Company logo

Privacy Policy

Version 2.0 · Last updated November 3, 2026

ParadeDB, Inc. (“ParadeDB,” “we,” “us”) provides hosted databases, management interfaces, APIs, and related services (the “Services”). We also operate our public website, documentation, blog, and learning materials (the “Website”).

This Privacy Policy explains how we collect and use personal information about Website visitors, prospective customers, account holders, and people who contact us when we decide why and how that information is processed.

1. How this policy applies

We use information about your relationship with ParadeDB, such as your account email, organization membership, billing contact, and marketing preferences, to administer accounts and our business. ParadeDB is the data controller for the personal information described in this Privacy Policy.

When we handle personal information in customer databases, backups, or support materials on a customer's behalf, we act as a processor or service provider. We act as a subprocessor when our customer is itself a processor. That processing follows the customer's instructions, our Terms of Service (“Terms”), and Data Processing Addendum (“DPA”). Requests about that information should go to the customer. We assist as required by the DPA.

Our role depends on why we process information, not where it is stored. Customer data in a log, support ticket, or diagnostic record does not automatically become information we can use for our own business purposes.

“Customer Content” means the data and materials customers submit to the Services, including database contents and support materials, but not voluntary product feedback. “Customer Personal Data” means the personal data customers upload or provide as part of the Services that is governed by the DPA.

For example, an employee's email used to sign into our platform console is account information. An email stored in a customer's application table is customer database content. The same address can appear in both contexts, with different purposes and obligations. Customers' application users do not become ParadeDB account holders simply because their records are stored in a database on our platform.

Customers decide what their databases contain and how their applications use that data. This policy does not permit unrelated uses of customer database contents or override our Terms or DPA.

Installing open-source ParadeDB on your own infrastructure does not, by itself, send us the contents of your database. This notice covers interactions with our website and services and information you send us, including support materials. It does not describe how a third party operates its own deployment.

This policy does not cover employment, contractor, or recruitment records. We provide separate notices for those records where applicable.

2. Information we collect

Contact details and communications

We receive your name, work email, company, and messages when you contact sales, email us, or use support channels. We use them to respond, manage our relationship, provide support, and send communications permitted by law and your preferences. We may use Slack for support onboarding and communications. Information you or your organization share there may include contact details and support messages. Please send only the diagnostic information needed for support.

Where measurement is enabled, we may collect email delivery status, opens, and link clicks to understand engagement, troubleshoot delivery, and improve our messages. We use WorkOS for account and authentication communications. The information measured depends on the communication service and its enabled settings. Email measurements can be affected by your email provider's privacy features. You can disable remote images or use other controls in your email application.

We may receive information you provide through event registrations, referrals, or interactions with our social accounts, including contact details, professional information, and the content of those interactions. The information available from a social platform depends on its settings and what you share. We use it to respond, administer the interaction, and communicate according to your preferences and applicable law.

Community participation

When you join our community Slack, other members may see your profile and messages according to the channel and workspace settings. Public GitHub issues, discussions, contributions, and other public posts may be visible to anyone. Do not post credentials, private database contents, or personal information you do not want others to see. Slack Connect support channels are separate from our community Slack and are accessible to the people invited to them.

Report suspected security vulnerabilities privately to security@paradedb.com, following our Security Policy. Do not report vulnerabilities in public GitHub issues or community channels.

Accounts and organization access

We receive your email, identity-provider identifiers, organization memberships, invitations, session records, and account settings from you, your organization, and our authentication provider. We use this information to authenticate users, manage invitations and access, maintain sessions, and communicate about the service.

Invitations and information from your organization

An organization administrator or other authorized inviter may provide your email address before you create an account. We use it to deliver and administer the invitation and associate an accepted invitation with the relevant organization. An invitation alone does not grant access or mean you subscribed to marketing. Inviters should have authority to share the contact details they provide. If you received an invitation in error, contact us using Section 10.

Authentication providers

We use WorkOS for authentication. When you sign in, WorkOS and your identity provider give us the identity and organization information needed for access, including your email address, verification status, and provider identifiers. The provider's own notice and settings govern its processing. See WorkOS's Privacy Policy for details about its processing. Changing or revoking a provider connection does not by itself delete account records we already hold. Account information is stored separately from customer database contents. Sections 6 and 8 explain retention and deletion requests.

Our platform uses a session cookie for authenticated access. Essential authentication and security processing is separate from optional website analytics. You can block or remove cookies through your browser, but blocking necessary cookies may prevent sign-in.

Service configuration and operations

Using the Services generates cluster identifiers and names, region and resource selections, configuration history, connection and security events, and operational metrics. We use this information to provision and administer the service, measure usage, troubleshoot, maintain records, and protect the platform. Personal data processed on a customer's behalf remains subject to the DPA.

Billing and transactions

For purchases, we collect business billing contacts, invoices, subscription and order details, amounts, and payment status. We use these records to administer payments, manage accounting, and meet legal obligations. We use Stripe to process online payments. Stripe handles payment details directly and sends us billing, transaction, and payment-status information rather than full card numbers.

Website and device information

We collect IP addresses, approximate location derived from IP addresses, browser and device characteristics, page and referral information, timestamps, online identifiers, and information from cookies or similar technologies. We use it to operate the Website, remember preferences, understand usage, and assess communications, subject to your choices and applicable law. Analytics cookies follow the choices described in Section 3. Declining them does not stop all collection of usage information.

Command-line installer downloads

Our command-line installer downloads a shell script that you can run with a curl | bash command. When download measurement is enabled, we record a random identifier for the request, the requested software version or image tag, the download source, and limited information about the browser or command-line tool making the request, taken from its User-Agent header. This helps us measure installer downloads. It does not tell us what is stored in your database or report activity inside an installed database.

This measurement uses a server-side Google Analytics event and operates independently of browser analytics-cookie preferences. We skip the event when the request carries Sec-GPC: 1 or DNT: 1. These controls do not disable necessary server access or security logs.

Required information and preferences

Some information is necessary to authenticate you, establish organization access, administer a purchase, or answer a request. Without it, we may be unable to provide the corresponding service. Other information, such as optional feedback or a marketing subscription, can be withheld without preventing ordinary account use. We use marketing preferences to honor subscriptions and opt-outs.

3. Cookies, analytics, and advertising

On our main website, we use Google Analytics through Google Tag Manager to understand site usage. We may also use Google Ads to measure campaigns and show ads on other websites, including personalized ads to previous visitors or people with similar interests. These tools may collect browser and device identifiers, page visits, referral information, and interactions with our ads. When advertising features are enabled and you consent, we may share this information with Google for campaign measurement and personalized advertising. See Google's Privacy Policy.

We also use HubSpot Buyer Intent to identify companies visiting our Website and understand their interest in ParadeDB. Its tracking code may collect IP addresses, pages visited, and other online identifiers, and may use cookies to associate visits. We use the resulting company-level insights to inform sales and marketing. Depending on the enabled settings, HubSpot may also use tracking data to improve its services and commercial dataset. See HubSpot's Privacy Policy for details about its processing.

Your choices

We check for Global Privacy Control (GPC) and Do Not Track (DNT) before loading Google Tag Manager. If either is enabled, we do not load Tag Manager or its analytics and advertising tags, even if you previously accepted cookies. We do not send cookieless measurement through those tags or show a cookie banner in that case. Essential service processing remains available. Reload the page after changing a browser signal.

Otherwise, the main website's cookie banner lets you accept or decline analytics and advertising cookies. Advertising cookies and Google's use of data for advertising and ad personalization are enabled only after you accept. Analytics cookies are also disabled until accepted for visitors in the EEA (including Iceland, Liechtenstein, Norway) and the United Kingdom. Elsewhere, analytics cookies are enabled by default and can be declined. We save and apply your choice.

If you decline, analytics and advertising cookies are disabled. Google Tag Manager still loads and Google Consent Mode may send usage information without cookies. This cookieless measurement is not necessarily anonymous and may still involve personal information. It does not run through these tags when GPC or DNT is enabled.

You can change your choice using Cookie preferences below or in the main website's footer. You can also remove existing cookies through your browser. Changing your choice limits future collection but does not automatically delete information a provider has already received.

Documentation analytics

Our documentation is hosted on Mintlify's platform. We configure Google Tag Manager on the documentation to load Google Analytics and HubSpot. These tools may collect browser, device, and usage information and set analytics cookies.

Mintlify's platform manages cookies separately from our main website. Cookie choices and browser privacy signals applied on the main website do not currently carry over to the documentation. You can block or remove cookies through your browser settings. For questions about Mintlify's own processing, see its Privacy Policy. For tracking configured by ParadeDB, contact legal@paradedb.com.

4. How we use information

We use personal information for the purposes in Section 2, to protect the service and investigate abuse, comply with law, enforce agreements, and resolve disputes. We send product or marketing communications where permitted by law and your choices. You may unsubscribe using the instructions in a marketing message or contact legal@paradedb.com. We may still send necessary account, security, billing, and legal notices after a marketing opt-out.

As provided in the Terms and DPA, we will not sell Customer Content or use it for advertising. We will not use Customer Content to develop, train, or enhance artificial intelligence or machine learning models, including third-party models. This also covers Customer Content in support materials and operational records.

We may disclose service statistics only in aggregate form that identifies neither a customer nor any individual and reveals no Customer Content. Information that remains identifiable is treated as personal information, regardless of the label assigned to it.

5. When we share information

Depending on the interaction, we disclose personal information to providers supporting hosting, authentication, communications, analytics, customer relationships, security, and billing. These providers include AWS, WorkOS, Slack, Mintlify, and the analytics providers discussed above. See our Trust Center for our subprocessor list. Providers processing Customer Personal Data on customers' behalf are subject to the DPA's subprocessor provisions. A provider's inclusion in this notice does not mean it receives customer database contents.

We may disclose organization-account information to authorized administrators and other users as needed for organization administration and collaboration. We may also disclose information to professional advisers, authorities or other parties where legally required or reasonably necessary to protect rights and security, and parties to a business transaction subject to appropriate safeguards. We may disclose information with your direction or authorization.

When advertising features are enabled, we may also share information with advertising partners such as Google to measure campaigns and deliver personalized ads, subject to the choices described in Section 3. This does not include Customer Content. Disclosing online identifiers and website activity for personalized advertising may constitute “sharing” or a “sale” of personal information under some US state privacy laws, even when no money is exchanged. On our main website, you may opt out of this use through Cookie preferences or the browser signals described in Section 3. These controls do not apply to our documentation. For applicable opt-out requests, including requests about documentation tracking, contact legal@paradedb.com.

Customer Personal Data disclosures remain subject to the DPA and applicable transfer protections, including when a legal request is involved.

6. Retention and deletion

We retain personal information for the purposes described here, considering service needs, the nature and sensitivity of the data, security, legal and accounting requirements, and dispute resolution. We keep account and billing records while needed for the customer relationship, outstanding payments, accounting and legal duties, or legitimate business needs. Security records support incident investigation and protection of the service. Marketing preferences may be retained to honor an opt-out. We periodically review whether continued retention is necessary.

Customer Content, including backups and related support and operational records, follows the deletion schedule in the Terms and DPA. At a customer's request after termination, we will return or delete Customer Content in our possession or control, excluding backup copies, within 30 days of the request and delete backup copies within 60 days of the request, except where law requires retention. If you instruct us to delete an active cluster, both periods run from that instruction. We may delete sooner. These deadlines do not promise a recovery window, continued service access, or retention for a future return request. A return request does not restore a deleted cluster.

Deleting a cluster is different from closing an account. We may retain limited account, transaction, or security records for lawful purposes after an account closes. Retained Customer Personal Data continues to receive the protections in the DPA.

7. International processing

We operate from the United States and use providers in other locations. Choosing a database region determines where the active database and its service-managed backups are hosted under the Terms. Authentication, account, support, and operational information may be processed elsewhere.

Where international transfers require legal safeguards, we use approved mechanisms such as standard contractual clauses. Contact legal@paradedb.com to learn about the safeguards that apply, how to obtain information about them, and any applicable EU or UK representative. We do not claim certification under the Data Privacy Framework. Transfers of customer data under the DPA follow the mechanisms specified there.

Depending on your location and applicable law, you may have the right to:

  • Access, correct, or delete personal information, or receive a portable copy.
  • Object to processing or ask us to restrict it.
  • Withdraw consent for processing that relies on consent.
  • Appeal a decision about a privacy rights request where the law provides that right.

You may complain to your relevant supervisory authority. We will not unlawfully discriminate against you for exercising rights.

For processing covered by EEA or UK data-protection law, we rely on the following legal bases as applicable:

  • Contract: administering your individual account or purchase.
  • Legitimate interests: administering an organization's account, responding to business contacts, improving service operations, and protecting against fraud and security threats.
  • Legal obligations: keeping required accounting, tax, and legal records.
  • Consent: marketing or optional tracking where consent is required.

Where consent is the basis, you may withdraw it without affecting the lawfulness of earlier processing. Where legitimate interests are the basis, you may object as provided by applicable law. If you act for an organization, administering its contract does not by itself mean that you are personally a party to that contract. Swiss rights and requirements apply where relevant under Swiss law.

Send privacy rights requests, including any applicable opt-out request or appeal of a rights decision, to legal@paradedb.com. We may need to verify identity and any agent's authority. We respond within the period required by applicable law and explain any permitted extension or exception. Requests about a customer's database should go to that customer as described in Section 1.

US state laws may provide additional rights concerning sale, targeted advertising, sharing for cross-context behavioral advertising, or certain sensitive information. To exercise applicable opt-out rights or ask how browser privacy signals are handled, contact legal@paradedb.com. GPC and DNT handling and cookie choices are described in Section 3.

9. Security, children, and third-party services

We maintain measures designed to protect personal information, but no service can guarantee absolute security. Our contractual security measures are described in the Terms and DPA. This policy does not limit your statutory privacy rights or our obligations when a security incident occurs.

Our website and account services are intended for business and developer use, not children under 13. If we learn we collected a child's personal information through those services contrary to applicable law, we will take appropriate steps to delete it. Contact us if you have a concern. Data in a customer's own application remains subject to that customer's responsibilities and our DPA.

Third-party websites and services have their own privacy policies. A link to another service does not change our obligations for information we process.

10. Updates and contact details

We will update the version and last-updated date when we revise this policy. For material changes, we will give at least 30 days' advance notice by email or a prominent notice on our Website or service, as appropriate and required by law, unless an earlier change is legally required. A notice update does not amend an accepted customer agreement or expand Customer Personal Data processing rights under the DPA.

Send privacy questions and rights requests to legal@paradedb.com or by mail to:

ParadeDB, Inc.
2261 Market Street STE 80275
San Francisco, CA 94114
United States

For general support, contact support@paradedb.com. To report a security vulnerability, contact security@paradedb.com.