Privacy Policy

1Who we are

SQL Sage is an independent product of LUMA sp. z o.o. (trading as LumaSoft), a limited liability company registered in Poland: ul. Gawronia 15, 04-785 Warszawa, Poland; KRS 0001244636, NIP PL9522285489, REGON 544875680 ("we", "us", "the vendor"). We are the data controller for the limited personal data described in this policy.

SQL Sage is not affiliated with Microsoft, Anthropic, or OpenAI.

You can reach us on any privacy or data-protection matter, including a request about your own data, at privacy@lumasoft.pl. For anything else — installation, licences, refunds — write to support@lumasoft.pl.

We have not appointed a data protection officer. None of the conditions in Art. 37(1) GDPR applies to us: we are not a public authority or body; our core activities do not consist of processing that requires regular and systematic monitoring of data subjects on a large scale (the extension contains no telemetry or analytics, and licence validation transmits only an opaque licence identifier, so there is nothing to monitor); and we do not process special categories of data, or data relating to criminal convictions and offences, on a large scale. The mailbox above is the contact point for all data-protection matters.

2Scope of this policy

This policy covers the SQL Sage extension installed on your Windows machine, our public website, and the limited backend services we operate for licensing and updates. It does not cover the AI provider you connect to (Anthropic or OpenAI), your SQL Server, or Paddle as our Merchant of Record — see the relevant sections below for how those relationships work.

3What data is involved

SQL Sage is architected to minimise the personal data that reaches us. The categories of data involved are:

4Data sent to the AI provider

When you use the chat, query help, or safe-execution features, the extension sends the following to your chosen AI provider (Anthropic or OpenAI) as context: your query text and database schema metadata — the names of tables, columns, and indexes.

Query result data (production data) is never sent unless you explicitly opt in for that session. A "Mask names" option replaces server and database identifiers with placeholders before anything leaves your machine.

The extension makes this explicit at the point of use: a persistent egress indicator in the chat context bar shows where content is going (the named provider for a keyless sign-in, or "your endpoint" for BYOK), and an (i) "What's sent" panel lists exactly the following — the same guarantees this section describes:

Sent to the AI provider:

• Database schema — table, column, index and constraint names and types (metadata, not row data).
• The SQL you're working on — the active query window's text and/or your editor selection, when attached.
• Your chat messages, and any file you explicitly attach as context.
• Server and database names — unless "Mask names" is on, in which case they are replaced with generic placeholders before egress.

Not sent (stays on your machine):

• Query results — your actual row data. Nothing is sent unless you turn on "Include results" and confirm a one-time per-session prompt; even then, cell values are not masked, so you send them deliberately.
• Your login credentials and connection password.
• Your BYOK API key, license key, and AI-provider sign-in tokens (see the next section).
• The local audit log of executed and blocked database operations — written under %LOCALAPPDATA%\SqlSage and never uploaded.

What the provider then does with the query text and schema it receives is governed by your relationship with that provider (their terms and privacy policy), including any model-training and data-retention settings on your account — matters we do not control and do not represent on their behalf.

Crucially, at launch the AI provider processes this data under your own account, subscription, or BYOK key. That means your direct relationship with Anthropic or OpenAI — their terms and privacy policy — governs how that data is handled. We are not an intermediary for AI inference and we do not resell access to AI models. We recommend you review your AI provider's privacy terms:

• Anthropic (Claude): anthropic.com/legal/privacy
• OpenAI (ChatGPT / API): openai.com/policies/privacy-policy

5Local, encrypted secrets

Two kinds of secret are stored only on your machine, encrypted at rest via the Windows Data Protection API (DPAPI), scoped to your Windows user account:

• Your BYOK API key (if you choose to provide one).
• Your SQL Sage license key.

These are never transmitted to us and never stored in plaintext, in the Windows registry, or in version control. Your AI provider sign-in tokens (for Claude Code or Codex) are managed entirely by those CLIs — SQL Sage only asks whether you are signed in; it never sees, stores, or transmits those credentials.

6Licensing & update checks

Trial. SQL Sage offers a 30-day free trial with no credit card required. The trial is tracked locally on your machine.

License validation. To confirm a paid license is active, the extension makes a periodic HTTPS request to our validation service (a Cloudflare Worker). This request sends only a license identifier — no personal data, no query content, no schema, no results.

Auto-update. To check for a new version, the extension makes a single anonymous HTTPS request to a static version file. Nothing about you, your machine, your database schema, or your queries is transmitted. As with any HTTPS request, our hosting provider's server logs may record standard connection metadata (such as IP address) transiently.

7Payments & billing

Purchases are processed by Paddle, acting as Merchant of Record (MoR). Paddle is the seller of record: it collects and processes your billing information (name, email, payment method, and tax/location data), handles VAT/GST/sales tax, issues invoices, and manages chargebacks and refunds. Paddle also serves the checkout overlay in your browser when you use a buy button, and your purchase is subject to Paddle's own checkout terms.

What reaches us. We do not receive or store your payment card details. From the payment notification we receive and store the email address you used at checkout (together with a SHA-256 hashed index of it, used for lookups) and the Paddle transaction and subscription identifiers, alongside the licence record itself — that is what lets us issue your key, tie a renewal or cancellation to it, and re-send it if you lose it.

Delivery. The key is issued as soon as the payment notification is verified and is retrievable from our licensing service using the transaction identifier Paddle gives you at checkout. If you lose it, a resend endpoint re-sends the keys held for an address you enter; the response is deliberately identical whether or not we hold anything for that address, and the endpoint is rate-limited per address and IP address, using counters keyed by a hash that expire automatically. Where email delivery is enabled, the key is sent from our own Microsoft 365 mailbox on the lumasoft.pl domain; we do not hand your address to a bulk-email or marketing platform, and we never use it to market to you.

For payment-data privacy requests, Paddle acts as controller of that billing data; we will help route your request to them. See our Sub-processors page.

8Legal bases (GDPR)

Where the EU General Data Protection Regulation (GDPR) applies, we rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b)) — license validation and delivering the product you purchased.
• Legitimate interests (Art. 6(1)(f)) — securing our services, preventing abuse, and providing update checks.
• Consent (Art. 6(1)(a)) — where you opt in, e.g. subscribing to our newsletter or opting in to send query results to the AI provider for a session. You may withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)) — tax and accounting duties, met primarily through Paddle as Merchant of Record.

9Sub-processors

We use a small number of sub-processors to operate the service: Cloudflare (static hosting, the licence-fulfilment Worker and its key-value store, and installer storage), Paddle (Merchant of Record for payments), Google (Google Analytics 4 on the website only, in Consent Mode v2 — see section 15) and Microsoft (Microsoft 365, which hosts the mailboxes the licence-key email is sent from and our correspondence is kept in). Paddle is our only payment channel; a second, unfinished Merchant of Record integration exists in our licensing service but is inactive and closed by default, so no data reaches that provider — the Sub-processors page explains this. At launch, Anthropic and OpenAI are your providers (via your own account or BYOK), not our sub-processors. The full, current list — with roles and locations — is maintained on our Sub-processors page.

10Retention

• License records (licence identifier and status, the signed key, the checkout email address and its hashed index, and the Paddle transaction/subscription identifiers) are retained for as long as the licence is active and for a reasonable period afterward to support renewals, transfers, and fraud prevention.
• Local data (BYOK key, license key, trial state, chat history) lives only on your machine and is removed when you uninstall or delete it.
• Billing records are retained by Paddle as Merchant of Record per its policy and applicable tax law.
• Support and newsletter data are kept until you ask us to delete them or unsubscribe.

11International transfers

Our infrastructure providers operate globally. Where personal data is transferred outside the European Economic Area, such transfers are covered by appropriate safeguards (for example, the European Commission's Standard Contractual Clauses) implemented by the relevant provider. Any data you send to your AI provider is transferred under your own agreement with that provider.

12Your rights

Under the GDPR you have the right to: access your personal data; request rectification or erasure; restrict or object to processing; data portability; and to withdraw consent where processing is based on consent. You also have the right to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO).

To exercise any of these, write to privacy@lumasoft.pl. For requests about payment and billing data, Paddle is the controller of that data as Merchant of Record; tell us and we will point you to the right place.

13Security

We follow a data-minimisation and least-custody approach: secrets stay on your machine encrypted via DPAPI, our license service transmits only opaque identifiers over HTTPS, and we never take custody of your AI provider tokens. No method of transmission or storage is perfectly secure, but we design the product so that there is very little sensitive data on our side to protect in the first place.

14Children

SQL Sage is a professional developer tool and is not directed at children. We do not knowingly collect personal data from anyone under the age of 16.

15Website analytics & cookies

On our public website we use Google Analytics in Consent Mode v2. Before you accept, the Google tag is loaded but stores no cookies or identifiers — only anonymous, cookieless measurement is sent. Cookies and full analytics are enabled only after you click "Accept" in the consent banner. If you click "Reject", no analytics cookies are set. You can change your choice at any time by clearing this site's storage in your browser. This applies to the website only; the SQL Sage extension itself contains no analytics or tracking. Google is therefore a sub-processor for website measurement and is listed as such on our Sub-processors page.

16Changes to this policy

We may update this policy as the product evolves — notably before any hosted/keyless AI feature ships (see section 4). When we make material changes, we will update the "Last updated" date and, where appropriate, notify you.

17Contact

LUMA sp. z o.o.
ul. Gawronia 15, 04-785 Warszawa, Poland
KRS 0001244636 · NIP PL9522285489 · REGON 544875680
Data protection and privacy: privacy@lumasoft.pl
Everything else: support@lumasoft.pl