1. Who we are and our roles
This Privacy Policy explains how DATABRUSH LLC, doing business as Databrush (“Databrush,” “we,” “us”), collects, uses and shares personal information when you visit our websites, use our apps, API, MCP server or emails (the “Service”), or communicate with us.
For account, billing, website, support, security and sales information, Databrush decides how information is used.
Our customers connect their databases and other sources to Databrush. Information in those sources, including information about our customers’ own customers and users, is “Customer Data”. We process Customer Data for our customer, as its service provider or processor, under our Terms and Data Processing Addendum. Our customer’s own privacy notice governs that information. If you are a customer or user of a business that uses Databrush, see Section 11.
2. Information we collect
| Category | Examples | Source |
|---|---|---|
| Account and team | Name, email address, sign-in identifiers, profile photo, team and workspace membership, role, settings, time zone, email preferences | You; sign-in providers such as Google and GitHub, through Clerk |
| Billing | Billing contact and address, plan, trial and subscription status, invoices, tax details. Card details go directly to Stripe; we don’t receive full card numbers | You; Stripe |
| Connection information | Supabase authorization tokens; database host, name, username and password, or API keys for other sources; connection health | You; Supabase |
| Customer Data | Table and column names, database statistics, category values such as status or plan names, records the connected source makes available, and the results and history the Service creates from them (Section 3) | Our customers’ connected sources |
| Agent and API information | Keys, the agent apps you connect and their sign-in details, and logs of agent calls and exports (time, tool, workspace, user) | You; your agents |
| Usage, device and security | IP address and the country derived from it, browser and device details, features used, pages viewed on our website and the website that referred you, cookie identifiers, timestamps, error and performance data, logs | Automatically, when you use the Service or visit our website (Section 7) |
| Email delivery | Delivery, bounce and complaint events; unsubscribe choices | Our email provider; you |
| Support and inquiries | Messages, support requests, problem reports and any diagnostics you choose to include, and sales inquiries such as the capacity request form | You |
| Business contacts | Names, job titles, business email addresses and company details of people at businesses that might use Databrush | Public sources such as company websites and professional profiles; referrals |
3. Connecting Supabase and other sources
Supabase approval. When you approve Databrush in Supabase, Supabase gives us authorization tokens, which we keep encrypted with our credential-management provider. We use them to read the projects you choose through Supabase’s read-only interfaces.
What we read. Tables in the schemas you choose, database statistics, and, from Supabase’s sign-in (Auth) tables, user IDs, email addresses, sign-up and last sign-in times, session times and sign-in events.
What we keep. To measure churn and retention, the Service keeps a history for each customer in the connected database: their identifier in that database (such as a primary key), status, plan or segment labels, billing status and amounts where the database holds them, daily activity counts, warnings, and records your team adds, such as marking a customer as contacted. This history is designed not to include names, email addresses or free text.
What we read when needed. Names and email addresses are read from the database when a page, an exclusion rule or an agent request needs them. They are designed not to be kept in the history above.
Other connection methods. If you connect with a connection string or API key, we keep the credentials encrypted with our credential-management provider. During sign-up, connection details may be held briefly, encrypted, in temporary storage, with a browser cookie to continue setup.
Other workspace features. In workspaces with AI chat and canvases, query results, which can include personal information, may be saved with conversations, charts and tables.
Disconnecting. Disconnecting a Supabase source deletes the history Databrush kept for it. Disconnecting does not revoke Databrush’s approval in Supabase or your credentials at the source; revoke those there.
4. AI providers and agents you connect
Our AI provider. We use OpenAI for some features. When the Service proposes your setup or words a suggestion, the information sent is designed to be limited to schema details (table and column names, types and comments), database statistics, category values such as status or plan names, and calculated figures. It is designed not to include customers’ names, email addresses, free text or identifiers. In AI chat and canvases, prompts, conversation context, schema details, SQL and query results are sent, and those can include personal information.
We have not opted in to OpenAI using our API data to train its models. OpenAI may keep API data for a limited time, for example for abuse monitoring, as its terms describe; we do not promise that it keeps none. We do not use Customer Data to train general-purpose AI models.
Agents you connect. When you connect an agent, such as Claude, ChatGPT or Codex, through our MCP server, we send it the information it asks for, within the permissions of the user who connected it. The agent and its AI provider handle that information under their own terms and privacy policies. Customer names and email addresses go to an agent only if the user who connected it turns that on in Settings › MCP. An agent can also hand a person a link to download a contact list; each link expires after a short time.
5. How we use information
- To provide the Service: sign-in, connecting sources, scheduled analysis, showing results, sending emails, serving agents and support.
- To run accounts and billing: trials, subscriptions, invoices, plan limits and account administration.
- To communicate with you: service emails such as nightly summaries, weekly digests, alerts, notices about lost access or upcoming deletion, receipts, and security and account messages. You can change most of these in Settings or with the unsubscribe link; security, billing and account messages may still be sent.
- For sales and marketing: emails about Databrush, including to business contacts at companies that might use it. Each includes a way to opt out.
- To improve the Service: using usage information and aggregated or de-identified information.
- For security and legal reasons: preventing fraud and abuse, enforcing our Terms, complying with the law and protecting our rights and others’.
We use Customer Data only to provide the Service to the customer that connected it and as our Terms and Data Processing Addendum allow.
8. How long we keep information
We keep personal information for as long as we need it for the purposes in this policy, then delete or de-identify it. Generally:
| Information | How long |
|---|---|
| Account and team information | While the account is open, then deleted after you delete the account, except records we must keep |
| Customer history (Section 3) | Daily records for about 400 days, then weekly summaries for up to 3 years, while the source stays connected. Deleted when the source is disconnected or the workspace or account is deleted, or 30 days after Databrush loses access to the database if access isn’t restored |
| A customer who leaves the connected database, or whom our customer asks us to forget | Their records are removed from the history after about 30 days, or on request; anonymous statistics with no link to the person may remain |
| Analysis results, warning history and run records | About 400 days |
| Email sending records | About 30 days after sending |
| Website analytics (Section 7) | Google Analytics cookies up to 400 days unless you delete them sooner; visit data kept by Google Analytics for the retention period set in our Google Analytics account |
| Conversations, charts and saved results in other workspaces | Until deleted by the team, or until the workspace or account is deleted |
| Billing records | As long as tax and accounting rules require, generally up to 7 years |
| Security logs, support and legal records | As long as needed for security, to resolve issues and disputes, or to meet legal obligations |
| Backups | Overwritten on our database provider’s backup cycle |
| Copies held by AI providers | As their terms describe (Section 4) |
We may keep information longer where the law requires it or to establish or defend legal claims.
9. Security
We use reasonable measures designed to protect personal information, including encryption in transit, encrypted storage of credentials and tokens, access controls, read-only access to connected databases and limits on what our logs record. No method of transmission or storage is completely secure, and we cannot guarantee security. Report a security concern to support@databrush.ai, without including passwords, tokens or connection strings.
10. Your choices and rights
- Your account. Update your profile in the app, and delete your account in Settings or by emailing us.
- Emails. Change email preferences in Settings, or use the unsubscribe link in an email. To stop sales emails, reply or use the opt-out in the email.
- Agents. Turn customer names and emails off for your agents in Settings › MCP, and revoke agent keys and sign-ins at any time.
- Privacy rights. Depending on where you live, you may have the right to know, access, correct or delete personal information we hold about you, to get a copy of it, and to opt out of its sale, targeted advertising or certain profiling. Email support@databrush.ai to make a request. We will verify your request before acting on it, and an authorized agent may make a request for you with proof of authority. If we deny your request, you may appeal by replying with “Privacy appeal”. We will not discriminate against you for exercising these rights.
11. If your information is in a customer’s database
If you are a customer or user of a business that uses Databrush, that business decides how your information is used, and its privacy notice applies. Please contact that business with questions or requests. If you contact us, we will pass your request to the business where we can identify it. Our customers can ask us to delete the information we hold about a particular person by contacting support@databrush.ai.
12. U.S. state privacy disclosures
This section applies where a U.S. state privacy law, such as California’s, applies to us. In the last 12 months we collected the categories below, from the sources in Section 2, for the purposes in Section 5, and disclosed them for business purposes to the recipients in Section 6.
| Category | Examples |
|---|---|
| Identifiers | Name, email address, account, device and cookie identifiers, IP address |
| Customer records and commercial information | Billing details, plan, trial and subscription history |
| Internet activity | Use of the Service, visits to our website, logs, error and performance data |
| Approximate location | Country derived from IP address |
| Professional information | Job title and company, for business contacts |
| Sensitive information | Account sign-in credentials, database credentials and authorization tokens |
| Customer Data | Information about our customers’ customers, processed as a service provider (Sections 3 and 11) |
We use sensitive information only to provide the Service, keep it secure and for other purposes the law permits. We do not sell or share personal information, including of anyone under 16, and we do not offer financial incentives for personal information. Section 8 explains how long we keep it, and Section 10 how to exercise your rights.
13. Children
The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect personal information from children. Customers must not connect children’s personal information without a separate written agreement with us. If you believe we have collected a child’s information, contact us and we will delete it.
14. Users outside the United States
The Service is offered to businesses in the United States. We and our providers process information in the United States and other countries where they operate. If you use the Service from outside the United States, your information will be transferred to and processed in the United States. If the data-protection law of another country applies to your information, contact us about it.
15. Changes and contact
We may update this policy and will post each update with its date. For material changes, we will notify you by email or in the Service before they take effect.
Questions or requests: support@databrush.ai, or DATABRUSH LLC, 10 Swackhamer Rd, Whitehouse Station, NJ 08889, United States.