Privacy Policy

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Email address
• Password (stored as a bcrypt hash — we never store your plaintext password)
• First and last name (optional)
• Profile image URL (optional)

1.2 Organization Information

If you create or join an organization, we collect:

• Organization name
• Organization logo and icon (optional)
• Member email addresses (for invitations)

1.3 Database Connection Credentials

When you connect an external data source, we collect connection details such as hostname, port, database name, and username. Database passwords are encrypted using AES-256-GCM authenticated encryption before storage. We enforce read-only access on all external database connections.

1.4 Google Account Data

If you connect Google Sheets, we request read-only access to your spreadsheets, drive file list, and basic email information via OAuth. OAuth tokens are encrypted using AES-256-GCM before storage. We only access the specific sheets you choose to import.

1.5 Usage and Query Data

We collect data about how you use the Service, including:

• Natural language queries you submit to the AI
• SQL queries generated by the AI
• Chat conversations with the AI assistant
• Dashboards and charts you create
• Internal analytics events (e.g., features used, pages visited)

1.6 Security and Access Logs

For security purposes, we collect:

• Login attempts (IP address, user agent, success/failure)
• Session information (IP address, user agent)
• Password reset request metadata (IP address, user agent)

1.7 Payment Information

Payments are processed by Stripe. We send your email address and name to Stripe to create a customer record. We do not store credit card numbers, bank account details, or other payment credentials on our servers. Please refer to Stripe's Privacy Policy for details on how they handle payment data.

1.8 File Uploads

When you upload CSV or Parquet files, the data is parsed in memory and stored directly in the database. No uploaded files are persisted on disk. Image uploads (e.g., organization branding) are limited to 512KB and restricted to PNG, JPEG, and WebP formats.

2. How We Use Your Information

We use your information to:

• Provide, maintain, and improve the Service
• Generate SQL queries from your natural language questions using AI
• Process payments and manage your subscription
• Send transactional emails (account verification, password resets, scheduled reports, alert notifications)
• Enforce rate limits and service tier quotas
• Detect and prevent unauthorized access, fraud, and abuse
• Maintain audit logs for security purposes
• Provide customer support

We do not sell your personal information. We do not use your data for advertising or share it with advertisers.

3. AI and Data Processing

3.1 What We Send to AI Providers

To generate SQL from your natural language queries and answer follow-up questions accurately, we send the following to our AI provider (Anthropic Claude):

• Your database schema metadata (table names, column names, and data types)
• Row counts per table
• Table relationships (foreign keys)
• Business glossary terms you have defined
• Your natural language queries and chat messages (which may contain data values you type into them)
• SQL generated during your session (including when the AI corrects a failed query)
• Small samples of query results as conversation context: when you ask a follow-up question in a chat conversation, up to 3 rows of a prior query's results (truncated to 300 characters) are included so the AI can reference the actual values it showed you instead of guessing. This is limited to your active conversation and is subject to the same protections described in Section 3.4.

3.2 What We Do NOT Send to AI Providers

We never send the following to any AI provider:

• Your datasets or complete query results (only the small conversation-context samples described in Section 3.1)
• Passwords, credentials, or connection strings
• Other users' data (multi-tenant isolation is enforced)
• Payment information

3.3 Query Results

Query results are fetched directly from your connected database by our server and delivered to you. Results are cached temporarily (per-query expiry) within your organization scope. Apart from the small conversation-context samples described in Section 3.1, query results are not sent to AI providers.

3.4 AI Provider Data Protection: No Training, Limited Retention

We access Anthropic Claude through Anthropic's commercial API, governed by Anthropic's Commercial Terms of Service. Under those terms, Anthropic does not train its models on the inputs we send or the outputs it returns. Anthropic's published policy states that, by default, it will not use inputs or outputs from its commercial products (including the Anthropic API) to train its models. Anthropic also automatically deletes API inputs and outputs within 30 days of receipt or generation (retained longer only where required to enforce its usage policy or comply with law).

Civalyze does not enroll in any feedback or data-sharing program that would permit such training. As a result, your data is never used to train AI models. You can review the underlying commitment in Anthropic's Commercial Terms of Service.

4. Third-Party Services

We use the following third-party services to operate the platform:

We do not use any third-party analytics, tracking pixels, advertising SDKs, or fingerprinting services. All usage analytics are collected and stored internally within our own database.

5. Data Security

We implement the following security measures to protect your data:

• Encryption at rest: Database credentials and OAuth tokens are encrypted using AES-256-GCM authenticated encryption
• Password security: Passwords are hashed with bcrypt (12 salt rounds) and checked against a common password dictionary
• Two-factor authentication: Optional TOTP-based 2FA with encrypted secrets and hashed backup codes
• Session security: HttpOnly, Secure (in production), and SameSite cookies with 7-day expiry
• Account lockout: Progressive lockout after 5 failed login attempts (15–120 minutes)
• Rate limiting: Per-endpoint rate limits on authentication, password resets, and API calls
• Read-only enforcement: All external database connections are restricted to read-only operations
• Multi-tenant isolation: Automatic organization-level data scoping on all queries
• Input validation: All API inputs are validated using Zod schemas with parameterized database queries
• Webhook verification: Stripe and GitHub webhooks are cryptographically verified
• Sensitive data redaction: Passwords, tokens, and API keys are automatically redacted from logs

6. Data Retention

We retain your data for the following periods:

Automated cleanup jobs run daily to delete data that has exceeded its retention period.

7. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of the personal data we hold about you. You can export your data from the "Export My Data" section of your account Settings.
• Rectification: Update your personal information through your account settings.
• Erasure: Delete your account and all associated data from the "Delete Account" section of your account Settings. Account deletion includes a 14-day grace period, after which all data is permanently purged.
• Portability: Export your data in JSON format from the "Export My Data" section of your account Settings.
• Restriction: Request restriction of processing by contacting us.
• Objection: Object to certain types of data processing by contacting us.

To exercise any of these rights, use the self-service options in your account settings or contact us at [email protected].

8. Cookies

We use only essential, functional cookies:

We do not use tracking cookies, third-party cookies, or advertising cookies. All cookies are HttpOnly and Secure (in production) with SameSite protection.

9. Children's Privacy

The Service is not directed to children under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us at [email protected] and we will delete it promptly.

10. International Data Transfers

Your data may be processed in the United States and other countries where our service providers operate. By using the Service, you consent to the transfer of your data to these jurisdictions. We take steps to ensure that your data receives an adequate level of protection wherever it is processed, including through the use of encryption and contractual safeguards.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting a notice on the Service prior to the change becoming effective. Your continued use of the Service after any changes constitutes your acceptance of the updated policy.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

• Email: [email protected]
• Civalyze LLC (Arizona, USA)