Privacy Policy

1Who we are

SqlSage for DBeaver is an independent product of LUMA sp. z o.o. (trading as LumaSoft), a limited liability company registered in Poland: ul. Gawronia 15, 04-785 Warszawa, Poland; KRS 0001244636, NIP PL9522285489, REGON 544875680 ("we", "us", "the vendor"). We are the data controller for the limited personal data described in this policy.

SqlSage is not affiliated with, endorsed by or sponsored by DBeaver Corp, Anthropic or OpenAI.

You can reach us on any privacy or data-protection matter, including a request about your own data, at privacy@lumasoft.pl. For anything else — installation, licences, refunds — write to support@lumasoft.pl.

We have not appointed a data protection officer. None of the conditions in Art. 37(1) GDPR applies to us: we are not a public authority or body; our core activities do not consist of processing that requires regular and systematic monitoring of data subjects on a large scale (the plugin contains no telemetry or analytics, and licence verification is offline, so there is nothing to monitor); and we do not process special categories of data, or data relating to criminal convictions and offences, on a large scale. The mailbox above is the contact point for all data-protection matters.

2Scope of this policy

This policy covers three things: the SqlSage plugin installed into your own DBeaver, this website (sqlsagedbeaver.lumasoft.pl, including the p2 update site), and the small licensing backend we operate at api-dbeaver.lumasoft.pl.

It does not cover: the AI provider you sign in to (Anthropic or OpenAI) and their command-line tools, which you install and use under your own agreement with them; DBeaver itself, which is a separate product of DBeaver Corp; your databases; or the payments provider that sells the product to you. Each of those relationships is described below so you can see where the boundary sits.

3What data is involved

The plugin is architected so that almost nothing reaches us. The categories of data involved are:

4What is sent to the AI provider

SqlSage does not hold an AI subscription for you and does not resell access to AI models. Instead it starts the Claude Code (claude) or OpenAI Codex (codex) command-line tool that you installed and signed in to, and talks to it as a local subprocess. Everything the model sees therefore travels to Anthropic or OpenAI through your tool, on your account, under your agreement with that provider.

What the plugin puts into a prompt is:

• Your SQL and your questions, and the SQL text or editor selection you act on.
• Schema metadata from the connection you are working on — table and view names, column names and types, primary and foreign keys, indexes, object definitions the engine itself reports, and the SQL dialect.
• Error text from your last failed statement, when you ask it to explain an error.

Query result values are withheld by default. When the assistant runs a read-only query, the rows are redacted before the result goes back to the model unless you have explicitly switched on the opt-in — the "Send query result values to the model" checkbox in Window → Preferences → SqlSage, or the /share on chat command. Be aware that this switch is a preference, not a one-off: once you turn it on it stays on, across chats and across restarts, until you turn it off with /share off or the same checkbox.

Because the request is carried by your provider's own tool, that provider's terms and privacy policy govern how the data is handled, including any retention, abuse monitoring or telemetry the tool performs on its own account. We recommend you read them:

• Anthropic (Claude / Claude Code): anthropic.com/legal/privacy
• OpenAI (Codex / ChatGPT): openai.com/policies/privacy-policy

5What stays on your machine

The plugin writes several things locally, and none of them are transmitted to us:

All of it is removed when you delete those folders and uninstall the plugin. We have no copy and no way to retrieve any of it.

6Licence, trial & update check

Trial. The plugin grants a 30-day Pro trial on first run, with no sign-up and no card. The trial clock is a timestamp in your local preference store. Nothing is sent to us when it starts, runs or ends; when it ends the plugin continues to work on the Free tier.

Licence verification is offline. A purchased licence key is a token signed with our Ed25519 key; the plugin verifies that signature against a public key compiled into it. There is no licence call-home — no periodic validation request, no licence identifier sent to us, no device fingerprint, no activation count.

Update check. Once per DBeaver session, a background job makes a single HTTPS GET for /updatesite/content.jar on our update site — a public file listing the current version — and compares it with the version you have installed. It sends a plain SqlSage-UpdateChecker user agent and nothing else: no identifier, no licence, no schema, no queries, no telemetry. You can switch it off in Preferences. As with any HTTPS request, our hosting provider's logs may record standard connection metadata such as your IP address.

7Purchase & licence delivery

Payment. Purchases are sold and processed by Paddle acting as Merchant of Record. Paddle is the seller of record for your transaction: it collects and controls your billing information (name, email, payment method, tax and location data), handles VAT and sales tax, issues the invoice, and manages chargebacks and refunds. We never receive or store your card details.

Licence issuance. When a payment completes, Paddle sends a signed notification to our licensing backend — a Cloudflare Worker at api-dbeaver.lumasoft.pl. The Worker signs a licence key for you and stores a record in a Cloudflare key-value namespace containing: a generated licence identifier, the licence type and tier, its expiry (for subscriptions), the signed key itself, the Paddle transaction and subscription identifiers, a timestamp, and the email address you used at checkout. It also keeps a lookup index of that address as a SHA-256 hash rather than in the clear, and short-lived markers so a retried notification cannot issue a duplicate licence.

Delivery. The key is issued the moment the payment notification is verified and is retrievable from our licensing service using the transaction identifier Paddle gives you at checkout (/license/retrieve). If you lose it, the /license/resend endpoint will re-send the keys held for an address you enter; the response is deliberately identical whether or not we hold anything for that address, and the endpoint is rate-limited per address and IP address to blunt abuse. The counters used for that rate limit are keyed by a hash and expire automatically. Where email delivery is enabled, the key is sent from our own Microsoft 365 mailbox on the lumasoft.pl domain; we do not hand your address to a bulk-email or marketing platform, and we never use it to market to you. If your key does not reach you, write to support@lumasoft.pl and we will send it.

We do not operate user accounts, and there is no password to create: the purchase email is the proof of ownership.

8The optional local agent bridge

SqlSage can expose the connection you are working on to your own external AI agent (for example Claude Code, Codex CLI, Cursor or Claude Desktop) over a small server bound to 127.0.0.1 on your machine, guarded by a 256-bit bearer token stored encrypted in Eclipse Secure Storage. It is off by default and you switch it on in the panel.

While it is on: external agents are restricted to read-only statements, writes and schema changes are refused outright, row values are withheld, the global kill switch still applies, and every classification is written to the same local audit log. Your database credentials never leave DBeaver.

9Website: analytics, cookies, checkout

Analytics. This website uses Google Analytics 4 in Consent Mode v2. Before you make a choice, every consent signal is set to denied: no analytics or advertising cookies or identifiers are stored on your device, and only anonymous, cookieless measurement is sent. Cookies and full analytics are enabled only after you click "Accept" in the banner; if you click "Reject", nothing further is stored. Your choice is remembered in your browser's local storage under the key sqlsage-consent — clear this site's storage to be asked again. Advertising features are not used, ad-data redaction and URL passthrough are enabled.

Checkout. The Paddle checkout script is loaded from Paddle's CDN only when you interact with a buy button (hover, focus or click) — not on page load. If you never touch a buy button, your browser never contacts Paddle from this site. Once the overlay opens, what you enter goes to Paddle as Merchant of Record.

Install counter. Clicking the "Copy" button next to the update-site URL fires a single, fire-and-forget request to a counter we run at api.lumasoft.pl that increments a tally of install attempts for this product. It carries no identifier, no cookie and no payload beyond the product name; standard connection metadata may appear in our hosting provider's logs.

The plugin itself contains no analytics, cookies or tracking of any kind. This section is about the website only.

10Legal bases (GDPR)

Where the EU General Data Protection Regulation applies, we rely on:

• Performance of a contract (Art. 6(1)(b)) — issuing, delivering and re-sending your licence key, and supporting the product you bought.
• Legitimate interests (Art. 6(1)(f)) — keeping the licensing service secure, preventing licence fraud and abuse of the resend endpoint, and serving the version file that powers the update check.
• Consent (Art. 6(1)(a)) — website analytics cookies, and your opt-in to send query result values to your AI provider. You can withdraw either at any time, with no effect on the rest of the product.
• Legal obligation (Art. 6(1)(c)) — tax and accounting duties, discharged primarily by Paddle as Merchant of Record.

11Sub-processors

We use a small number of providers to run the service: Cloudflare (this website, the p2 update site, the licensing Worker and its key-value store), Paddle (Merchant of Record), Google (website analytics only) and Microsoft (our own Microsoft 365 mailboxes, used for licence-key delivery and support correspondence). The current list, with roles, data and locations, is on our Sub-processors page.

Personal data these providers handle for us is processed on that provider's own data processing terms, which form part of the service agreement we accept with each of them.

Anthropic and OpenAI are not our sub-processors. They are your providers, reached through the CLI you installed and the account you signed in to, and nothing about that traffic passes through us. Likewise DBeaver Corp is the vendor of the host application, not a processor acting for us.

12Retention

• Licence records (licence identifier and key, type, tier, expiry, Paddle identifiers, purchase email, hashed-email index) are kept in our key-value store for as long as the licence is in force, and afterwards for as long as we need them to support it, re-send keys, honour renewals, handle refunds and chargebacks, prevent licence fraud and meet our accounting and tax obligations. To be precise rather than reassuring: no automatic expiry is configured on these records, so they persist until deleted — a perpetual licence record is expected to persist indefinitely, because it is the only proof of an entitlement that never ends. You can ask us to erase your record at any time (see section 14); the consequence is that we can no longer re-send your key or confirm your entitlement.
• Idempotency markers and rate-limit counters expire automatically — 60 days and roughly an hour respectively.
• Local data (licence key, trial state, chat transcript, audit log, settings) lives only on your machine, for as long as you keep it.
• Billing records are kept by Paddle under its own policy and applicable tax law.
• Support correspondence is kept until you ask us to delete it.
• Server logs at our hosting provider are kept for that provider's standard period.

13International transfers

Our infrastructure providers operate globally, so personal data may be processed outside the European Economic Area. Where that happens, the transfer is covered by the safeguards the relevant provider implements — for example the European Commission's Standard Contractual Clauses. Anything you send to your own AI provider is transferred under your own agreement with them, not ours.

14Your rights

Under the GDPR you have the right to access your personal data, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent where processing rests on consent. You also have the right to complain to a supervisory authority — in Poland the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), or the authority where you live.

To exercise any of these, write to privacy@lumasoft.pl. For a request about your billing data, Paddle is the controller of that data as Merchant of Record; tell us and we will point you to the right place. Note that erasing your licence record means we can no longer re-send your key or verify your entitlement.

15Security

Our approach is to hold as little as possible. Prompts and query results never reach our servers. We never take custody of your AI provider credentials, and the CLI we launch is given a filtered environment that excludes API-key and token variables. Licence keys are signed with a private key that lives only in our licensing Worker as a secret, never in the product or the repository, and never in the key-value store. Webhook notifications are signature-verified over their exact bytes with a replay window before we act on them. The database work the assistant does passes through a single classifier chokepoint: only statements provable as reads run automatically, on a separate session with a row limit, and anything else stops for your explicit confirmation.

No method of transmission or storage is perfectly secure. We design the product so that there is very little sensitive data on our side to protect in the first place.

16Children

SqlSage is a professional developer tool and is not directed at children. We do not knowingly collect personal data from anyone under 16.

17Changes to this policy

We may update this policy as the product changes — and we will update it before any feature ships that would send your prompts through infrastructure we operate, or that would add a provider to the list in section 11. Material changes are reflected in the "Last updated" date and, where appropriate, notified to customers.

18Contact

LUMA sp. z o.o.
ul. Gawronia 15, 04-785 Warszawa, Poland
KRS 0001244636 · NIP PL9522285489 · REGON 544875680
Data protection and privacy: privacy@lumasoft.pl
Everything else: support@lumasoft.pl