storage providers; the customer's selected source to authenticate the connection |
| Connected records, customer content, commercial/product activity and analytical inferences, including personal/sensitive information if made available by the customer | Hosting/database/object-storage and relevant AI providers; authorized workspace users; customer-selected sources; limited support or legal recipients where required |
| Network/device identifiers, service interactions and usage/performance/security information | Hosting, authentication/security, rate-limit, monitoring and database providers; relevant advisers or legally authorized recipients |
| Support/privacy correspondence and verification information | Authorized personnel and relevant storage/communications providers; the customer whose data is concerned; advisers or legally authorized recipients where required |
Not every recipient receives every field. Where a person requests more detail that applicable law requires us to provide, the request process in Section 11 applies.
We use sensitive information only as needed to provide the requested Service, maintain security, or for other legally permitted purposes. We do not sell personal information or share it for cross-context behavioral advertising, including information about people known to be under 16. We do not offer financial incentives in exchange for personal information. Section 11 explains requests, authorized agents, appeals where applicable, and nondiscrimination.
Where we act solely as a service provider or processor for a business customer, that customer handles the corresponding consumer request, with our assistance under applicable law and the DPA.
14. Children
The Service is intended for users aged 18 and over, for personal or business use, and is not directed to children. We do not knowingly solicit accounts from children. Customers must not make children's personal information available without an agreement establishing the necessary legal basis and safeguards. If you believe we received children's information improperly, contact support@databrush.ai so we can investigate and take legally required action.
15. Policy updates and contact
We will update the effective date when this policy changes. For material changes, we will provide a prominent notice or contact affected users as appropriate and obtain consent where legally required. We will not rely solely on an update to this policy to authorize an incompatible new use of information already collected.
For questions or requests, contact support@databrush.ai or write to DATABRUSH LLC, 10 Swackhamer Rd, Whitehouse Station, NJ 08889, United States.