Privacy Policy

1Who we are

SqlSage for DBeaver is an independent product of LUMA sp. z o.o. (trading as LumaSoft), a limited liability company registered in Poland: ul. Gawronia 15, 04-785 Warszawa, Poland; KRS 0001244636, NIP PL9522285489, REGON 544875680 ("we", "us", "the vendor"). We are the data controller for the limited personal data described in this policy.

SqlSage is not affiliated with, endorsed by or sponsored by DBeaver Corp, Anthropic or OpenAI.

You can reach us on any privacy or data-protection matter, including a request about your own data, at [email protected]. For anything else — installation, licences, refunds — write to [email protected].

We have not appointed a data protection officer. None of the conditions in Art. 37(1) GDPR applies to us: we are not a public authority or body; our core activities do not consist of processing that requires regular and systematic monitoring of data subjects on a large scale (the plugin contains no telemetry or analytics, and its licence check carries only a licence identifier and the plugin version, used solely to confirm that licence, so there is nothing to monitor); and we do not process special categories of data, or data relating to criminal convictions and offences, on a large scale. The mailbox above is the contact point for all data-protection matters.

2Scope of this policy

This policy covers three things: the SqlSage plugin installed into your own DBeaver, this website (sqlsagedbeaver.lumasoft.pl, including the p2 update site), and the small licensing backend we operate at api-dbeaver.lumasoft.pl.

It does not cover: the AI provider you sign in to (Anthropic or OpenAI) and their command-line tools, which you install and use under your own agreement with them; DBeaver itself, which is a separate product of DBeaver Corp; your databases; or the payments provider that sells the product to you. Each of those relationships is described below so you can see where the boundary sits.

3What data is involved

The plugin is architected so that almost nothing reaches us. The categories of data involved are:

4What is sent to the AI provider

SqlSage does not hold an AI subscription for you and does not resell access to AI models. Instead it starts the Claude Code (claude) or OpenAI Codex (codex) command-line tool that you installed and signed in to, and talks to it as a local subprocess. Everything the model sees therefore travels to Anthropic or OpenAI through your tool, on your account, under your agreement with that provider.

What the plugin puts into a prompt is:

• Your SQL and your questions, and the SQL text or editor selection you act on.
• Schema metadata from the connection you are working on — table and view names, column names and types, primary and foreign keys, indexes, object definitions the engine itself reports, and the SQL dialect.
• Error text from your last failed statement, when you ask it to explain an error.

Query result values are withheld by default. When the assistant runs a read-only query, the rows are redacted before the result goes back to the model unless you have explicitly switched on the opt-in — the "Send query result values to the model" checkbox in Window → Preferences → SqlSage, or the /share on chat command. Be aware that this switch is a preference, not a one-off: once you turn it on it stays on, across chats and across restarts, until you turn it off with /share off or the same checkbox.

Because the request is carried by your provider's own tool, that provider's terms and privacy policy govern how the data is handled, including any retention, abuse monitoring or telemetry the tool performs on its own account. We recommend you read them:

• Anthropic (Claude / Claude Code): anthropic.com/legal/privacy
• OpenAI (Codex / ChatGPT): openai.com/policies/privacy-policy

5What stays on your machine

The plugin writes several things locally, and none of them are transmitted to us:

All of it is removed when you delete those folders and uninstall the plugin. We have no copy and no way to retrieve any of it.

6Licence, trial & update check

Trial. The plugin grants a 30-day Pro trial on first run, with no sign-up and no card. The trial clock is kept on your machine — in Eclipse secure storage for your operating-system user, with a copy in DBeaver's configuration preferences. Nothing is sent to us when it starts, runs or ends; when it ends the plugin continues to work on the Free tier.

Licence check. A purchased licence key is a token signed with our Ed25519 key; the plugin verifies that signature locally against a public key compiled into it. Once you have entered a paid licence key, the plugin also confirms with our licensing backend that the licence is still active: a background check about 15 seconds after DBeaver starts, re-evaluated hourly but contacting the server at most once every 24 hours, plus one check right after you paste a new key. Each check is a single HTTPS POST to https://api-dbeaver.lumasoft.pl/license/validate whose body carries only the licence identifier, with the plugin version in the user-agent header — no email address, no device fingerprint, no schema, queries, results or usage data. On the Free tier or the trial, no check is made.

What we keep from a check. An identifier we do not know is answered and nothing is stored. For a licence we hold, we record the date it was last seen (one marker per licence identifier, rewritten at most once a day and deleted automatically after 35 days) and increment a running total of checks that carries no identifier. We use this to confirm the licence and to count active installations. As with any HTTPS request, our hosting provider's logs may record standard connection metadata such as your IP address.

What the answer does. If the licence is active, it keeps working, and the plugin may replace the stored key with a freshly signed one (for example after a subscription renews). If our server reports the licence revoked (for example after a refund) or expired, the Pro features stop and the plugin falls back to the trial if it is still running, otherwise to Free. If the server cannot be reached, the licence keeps working for 14 days after the last successful check — never beyond the expiry date in the key itself — and then falls back the same way until a check succeeds.

Switching it off. Window → Preferences → SqlSage → "Never contact the license server". With it on, the plugin makes no licence request at all; the key simply works until its own expiry date, without automatic renewal.

Update check. Once per DBeaver session, a background job makes a single HTTPS GET for /updatesite/content.jar on our update site — a public file listing the current version — and compares it with the version you have installed. It sends a plain SqlSage-UpdateChecker user agent and nothing else: no identifier, no licence, no schema, no queries, no telemetry. You can switch it off in Preferences. As with any HTTPS request, our hosting provider's logs may record standard connection metadata such as your IP address.

7Purchase & licence delivery

Payment. Purchases are sold and processed by Paddle acting as Merchant of Record. Paddle is the seller of record for your transaction: it collects and controls your billing information (name, email, payment method, tax and location data), handles VAT and sales tax, issues the invoice, and manages chargebacks and refunds. We never receive or store your card details.

Licence issuance. When a payment completes, Paddle sends a signed notification to our licensing backend — a Cloudflare Worker at api-dbeaver.lumasoft.pl. The Worker signs a licence key for you and stores a record in a Cloudflare key-value namespace containing: a generated licence identifier, the licence type and tier, its expiry (for subscriptions), the signed key itself, the Paddle transaction and subscription identifiers, a timestamp, and the email address you used at checkout. It also keeps a lookup index of that address as a SHA-256 hash rather than in the clear, and short-lived markers so a retried notification cannot issue a duplicate licence.

Delivery. The key is issued the moment the payment notification is verified and is retrievable from our licensing service using the transaction identifier Paddle gives you at checkout (/license/retrieve). If you lose it, the /license/resend endpoint will re-send the keys held for an address you enter; the response is deliberately identical whether or not we hold anything for that address, and the endpoint is rate-limited per address and IP address to blunt abuse. The counters used for that rate limit are keyed by a hash and expire automatically. Where email delivery is enabled, the key is sent from our own Microsoft 365 mailbox on the lumasoft.pl domain; we do not hand your address to a bulk-email or marketing platform, and we never use it to market to you. If your key does not reach you, write to [email protected] and we will send it.

We do not operate user accounts, and there is no password to create: the purchase email is the proof of ownership.

8The optional local agent bridge

SqlSage can expose the connection you are working on to your own external AI agent (for example Claude Code, Codex CLI, Cursor or Claude Desktop) over a small server bound to 127.0.0.1 on your machine, guarded by a 256-bit bearer token stored encrypted in Eclipse Secure Storage. It is off by default and you switch it on in the panel.

While it is on: external agents are restricted to read-only statements, writes and schema changes are refused outright, row values are withheld, the global kill switch still applies, and every classification is written to the same local audit log. Your database credentials never leave DBeaver.

9Website: analytics, cookies, checkout

Analytics. This website uses Google Analytics 4 in Consent Mode v2. Before you make a choice, every consent signal is set to denied: no analytics or advertising cookies or identifiers are stored on your device, and only anonymous, cookieless measurement is sent. Cookies and full analytics are enabled only after you click "Accept" in the banner; if you click "Reject", nothing further is stored. Your choice is remembered in your browser's local storage under the key sqlsage-consent — clear this site's storage to be asked again. Advertising features are not used, ad-data redaction and URL passthrough are enabled.

Checkout. The Paddle checkout script is loaded from Paddle's CDN only when you interact with a buy button (hover, focus or click) — not on page load. If you never touch a buy button, your browser never contacts Paddle from this site. Once the overlay opens, what you enter goes to Paddle as Merchant of Record.

Install counter. Clicking the "Copy" button next to the update-site URL fires a single, fire-and-forget request to a counter we run at api.lumasoft.pl that increments a tally of install attempts for this product. It carries no identifier, no cookie and no payload beyond the product name; standard connection metadata may appear in our hosting provider's logs.

The plugin itself contains no analytics, cookies or tracking of any kind. This section is about the website only.

10Legal bases (GDPR)

Where the EU General Data Protection Regulation applies, we rely on:

• Performance of a contract (Art. 6(1)(b)) — issuing, delivering and re-sending your licence key, and supporting the product you bought.
• Legitimate interests (Art. 6(1)(f)) — keeping the licensing service secure, preventing licence fraud and abuse of the resend endpoint, confirming through the licence check that an entered licence is still active and counting active installations, and serving the version file that powers the update check.
• Consent (Art. 6(1)(a)) — website analytics cookies, and your opt-in to send query result values to your AI provider. You can withdraw either at any time, with no effect on the rest of the product.
• Legal obligation (Art. 6(1)(c)) — tax and accounting duties, discharged primarily by Paddle as Merchant of Record.

11Sub-processors

We use a small number of providers to run the service: Cloudflare (this website, the p2 update site, the licensing Worker and its key-value store), Paddle (Merchant of Record), Google (website analytics only) and Microsoft (our own Microsoft 365 mailboxes, used for licence-key delivery and support correspondence). The current list, with roles, data and locations, is on our Sub-processors page.

Personal data these providers handle for us is processed on that provider's own data processing terms, which form part of the service agreement we accept with each of them.

Anthropic and OpenAI are not our sub-processors. They are your providers, reached through the CLI you installed and the account you signed in to, and nothing about that traffic passes through us. Likewise DBeaver Corp is the vendor of the host application, not a processor acting for us.

12Retention

• Licence records (licence identifier and key, type, tier, expiry, Paddle identifiers, purchase email, hashed-email index) are kept in our key-value store for as long as the licence is in force, and afterwards for as long as we need them to support it, re-send keys, honour renewals, handle refunds and chargebacks, prevent licence fraud and meet our accounting and tax obligations. To be precise rather than reassuring: no automatic expiry is configured on these records, so they persist until deleted — a perpetual licence record is expected to persist indefinitely, because it is the only proof of an entitlement that never ends. You can ask us to erase your record at any time (see section 14); the consequence is that we can no longer re-send your key or confirm your entitlement.
• Idempotency markers and rate-limit counters expire automatically — 60 days and roughly an hour respectively.
• Licence-check markers (a licence identifier and the date it was last seen) expire automatically after 35 days. The running total of checks carries no identifier. Nothing is stored for an identifier we do not know.
• Local data (licence key, trial state, chat transcript, audit log, settings) lives only on your machine, for as long as you keep it.
• Billing records are kept by Paddle under its own policy and applicable tax law.
• Support correspondence is kept until you ask us to delete it.
• Server logs at our hosting provider are kept for that provider's standard period.

13International transfers

Our infrastructure providers operate globally, so personal data may be processed outside the European Economic Area. Where that happens, the transfer is covered by the safeguards the relevant provider implements — for example the European Commission's Standard Contractual Clauses. Anything you send to your own AI provider is transferred under your own agreement with them, not ours.

14Your rights

Under the GDPR you have the right to access your personal data, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent where processing rests on consent. You also have the right to complain to a supervisory authority — in Poland the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), or the authority where you live.

To exercise any of these, write to [email protected]. For a request about your billing data, Paddle is the controller of that data as Merchant of Record; tell us and we will point you to the right place. Note that erasing your licence record means we can no longer re-send your key or verify your entitlement.

15Security

Our approach is to hold as little as possible. Prompts and query results never reach our servers. We never take custody of your AI provider credentials, and the CLI we launch is given a filtered environment that excludes API-key and token variables. Licence keys are signed with a private key that lives only in our licensing Worker as a secret, never in the product or the repository, and never in the key-value store. Webhook notifications are signature-verified over their exact bytes with a replay window before we act on them. The database work the assistant does passes through a single classifier chokepoint: only statements provable as reads run automatically, on a separate SqlSage connection with a timeout and a row limit, and anything else stops for your explicit confirmation.

No method of transmission or storage is perfectly secure. We design the product so that there is very little sensitive data on our side to protect in the first place.

16Children

SqlSage is a professional developer tool and is not directed at children. We do not knowingly collect personal data from anyone under 16.

17Changes to this policy

We may update this policy as the product changes — and we will update it before any feature ships that would send your prompts through infrastructure we operate, or that would add a provider to the list in section 11. Material changes are reflected in the "Last updated" date and, where appropriate, notified to customers.

18Contact

LUMA sp. z o.o.
ul. Gawronia 15, 04-785 Warszawa, Poland
KRS 0001244636 · NIP PL9522285489 · REGON 544875680
Data protection and privacy: [email protected]
Everything else: [email protected]