Privacy Policy

1. Data controller

2. What data we collect

• Account data: name, email, company name.
• Usage data: analyses performed, investigations created.
• Performance files: AWR reports, ASH reports and log files uploaded by the user for analysis.
• Billing data: managed by Stripe (we don't store card data).
• Technical data: IP address, browser, session cookies.

3. How we use your data

• Provide the DBA Copilot service.
• Process performance files with AI (Anthropic API).
• Send transactional emails (Resend).
• Process payments (Stripe).
• Improve the service.

4. Third-party processors

Note on Anthropic: files sent to the Anthropic API are processed but not used to train AI models. See Anthropic's usage policy at anthropic.com/legal/aup.

5. Legal basis (GDPR)

• Contract performance (Art. 6.1.b): account and billing.
• Legitimate interest (Art. 6.1.f): service improvement.
• Legal obligation (Art. 6.1.c): tax records.

6. Data retention

• Account data: while the account is active + 3 years.
• Uploaded files: stored for the duration of the investigation, deletable by the user at any time.
• Billing records: 7 years (legal requirement in Spain).

7. Your rights (GDPR Art. 15-22)

You have the right to access, rectification, erasure, portability, restriction and objection.

To exercise them, contact [email protected].

You also have the right to lodge a complaint with the AEPD (aepd.es).

8. Cookies

• Session cookies (necessary, no consent required).
• No third-party tracking or advertising cookies.

9. International transfers

Anthropic, Voyage AI, Stripe and Resend are based in the USA. These transfers are covered by Standard Contractual Clauses (SCCs) or adequacy decisions.

10. Changes to this policy

We will notify users by email of material changes.