Privacy Policy
This policy explains how Premsan Inc (“Premsan”, “we”, “us”) handles personal data in PerSQL — this website, the web app, the API, and the PerSQL apps for iPhone, iPad and Android. Premsan is the controller of that data.
1. What we collect
- Your account. Your name, your email address, and either a password — stored only as a hash — or, when you sign in with Apple or Google, your identifier there and the sign-in tokens they give us. Each session records the IP address and the browser or device it was opened from, and when it expires. We also record the date on which you accepted the Terms, and which version.
- What you bring. Your databases — every table and every row in them — their backups, the queries you save, the photos you send, and the messages you exchange with the assistant. A file you upload for import is deleted when the import ends. What goes in is your choice; PerSQL holds it exactly as you gave it, and you can change or delete any row, table, backup, saved query or database at any time.
- What the assistant reads. When you ask the assistant something, it sends the model your message and any photo with it, the names of your databases, tables and columns, your saved queries, a few sample rows, and the rows its queries return, so that it can answer. A change it proposes is shown to you to approve or discard, and nothing changes until you approve it.
- Keys and agents. A developer key you create is stored only as a hash, with the name you gave it, when you created it and when it was last used. An agent you allow through the browser is recorded with the name and web address it registered, the day you allowed it, and the access tokens it holds, until you remove it under Connected agents in Settings or delete your account.
- Exports. When you export a database as SQL or SQLite, or a table as CSV, the file is kept in our storage for seven days so that you can download it, and is then deleted.
- Help. When you write to us from Help, we keep your messages, the images you attach, and the details the web app or the phone app sends with them — the browser or app version and operating system, the screen you came from, the window size, your time zone and the last few requests that failed — with our replies, in your account’s storage. Our team reads them in our own support tool, where, if you have allowed the assistant, PerSQL’s model may draft a reply that a team member reviews before sending.
- What the assistant remembers. The facts you tell the assistant about yourself, your work, your data and how you want it to work, kept as memories, each for all your databases or only for one, so every later conversation they apply to starts with their titles and descriptions: each one’s kind, title, description and details, whether you or the assistant wrote it last, and when. You see and delete them in Settings, and correct one by telling the assistant; their titles and descriptions go to the model with every message you send it, and a memory’s details when the assistant opens it.
- Your voice. When you turn on voice mode, what you say is recorded and sent to be written down as text; the text goes to the assistant as your message, and the recording is deleted once it is written down. The assistant’s replies are read aloud by your own device’s voice.
- The plan. When your free use began, how many messages you have sent since, and the state of your subscription. On the web, payment is taken by Stripe: it receives your email address and your account id, and your card details go to Stripe and never reach us. We keep the subscription’s id, its customer id at Stripe, when it runs to and whether it renews. In the app, payment is taken by the App Store or Google Play; we receive the transaction’s id, confirm it with Apple or Google, and record it against your account.
- Usage. Monthly counts of assistant runs, queries, rows written and model tokens, kept in your own account’s storage for our accounting. Server logs hold request metadata, including your IP address, and error reports for a short time, for security and debugging.
- The bot check. Cloudflare Turnstile runs on our sign-in and sign-up pages, and on the app’s sign-in screen, to tell a person from an automated script.
- Nothing else. There is no advertising, no analytics, no tracking across sites or apps, no advertising identifier, and no data broker.
2. What we do with it
We use personal data to run PerSQL: to store your databases and answer your questions about them, to import and export your files, to sign you in, to send you the emails the account needs — a verification link and a password reset — to take payment and keep your subscription’s state, to keep the service running and prevent abuse, to answer you when you write to us, and to meet legal obligations. We do not use your data or your conversations to train models, we do not sell personal data, and we do not share it for advertising.
3. Why we are allowed to
Where the GDPR or a similar law applies, we rely on these bases:
- Performing our contract with you — your account, your databases, your conversations, and the subscription. Without them we cannot provide the service.
- Our legitimate interests — keeping PerSQL running, finding failures, and stopping abuse and automated sign-ups. We limit this to what running the product needs: the usage counts, the logs and the bot check, not profiling and not advertising.
- A legal obligation — payment records and anything else the law requires us to keep.
- Your consent — for any data the law treats as a special category, such as health information, that you choose to put in a database or a conversation. You give it by putting the data in, and you withdraw it by deleting the data, the database or the account.
4. Who else processes it
PerSQL runs on Cloudflare: the servers, the storage that holds your account and your databases, the model that answers your questions, the email we send, and the bot check are all Cloudflare services on our own account. No question of yours, and no row of yours, goes to any other AI provider. The model runs on Cloudflare Workers AI, and the assistant sends it nothing until you allow that, on the web or in the app, when it asks before your first message; you can turn it off in Settings (under Account in the phone app), and the assistant then asks again before your next message. Some email may be sent through Resend instead. Stripe takes payment on the web and holds your card details; Apple and Google take payment in the app, and each tells us when a subscription you bought there renews, is cancelled or is refunded. When the app opens, it asks Expo’s update service whether a newer version of our code is available; that request carries the operating system, our project id and a random identifier the app created for itself — no account and no device identifier — and Expo sees the IP address it came from. These providers process data only on our instructions and are each bound to protect it at least as well as this policy does; we will list a new provider here before it starts.
In voice mode, each recording of what you say goes to Cloudflare Workers AI to be written down as text, and to no other provider; we do not keep the recording.
Signing in with Apple or Google sends us your identifier and email from that provider. Each acts on its own behalf there, not as our processor, and its handling of your account with it is governed by its own privacy policy; if you hide your email from us with Apple, our emails reach you through Apple’s relay. The App Store and Google Play are the sellers of what you buy in the app, and their handling of your payment is governed by their own policies.
When the assistant searches the web, the words it searches for, which it writes from your conversation, go through Cloudflare to Linkup, or to Ceramic.ai when Linkup cannot answer; neither keeps them once it has answered. When the assistant reads a web page, our servers fetch it from its site in a request that names PerSQL, and the site sees nothing else of yours.
5. Where it is
Your data is processed on Cloudflare’s global network, and stored on it under Cloudflare’s own commitments for international transfers. Premsan is in Japan, a country the European Commission recognises as protecting personal data adequately.
6. On the phone
The app keeps on your device a sign-in token, the language and appearance you picked, the random identifier its update check uses, and, when you export a database or a table, a copy of that file in the app’s own cache for the share sheet. It reads a file only when you tap Import and pick one, and a photo only when you attach one to a message. Picking a photo from your library needs no permission; the operating system asks for your permission to use the camera the first time you take a photo. It uses the microphone only while voice mode is on, and the operating system asks your permission the first time you turn it on. Nothing is read in the background. Purchases go through the store’s own sheet. The app contains no advertising or analytics library, and the only review prompt it shows is the operating system’s own, once, after you first export a database.
7. Cookies
On the web we set only the cookies the product needs: the one that keeps you signed in, and the ones Cloudflare Turnstile sets to tell a person from an automated script on the sign-in and sign-up pages. This website and the web app keep your theme and language in your browser’s own storage. There are no advertising cookies, no cross-site trackers and no analytics that follow you between sites, so we do not ask you to accept cookies. Clearing the cookies signs you out.
8. How long we keep it, and deleting it
We keep your account and everything in it for as long as the account exists, with two exceptions: exports are deleted after seven days, and a backup taken automatically before a change, or by the assistant, can be restored for 30 days and is then removed. Deleting a backup, a saved query or a memory removes it. Deleting a database removes it with its rows, backups, exports, saved queries, the memories kept only in it, photos and conversation. Verification and reset links expire on their own.
You can delete your account at any time: on the web under Account in Settings, or in the app under Account. We then erase everything we hold for you — every database, backup, export, photo, saved query, memory, conversation, Help message, developer key, connected agent, usage count and the subscription’s state — and then the account itself, except the records listed below. You cannot undo it.
These records remain after the account is deleted:
- If you bought a subscription in the app, a record of the store’s transaction id, the date, and the id of the deleted account. It is kept so that the same purchase cannot be claimed by another account, and because the law requires payment records to be kept.
- Stripe, Apple and Google keep their own records of a payment under their own legal obligations.
- Cloudflare keeps restorable copies of our databases for up to 30 days so that they can be recovered after a failure; they then expire.
- Server logs are deleted automatically after a short time.
9. Your rights
You can read, correct and delete every row, table, backup, saved query and database yourself, read and delete every memory, export any database as SQL and any table as CSV, and delete your account, without asking us. Depending on where you live, you may also have the right to a copy of the rest of what we hold about you, to restrict how we process it, to object to processing we base on legitimate interests, to withdraw consent where we relied on it, and to move your data elsewhere. Write to support@persql.com and we will answer within one month.
If you live in California or another U.S. state with a similar law, you have the right to know what personal data we hold about you, to delete it, and to correct it; the controls above do that. We do not sell or share personal data as those laws define the terms, so there is no opt-out to offer, and exercising a right gets you the same service on the same terms.
If you think we have handled your personal data wrongly, you can complain to a data protection authority — in the EEA or the United Kingdom, the one where you live or work or where the problem happened; in Japan, the Personal Information Protection Commission. You may contact us first, but you do not have to.
10. Security
Every connection is encrypted in transit. Passwords and developer keys are stored as hashes. Each user’s account and each of their databases is kept in its own isolated storage and is deleted with the account, apart from the records listed in section 8. The app keeps its sign-in token in the operating system’s secure storage, not in a cookie. Credentials are never written to our logs. If you find a security weakness, write to security@persql.com and give us time to fix it before you disclose it.
11. Children
PerSQL is not for anyone under 16, and we do not knowingly hold a child’s data. If you think a child has an account, tell us and we will delete it.
12. Changes
We may update this policy. When a change matters, we will say so in the web app or the phone app, or by email. The date at the top identifies the current version.
13. Contact
Premsan Inc — 530-0001, 12-12, Osaka Ekimae Dai-2 Bldg., 1-2-2 Umeda, Kita-ku, Osaka-shi, Osaka, Japan. support@persql.com.