Privacy policy

In short

We collect what we need to run your account and your projects, nothing for advertising. There are no analytics or tracking scripts on this site. We do not sell data, and we do not use your data or your users' data to train AI models.

What we collect

• Your console account: email address, name, password hash (never the password), and, if you sign in with Google or GitHub, the account id, name and picture they send us.
• Sessions and security: the session cookie, and for each session the IP address, browser and time of sign-in, so you can see and revoke sessions and we can stop abuse.
• Your workspaces and projects: their settings, members and invitations, and the data you and your apps store in them.
• Logs and the trace: every API call and rule decision, as described in the trace docs, including the caller's IP address in request logs.
• Email: sign-in links and notices we send you.
• Messages you send us: what you write in the contact form (your email, and name, company and message if given), the page you came from and your IP address, to reply and to stop spam. Deleted on request.
• The beta waitlist: the email address (and name, if given) of anyone who signs up while sign-up is closed, until we let them in or they ask us to remove it.

The site and console use your browser's storage for small conveniences (for example, remembering that you are signed in, to show "Open console"). We use no third-party cookies.

Your app's users

When your app stores data about its own users (including through dabadata's hosted sign-in), you are the controller of that data and we process it only on your instructions, to run your project. Your users should contact you first; we will help you answer their requests.

An app on a *.dabadata.site address may let its users sign in through dabadata's own Google app ("dabadata site") instead of its own. Then Google sends us the user's Google account id, email address, name and picture, and whether Google verified the address. We use them only to sign the person in to that app and to keep their account there: they are stored in that app's project, the app's owner controls them as above, and we never use them for anything else or share them with other apps.

Who helps us run dabadata

• Amazon Web Services - the servers and the database.
• Cloudflare - the network in front of dabadata.com, hosting of sites on dabadata.site and custom domains, and storage of files and nightly backups (R2).
• Resend - sending email.
• Google and GitHub - only if you choose to sign in with them, or a user of an app signs in to it with Google through dabadata's Google app.
• Stripe - payments, once paid plans open; card details go to Stripe, never to us.

Some of them process data outside Israel and the EU, under their own data-protection terms.

How long we keep it

• The trace and API logs are deleted nightly after the retention of your plan (see plans and limits).
• Your projects' data stays until you delete it or the project.
• Nightly backups are kept for 30 days, so deleted data leaves the backups within 30 days.
• Your account stays until you delete it in the console.

Your rights

You can see, export, correct and delete your data from the console, or ask us to do it. You may also complain to your data-protection authority. Contact us through the contact page.

Changes

If this policy changes we will update the date above, and email account owners about material changes before they apply.