This page describes how Datarelix handles personal information on the public sites
(datarelix.ai, docs.datarelix.ai) and in the hosted product at
app.datarelix.ai.
What we collect
- Account data: name, email address, and sign-in method (Google, Microsoft, or email and password) when you sign in.
- Connection metadata: the host, port, dialect, and schema scope of databases you connect. Passwords and refresh tokens are encrypted at rest.
- Run data: the question you ask, the plan the LLM produced, the SQL/KQL we executed, and the resulting artifacts. This is stored so you can review past runs.
- Product analytics: page views, feature usage, and (in the app) masked session replays — see “Cookies & analytics” below. No row contents.
Cookies & analytics
We use Google Analytics 4 (Google LLC) to count page views and see which pages are used, and Microsoft Clarity (Microsoft Corporation) to understand how pages are used, including session replays and heatmaps. In the app, session replays run with strict masking: page content and inputs are masked before they leave your browser.
If you visit from the EEA, the UK, or Switzerland, a consent banner asks before any analytics cookies are set (until then, only cookieless, aggregate measurement runs); elsewhere analytics runs by default. You only choose once: the choice is stored in a browser cookie that applies across datarelix.ai and its subdomains (docs, app), and can be changed at any time via “Cookie preferences” in the site footer or the app's Settings → Data controls.
- Essential: required for the site to work, including saving your consent choice. Always on.
- Preferences (
drx_lang,drx_currency): strictly necessary cookies that keep choices you make explicitly — display language and display currency — for 12 months. They are set only when you pick a language or a currency, never on page load. - Product analytics & improvement: Google Analytics and Microsoft Clarity, as described above.
- Marketing & advertising: with this consent, usage data may be shared with advertising platforms (such as Microsoft Advertising) for campaign measurement and audience building.
When you are signed in and have accepted product analytics, we attach your account identifier — a random ID, never your name or email address — to this measurement, so that visits on your phone and your laptop count as one person rather than two. If you decline product analytics, or withdraw it later, the identifier is not sent and Clarity is not given it either.
Analytics events are also copied into our own Google Cloud project in the EU, so we can analyse them ourselves instead of only through Google's reports. When a subscription starts, renews, changes, or is cancelled, our servers send Google Analytics the plan, the amount, and the currency. Card details are handled by Stripe and never reach us or any analytics service.
What we do not collect
We do not copy the contents of your tables to our infrastructure. Queries execute against your database; only the result set you specifically ask about is fetched, stored as part of the run trace, and surfaced in the UI.
Google user data
Datarelix uses Google APIs in two separate places. Each asks for its own consent, and one does not imply the other.
- Signing in with Google: we request your name, email address, and basic profile (
openid,profile,email) to create and identify your account. Signing in grants no access to any other Google data. - Connecting BigQuery: if you add BigQuery as a data source and authorize it with your Google account, we request the
https://www.googleapis.com/auth/bigqueryscope. We use it to list the datasets you choose to expose and to run the read queries behind your questions.
Why that scope and not a read-only one. BigQuery runs every query as a job, including a plain SELECT. The BigQuery v2 API accepts only three scopes that can do that: bigquery, cloud-platform, and cloud-platform.read-only. The legacy bigquery.readonly scope is accepted by no BigQuery v2 method at all. Of the three, bigquery is the only one confined to BigQuery — the other two reach across your whole Google Cloud account. We take the smallest reach and enforce read-only ourselves: each generated statement is parsed into a full syntax tree and rejected if it is not a read, and queries are restricted to the datasets you select. If you would rather Google enforced it too, connect with a service account holding BigQuery Data Viewer and BigQuery Job User and no write roles.
How the grant is stored. Authorizing BigQuery returns a refresh token. It is encrypted at rest and attached to that one connection; the connection record holds only a reference to it. It is used to obtain short-lived access tokens when a query runs. Connection credentials are never placed in the AI model's context: they are decrypted at execution time only, by an isolated query service.
How we protect it. Traffic to and from Google's APIs runs over TLS. The refresh token is encrypted at rest and kept apart from the connection record, which stores only a reference to it; it is decrypted only at execution time, inside an isolated query service, and credential values are redacted from log output. Connections, dashboards, and runs are strictly scoped to the account that owns them — there is no cross-account access. Deleting the connection deletes the token.
What reaches the AI model. The model receives your question and the structure of the datasets you selected — table and column names and types — not the contents of your tables. One exception is deliberate: a single-row answer value can be carried into the context of follow-up questions, so that asking “and versus last year?” makes sense.
Deleting and revoking are two separate steps. Deleting a BigQuery connection deletes the refresh token we hold for it, and deleting your account deletes your connections along with their stored tokens. Neither of those revokes the permission at Google.
Withdrawing Datarelix's access to your Google account is a step only you can take, on Google's permissions page. Until you do, Datarelix stays listed there even though we no longer hold a token for it. We recommend removing it whenever you disconnect BigQuery for good. Revoking automatically when you delete a connection is on our roadmap; this page will be updated when it ships. To delete your account and everything attached to it, see “Your rights” below.
Limited Use. Datarelix's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, we do not use it for advertising, and we do not use it to train or improve generalized AI or machine-learning models. Human access is limited to what you ask us for in support, what is needed to investigate a security incident or abuse, and what the law requires.
Sharing
We share necessary data with our LLM provider (currently OpenAI; the platform also supports Anthropic) to generate plans, and the service runs on cloud infrastructure that processes data on our behalf. Google and Microsoft act as analytics processors for the usage data described under “Cookies & analytics”. We do not sell your data. We do not share it with advertising platforms unless you enable “Marketing & advertising” — with that consent, usage data may be shared with advertising services (such as Microsoft Advertising) for campaign measurement and audiences, and you can withdraw it at any time via “Cookie preferences”. Beyond those processors, we do not share your data with third parties. See the security page for what gets sent to the LLM and what does not.
Your rights
Email support@datarelix.ai from the address on your account to ask for a copy of your account data, a correction, or deletion of your account and its data. There is no self-serve export or delete button in the product yet. We will acknowledge your request and complete it within 30 days. If you have a paid subscription, cancel it in Settings → Billing first, or ask us to cancel it in the same email (see Terms).
Changes
If we change this policy materially, we will email registered users.