Privacy policy

This policy covers the information we use to manage Espobase accounts, subscriptions, service operations, security and communications. For these activities we decide why and how personal information is used and act as a controller, where that term applies.

Customers can also store information about their own users in Espobase databases, authentication, storage and APIs (“Customer Data”). For Customer Data we act on the customer’s instructions as a processor or service provider.

If your information is held in an app built by an Espobase customer, contact that app’s operator about its privacy practices and your rights. We help customers with such requests where the law or our agreement requires it.

Account and organization information

Your name, email address, password (stored only as a one-way hash), profile picture if you add one, organization details, membership roles and preferences. If you sign in with GitHub, Google or Apple, or through your organization’s single sign-on, we receive what that provider shares for sign-in, such as your name, verified email address and account identifier.

Billing information

Your plan, billing period, payment status and the identifiers of your customer and subscription records at our payment processor, Stripe. You enter card details on Stripe’s payment page and Stripe handles them; Espobase does not receive or store card numbers, security codes, or card brand and last digits.

Support and communications

Messages, attachments and feedback you send us by email or through the dashboard’s feedback form. Please don’t include passwords, private keys or unnecessary personal information.

Customer Data

The content customers manage through the Service: database records, uploaded files, edge functions (their code, secrets, and logs of what they print when they run), the accounts of customers’ own users (their email addresses, password hashes and session information) and other app data. Customers decide what they submit and how their apps use it.

Hosting, builds and GitHub

If you use Hosting, we store the files you publish for each site and a record of each deployment (when, by whom, how many files and bytes), the site’s name, address and settings, and the custom domain names you add with our DNS checks. The files of a live site are public: anyone who visits its address can read them, so don’t publish anything you want to keep private. A site’s previews (below) are public too, but hidden from search engines.

If you build a site from a Git repository, we also store the repository address, the branch, the commit and the build settings, your build variables (public values are shown in the dashboard; secret values are encrypted and never shown again) and each build’s log, where secret values are hidden. Your repository is cloned and built in an isolated environment that can reach the internet but not our systems, and is deleted when the build ends. Anything a build puts into your site’s files can be read by everyone who visits the site.

If you connect GitHub, you install the Espobase Hosting GitHub App on your GitHub account and choose which repositories it can reach. We store your GitHub account name, type and number, the installation and whether it covers all or selected repositories. We read only the repositories you choose, only to build them, with short-lived access tokens that we don’t keep. The sign-in token GitHub gives us while you connect is used once and isn’t stored. GitHub sends us notices about pushes and pull requests (the repository, branch, commit and pull request number), which we use to start builds. We write a commit status and one comment per pull request back to GitHub.

When someone visits a hosted site, our servers count requests and bytes for the project’s plan limits. We don’t keep a log of visits and don’t set cookies for visitors. Our servers’ technical error logs can include a visitor’s IP address and are rotated automatically. What a hosted site itself collects from its visitors is the customer’s responsibility.

Technical and usage information

• Sign-in sessions: the IP address and browser (user agent) of each dashboard session.
• Security and audit events: who did what and when (for example signing in, inviting a member, changing a key or a security rule), with the IP address of the request.
• API request logs for each project: time, method, path (without query strings), response status, duration, an error code, and whether the caller was anonymous, a signed-in user or a server. They never contain request or response bodies, query strings, passwords, keys, tokens, cookies, SQL text or AI prompts.
• Usage totals such as request counts, bandwidth, storage and AI actions, for plan limits and billing.
• Website statistics: when you visit our public website (espobase.com), we count page views with Umami, which we run on our own server; no other company receives this information. For each page view it records the page address and title (without query strings), the referring website, your browser, operating system, device type, screen size and language, and the country, region and city derived from your IP address. It sets no cookies, stores nothing in your browser and doesn’t keep your IP address. Page views are grouped into visits with an anonymous identifier that changes every month. Nothing is recorded if your browser sends a “Do Not Track” signal, and the dashboard isn’t measured.

AI features

When you use the AI builder, we process your request and the database structure it needs: table and column names, column types, keys and relationships, and the names of security rules. The AI provider never receives the rows stored in your tables. When you ask the AI to explain a query or an error, we send the SQL and the error message you provide, which can contain values you typed. Your requests, the AI’s answers and the proposed changes are stored with the project.

If you connect an AI assistant (such as ChatGPT or Claude) to Espobase, it acts on your instructions and can receive what you ask it to read, including the results of read-only queries, which can contain rows from your tables. That assistant’s provider handles this information under its own terms.

• Create and authenticate accounts, and manage projects and organization access.
• Provide databases, app authentication, storage, APIs, hosting, builds and the other features you use.
• Manage subscriptions, payments and plan limits.
• Answer support requests and fix problems.
• Detect abuse, fraud, unauthorized access and service failures.
• Measure reliability and improve the Service.
• Send verification, password reset, invitation, billing, usage-limit and security emails.
• Send product news, only if you opted in.
• Meet legal obligations and establish, exercise or defend legal claims.

We send product-news emails only if you opt in (an unticked box at sign-up, or Settings). You can opt out anytime in Settings or with the unsubscribe link in every such email. We record when you opted in or out.

Where European or similar data protection laws apply, our legal basis depends on the activity: performing a contract, complying with legal obligations, our legitimate interest in protecting and operating the Service, or consent where required. You may withdraw consent at any time; this doesn’t affect processing that took place before.

Our AI features use OpenAI’s API. When you ask for AI help, the information that request needs (Section 2) is sent to OpenAI.

In our OpenAI account, sharing our API inputs and outputs with OpenAI, including for training its models, is turned off, and so is OpenAI’s storage of our API calls. Under OpenAI’s API terms, OpenAI may keep API requests for a limited time to detect abuse, and then deletes them. Espobase does not use Customer Data, AI requests or AI answers to train AI models.

The AI builder runs only when you ask it to. It proposes changes and never applies them by itself: you review the SQL and apply it. Don’t submit credentials or unnecessary sensitive information in AI requests, and only submit information about others that you’re allowed to share.

We don’t sell your personal information, and we don’t share it for advertising. We share it only:

• To provide the Service: with the providers below, for hosting, storage, networking, payments, email and AI features.
• Within your organization: with its members and administrators, according to their roles.
• On your instructions: through integrations, public endpoints, connected AI assistants or sharing settings you choose.
• To comply with the law and protect rights: in response to valid legal demands, to handle abuse or security incidents, or to protect people, property and legal rights.
• In a business transaction: such as a merger, acquisition or transfer of the Service, under confidentiality and privacy obligations.
• With your permission.

We give providers only what their service needs, under contractual protections.

• Your account: while it’s active. You can delete it in Settings (delete your projects first); it’s removed right away, except the records below that we must keep.
• Customer Data: until the customer deletes it. Deleting a project removes its database, files and API keys right away.
• Backups: projects are backed up daily. Backups are kept 1 day (Free), 7 days (Pro) or 14 days (Group) and are locked against deletion for 7 days. When a project is deleted, a final backup is kept for 30 days in case the deletion was a mistake, then deleted. Backups are encrypted and used only to recover from failures or mistaken deletions.
• API request logs: 1 day (Free), 7 days (Pro), 28 days (Group). Usage totals, which contain no personal information, are kept longer for billing and plan limits.
• Edge function logs: 1 day (Free), 7 days (Pro), 28 days (Group). These logs hold what a customer’s function printed or the errors it raised on each run, with the time, status and duration; their content comes from the customer’s own code.
• Automation run logs: 1 day (Free), 7 days (Pro), 28 days (Group). One entry per scheduled job run or database webhook delivery, with the time, result, HTTP status and an error code; never the data that was sent. A webhook event is held only until it is delivered or its last retry fails (about 11 minutes), then deleted.
• Hosted sites: until you delete the site or a deployment. Older deployments are removed automatically (a site keeps its newest 10; a pull request preview keeps its newest 3 and is deleted when the pull request is closed). Deleting a project deletes its sites.
• Builds: a site keeps its newest 30 builds with their logs, until you delete the site. Cloned repositories are deleted when each build ends.
• GitHub connection: until you disconnect it in the dashboard or uninstall the app on GitHub. Notices from GitHub are remembered by their delivery number for about 7 days, to handle each one once.
• Website statistics: 24 months.
• Security and audit events: 1 year.
• AI requests and answers: with the project, until it’s deleted.
• Billing records: 5 years.
• Support messages and feedback: 2 years.

Information under a legal hold may be kept longer. Deleting a project doesn’t delete separate billing, support or security records. Export anything you need before deleting a project or your account.

We use technical and organizational measures to protect personal information, including:

• Encryption in transit (HTTPS) for the website, dashboard and APIs.
• Passwords stored only as one-way hashes (Argon2id), for dashboard accounts and for customers’ app users.
• API keys and access tokens stored only as keyed hashes; database passwords and other secrets encrypted (AES-256-GCM).
• Backups encrypted before they leave our server (AES-256-GCM) and verified after every upload.
• Row-level security turned on by default for every new table, and project databases isolated from each other.
• Role-based access for organization members, and an audit trail of security-sensitive actions.

No service can guarantee absolute security. Protect your credentials and project secrets and review who has access. Customers are responsible for configuring their apps, security rules and sharing settings.

You can update your profile in Settings and delete your account there. Depending on where you live, you may have the right to access, correct, delete or receive a copy of your information, to restrict or object to certain processing, to withdraw consent, and to appeal a decision about your request.

Send requests to support@espobase.com. We may ask for information to verify your identity and authority, and we respond within the time limits the law sets. Authorized agents may make requests where the law allows, subject to verification. You may also complain to your local data protection authority. We won’t discriminate against you for exercising your privacy rights.

If your request is about information an Espobase customer stores in its app, contact that customer first.

We use only what the Service needs to work:

• A sign-in cookie that keeps you signed in to the dashboard for up to 7 days, and a short-lived cookie during GitHub, Google, Apple or single sign-on.
• A cookie that remembers the language you choose, for one year.
• Browser storage for your dashboard preferences (such as the theme) and open SQL editor tabs.

We don’t use advertising or tracking cookies, and our website statistics use no cookies or browser storage. You can manage cookies and storage in your browser’s settings; blocking the sign-in cookie prevents signing in.

The dashboard, APIs and project databases run on servers in the United States (Boston). Uploaded files and backups are stored with Cloudflare R2 in western North America; backups are encrypted before they leave our server. Our other providers process information in the locations described in their own privacy terms.

Where the law requires protections for an international transfer, we use legally recognized safeguards appropriate to that transfer. Contact us for details.

Espobase is intended for people aged 18 or older, as stated in our Terms and conditions. We don’t knowingly collect children’s personal information through account registration. If you believe a child has given us personal information, contact us and we’ll take appropriate action.

Apps built by customers may serve other audiences; those customers are responsible for their own privacy notices and any required parental consent. Third-party websites, sign-in providers, AI assistants and integrations have their own privacy policies.

MatterOne LLC · 9257 Culebra Rd Ste 101 PMB 1062, San Antonio, TX 78251, United States · support@espobase.com