1. Who is responsible
The controller is Ruben Gomez Morales, trading as ElectraDB (“we”). Write to [email protected] about anything in this policy.
Data protection officer: We have not appointed one; write to the privacy address.
2. What we collect, why, and for how long
| What | Data | Purpose and legal basis | Kept |
|---|---|---|---|
| Your account | Work email, password (stored only as an Argon2id hash), company name, country, when you verified your email and last logged in, the version of the terms you accepted, if you turn on two-factor sign-in its secret (encrypted) and hashed recovery codes, and hashes of the browser and network you signed in from before (so we can email you about a sign-in from a new one; no addresses are kept for this) | Providing the service and your account (contract, art. 6(1)(b) GDPR) | While your account exists; deleted within 30 days after you close it |
| Billing | Billing email, company, country, VAT id, invoices, payment status. Card details are held by Stripe; we never see the card number | Contract (art. 6(1)(b)); keeping invoices is a legal obligation (art. 6(1)(c)) | Invoices and billing records for as long as tax and accounting law requires; the rest with the account |
| Security and abuse prevention | IP address at signup and login, the human check on signup and login (Cloudflare Turnstile), rate-limit counters | Protecting the service and our customers (legitimate interest, art. 6(1)(f)) | Signup IP: 30 days. Rate-limit counters: minutes, in memory only |
| Sessions and API keys | A session cookie (14 days) with the IP address and browser it was last used from (shown to you under Your login, so you can sign a device out), API key names and when they were last used; keys and tokens are stored only as hashes | Keeping you logged in and authenticating API calls (contract) | Sessions: until they expire or you log out (removed 1 day after expiry). Email links: 24 h (verification) or 1 h (password reset), removed 7 days after expiry |
| Latency checks | The IP address of a server you ask us to measure the latency to, the region, and the round-trip times our servers measured | Running the check you asked for (contract) | 7 days |
| Activity log | What was done on your account and databases and by whom (for example: database created, plan changed, password reset) | Security, support and dispute resolution (legitimate interest, art. 6(1)(f)) | While your account exists |
| Website analytics (only if you accept analytics cookies) | The pages you view on this website (the address without its query string), the referring website, device and browser type, approximate location that Google derives from your IP address (Google Analytics does not store IP addresses), linked by the Google Analytics cookie | Learning which pages are read so we can improve the website (consent, art. 6(1)(a) GDPR and art. 22.2 LSSI-CE); you can withdraw it at any time under Cookie settings | 2 months in Google Analytics |
| Service emails | Your email address and the notices we send (verification, password reset, database ready or resized, payment problems) | Contract (art. 6(1)(b)). We do not send marketing email | As for your account |
3. What we do not do
- No advertising cookies. Google Analytics runs only if you accept it, and we do not link it to your account.
- We do not sell personal data or share it for advertising.
- No automated decisions with legal or similarly significant effects.
4. Who receives data
Only the service providers we need to run ElectraDB, each bound by a data processing agreement: listed with their purpose and location on the Sub-processors page. If you accept analytics cookies, Google receives website usage data for Google Analytics. We share data with authorities only when the law requires it.
Our operational alerts (for example to our team chat) contain technical identifiers only, not your name, email or full IP address.
5. Transfers outside the EU
Account data is stored in the EU. We send email through Brevo. Some providers (Stripe, Cloudflare) may process it in the United States under the EU-US Data Privacy Framework or the EU Standard Contractual Clauses. If you accept analytics cookies, Google Analytics (Google Ireland Ltd., with Google LLC in the United States) receives website usage data under the same safeguards. Databases you create in the US or Asia region, and their backups, are stored there because you chose that region.
6. Security
TLS on every connection, passwords hashed with Argon2id, API keys and tokens stored only as hashes, secrets encrypted at rest, backups encrypted with a key per database before they leave the server, least-privilege access for our own systems, and a record of administrative actions. Details are in the DPA.
7. Your rights
You can ask for access to your personal data, a copy in a portable format, correction, deletion, or restriction of processing, and you can object to processing based on legitimate interest. Write to [email protected] from your account email; we answer within one month. You can correct most account data yourself, and closing your account deletes it as described above.
You can complain to a data protection authority, in particular where you live or work, or to ours: Agencia Española de Protección de Datos (AEPD) (https://www.aepd.es).
9. Changes
We update this policy when our processing changes, and email account owners about material changes. The version and date at the top show the current one.