Privacy Policy

Who we are

SQL Optimizer is operated by Zhao Changwen, an individual developer established in the People's Republic of China. For the purposes of the EU and UK General Data Protection Regulation, we are the data controller for the personal data described here.

What we process

Data	Why we have it	How long we keep it
Account details from Google sign-in: name, email address, avatar URL, Google account identifier	To identify you and attach your monthly allowance to an account	Until you delete the account, then 30 days
Anonymous usage identifier, hashed IP address, UTC date, number of optimizations used	To enforce the daily and monthly allowance and to stop one visitor from minting unlimited free identities	90 days
The SQL you submit	To produce the optimization you asked for	Not stored. Processed in memory and discarded
Order metadata: order id, plan, amount, currency, status	To provide paid plans and keep accounting records	As long as tax and accounting law requires
Messages you send to support	To answer you	24 months
Analytics events	To understand how the tool is used, only with your consent	Set by the providers, see the Cookie Policy

Card details never reach us. Payments are processed by Waffo, which acts as merchant of record: it is the seller, and it handles your card and tax data under its own privacy policy.

The SQL you submit

Your statement is sent to our model provider to produce a result, and it is not written to our database, not written to application logs, and not used to train any model. Error reporting is configured not to include request bodies, and session recording is masked over the input form, the result panel and any error message.

We delete results when the request finishes. If you keep the page open, the result lives only in your browser.

Please do not paste credentials, connection strings, personal data or material you are not allowed to disclose. An optimization request needs the query and, optionally, the schema and execution plan — nothing else.

Cookies and analytics

We set two strictly necessary cookies: a session cookie that keeps you signed in, and an anonymous identifier that recognises your free daily run. Your theme preference and your cookie choice are stored in your browser's local storage, not in cookies.

Analytics cookies from Google Analytics and Microsoft Clarity are optional and load only after you accept them. Nothing loads before you decide. You can change the decision at any time through Cookie settings in the footer. Details, including the individual cookie names and lifetimes, are in the Cookie Policy.

Why we are allowed to process it

Where the GDPR applies, we rely on:

• Performance of a contract — creating your account, delivering optimizations, and administering paid plans.
• Legitimate interests — preventing abuse of the free allowance, keeping the service secure, and understanding aggregate usage. The guard uses a hashed IP address, not the address itself, and we have balanced this against your rights by keeping the data short-lived and the scope narrow.
• Consent — analytics cookies. You can withdraw consent at any time.
• Legal obligation — retaining records that tax and accounting law requires.

Where your data is stored and transferred

Account data and usage records are hosted in the European Union: the database is hosted by Neon in the eu-central-1 region and the application runs on Vercel in the fra1 region. This keeps the account side of the service inside the EU.

One transfer is unavoidable: the SQL you submit is sent to DeepSeek, our model provider, which processes it in mainland China. China is not covered by an adequacy decision of the European Commission or the UK Government. We therefore rely on the Standard Contractual Clauses approved by the European Commission for this transfer, together with a transfer impact assessment, and we limit what is sent to the statement plus any schema or execution plan you choose to include.

If you are located in mainland China, this sending of personal data outside China is a cross-border transfer under the Personal Information Protection Law. We rely on the standard contract mechanism, minimise the data sent, and encrypt it in transit.

If you would rather not have your statement processed outside the EU or China, please do not use the optimization feature. There is no way to run the service without a model provider.

Who else processes it

We use a small set of processors: Neon for the database, Vercel for hosting, DeepSeek for inference, Google for sign-in, Waffo for payments, Resend for transactional email, and Google Analytics and Microsoft Clarity for analytics once you consent. Each one, what it sees, and where it processes it is listed in the Sub-processors document.

Your rights

Depending on where you live, you may have some or all of the following rights:

• Access — a copy of the personal data we hold about you.
• Rectification — correction of data that is wrong.
• Erasure — deletion of your account and the data attached to it.
• Restriction and objection — limits on how we process, including a right to object to processing based on legitimate interests.
• Portability — a machine-readable export of the data you provided.
• Withdrawal of consent — for analytics, at any time, without affecting processing that already happened.

California residents have the right to know what categories of personal information we collect and disclose, to request deletion, to correct inaccurate information, and not to be discriminated against for exercising those rights. We do not sell personal information and we do not share it for cross-context behavioural advertising.

Users in mainland China have the rights granted by the Personal Information Protection Law, including access, correction, deletion, withdrawal of consent, and an explanation of our processing rules.

To exercise any of these rights, email support@sqloptimizer.online. We respond within 30 days. We may need to verify that the request comes from the account holder, and we will not charge you for a request unless it is manifestly unfounded or excessive.

You also have the right to complain to a supervisory authority — in the EU, the authority of your habitual residence, place of work or the place of the alleged infringement; in the UK, the Information Commissioner's Office.

Nothing in this policy limits any right you have under mandatory consumer or data protection law in your country of residence.

EU and UK representative

If you are in the EU or the UK, Article 27 of the GDPR and the equivalent UK provision require a representative established in that territory. We have not yet appointed one. Until we do, please contact us directly at support@sqloptimizer.online and we will handle your request ourselves. This is a known gap and we will update this document when a representative is appointed.

Security

Data is encrypted in transit with TLS and at rest by our database provider. Access is limited to the operator, administrative accounts require strong authentication, and we do not keep copies of submitted SQL.

If a breach affects your personal data and is likely to result in a risk to your rights, we will notify the competent supervisory authority without undue delay and, where the law requires it, notify you directly, describing what happened and what we have done about it.

Children

The service is not intended for people under 16 in the European Economic Area and the United Kingdom, or under 13 elsewhere. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

Changes

We publish a new version of this policy with a revised date at the top. If a change materially affects what we do with your data, we will notify account holders by email at least 30 days before it takes effect, unless the law requires a faster change.

Contact

Email support@sqloptimizer.online for anything in this policy, including access and deletion requests. See also the Terms of Service, the Cookie Policy and the Sub-processors list.