Legal
Privacy Policy
What personal data ShadowDB collects, why, how long we keep it, and the rights you have over it.
Draft · This document is under legal review and is not yet in effect. Text in [BRACKETS] is still to be filled in.
01Who is responsible
[LEGAL ENTITY NAME] is the controller of the personal data described here. Contact us at [PRIVACY EMAIL]. [DPO / EU REPRESENTATIVE, IF REQUIRED]
For the code and data you ask us to process through the service, we act as your processor; see the Data Processing Agreement.
02What we collect
Account data: your name, email address and GitHub identity when you sign in, and your organisation memberships and roles.
Early access requests: the name, email, company, role, team size, migration tool, PostgreSQL version and message you send through the form.
Service data: repository and pull request metadata, migration files, and the results of each run.
Technical data: IP address, request logs and security events, kept to run and protect the service.
Website analytics: anonymous page-view counts from Vercel Web Analytics on this site, without cookies.
03Why we use it
To provide the service (contract), to keep it secure and prevent abuse (legitimate interest), to reply to early access requests (legitimate interest or consent), and to meet legal obligations. We don't sell personal data or use your code to train models.
04How long we keep it
Raw migration bundles are deleted when a run finishes. Statement SQL, logs and reports are kept for your plan's retention period. When you delete an organisation, everything, including stored artifacts, is purged after 30 days. [ACCOUNT AND EARLY ACCESS RETENTION PERIODS]
05Who we share it with
GitHub, to read pull requests and post checks; Stripe, to take payments for paid plans (it receives your billing details; we never see card numbers); Vercel, for website analytics; and the sub-processors that host the service: [SUB-PROCESSOR LIST WITH LOCATIONS]. [INTERNATIONAL TRANSFER SAFEGUARDS, E.G. SCCs]
06Your rights
Depending on where you live, you can ask to access, correct, delete or export your data, or object to how we use it. Email [PRIVACY EMAIL]. You can also complain to your local data protection authority.