Privacy Policy

1. Who this policy covers

This policy explains how Data Viz Tool, Inc. ("dvt", "we", "us") handles personal data across the dvt.dev website, the dvt application and API (app.dvt.dev), and the dvt MCP endpoint (mcp.dvt.dev). It covers visitors to our site, people who request early access, users of the product, and people we contact by outbound email or who reply to it (see Outbound outreach email). It does not change the terms of any separate agreement you have with us.

2. Information we collect

Information you provide

• Account & identity. When you sign in, our authentication provider (WorkOS) processes your name, email address, and organization and membership metadata.
• Early-access requests. If you use a "handraise" form on dvt.dev, we collect the email address and company name you enter, and use them only to reach out to you about dvt.
• Content you author. Dashboard specs — the JSON definition of your charts and layout — and related settings you create in the product.
• Warehouse connection settings. The configuration needed to connect to your warehouse. Credentials are envelope-encrypted; our database stores only ciphertext.
• Trial uploads. If you upload a CSV during a trial, we store it as encrypted, organization-scoped Parquet so your trial dashboards keep working. This exists only during a trial — not on paid plans.
• Support & correspondence. Messages you send us, including any details you choose to include.
• Business contacts. If you work in a data or analytics role at a U.S. company, we may collect your work contact details from public sources, or from work contact details our founders already have from professional communities and user groups they take part in, in order to email you — see Outbound outreach email.

Information collected automatically

• Usage & audit records. Sensitive actions — including every credential decryption — are recorded to an append-only audit log with the actor, action, and resource.
• Diagnostic data. Error and performance events (via Sentry) and application logs (via Axiom), which may include user or organization identifiers and request context.
• Website analytics. We use privacy-respecting, cookieless analytics to understand aggregate traffic on dvt.dev. We do not build advertising profiles.
• Homepage video. The homepage video is hosted on YouTube. It loads from youtube-nocookie.com only after you click play; until then, no request is made to YouTube or Google. Once it loads, YouTube may store cookies or similar identifiers (such as local storage) on your device, and Google's privacy policy applies to that player.
• Warehouse catalog structure (opt-in). If an org admin turns on catalog sync for a connection — off by default, per connection — we automatically read and store names/types/comments only, never data rows or values: the object and column names, kinds, data types, nullability, and comments in your warehouse's own catalog, plus a column ordering dvt assigns itself (not read from the warehouse). A warehouse column comment is free text your team wrote, so it's stored verbatim. Turning catalog sync back off for that connection deletes its synced structure immediately.

3. What we do not collect

Your warehouse's data rows or values. A dashboard is a spec; to render it, dvt compiles SQL and sends it to your warehouse, where the query runs on your compute. Only the result rows needed to draw a chart come back — they pass through our systems in memory for that request and are then discarded, never persisted to our database. This holds even for a connection with catalog sync enabled: as described above, catalog sync stores names/types/comments only, never data rows or values. A data export (CSV or XLSX) is streamed to you on request and audited, but never stored by dvt. We also never store warehouse credentials in plaintext.

4. How we use information

• To provide, operate, secure, and improve the dvt product and website.
• To authenticate you, enforce role-based access, and maintain audit trails.
• To communicate with you about your account, support requests, and early access.
• To contact business contacts about dvt by outbound email (see §9).
• To detect, investigate, and prevent security incidents and abuse.
• To comply with legal obligations.

We do not sell personal data, and we do not use your content to train models.

5. How we share information

We share personal data only with the third-party subprocessors that help us operate the product — currently WorkOS, Neon, Fly.io, Cloudflare, Resend, Sentry, and Axiom — and, for outbound outreach email only (not as subprocessors under our Data Processing Addendum), Google Workspace, Anthropic, Cloudflare, and Hunter (see Outbound outreach email). Each one, what it processes, and where it operates is listed on oursubprocessors page, kept current as our infrastructure evolves. Because queries run in your warehouse, none of these services receive your warehouse's data rows or values. The one exception is Neon: per §2 above, an org admin can opt a connection into catalog sync, which stores warehouse catalog structure — names, types, and comments, never data rows or values. We may also disclose data when required by law, or to protect the rights, safety, and security of dvt, our users, or the public. If dvt is involved in a merger or acquisition, we will honor the commitments in this policy.

6. Data retention

• Personal data. When a user's account is deleted, or an organization is closed, a daily job de-identifies their account details — email, name, avatar — after 90 days, keeping usage history in de-identified form. Note that removing someone from an organization does not by itself start that clock: their account still exists, so it is their account deletion that begins the 90 days.
• What outlives that scrub. Two kinds of record are kept longer, and we'd rather name them than imply nothing is left. An email address you added as a scheduled-export recipient lives until you delete that recipient or its schedule. Free text you or an agent typed into a change history — which can mention a person by name — is kept for as long as that history is kept. Removing it is a deliberate, audited database change rather than a routine job — contact us and we will do it.
• Image exports (PNG/PDF). Stored encrypted and scoped to your organization. Retained indefinitely — we do not delete them on a schedule, and closing your organization does not delete them. Email[email protected] to have your organization's exports deleted.
• Trial CSV uploads. Deleted by an automated retention job after your trial ends.
• Warehouse catalog structure. Deleted immediately when catalog sync is turned off for a connection, or when the connection itself is deleted — not held on any separate retention schedule.
• Dashboard specs & account metadata. Retained while your account is active and as needed for the purposes above.
• Outbound outreach contacts. See §9.

7. Security

All connections use TLS 1.2 or higher. Our database provider encrypts metadata at rest with AES-256, and warehouse credentials get a second layer we control (envelope encryption) — the root key that unwraps them lives only in the query engine, never in the API tier or the database. Every record is scoped to an organization and checked on every read and write. Full detail — access controls, tenant isolation, and our continuous security testing program — is on our security overview.

8. AI authoring and your data

dvt is AI-native: humans and AI agents author the same dashboard spec over the same scoped, audited API and MCP surface. The AI is your agent, not ours — dvt does not send your product or warehouse data to a model provider, and there is no dvt-operated model that ingests your prompts or warehouse data. An agent connects with API keys scoped to the minimum a workload needs and cannot exceed the capabilities of the user who authorized it, and its actions are recorded in the audit log as agent activity.

9. Outbound outreach email

dvt runs a small outbound email program operated by an AI agent. Every message says it comes from dvt's AI agent, working for dvt's founders. Every message has an unsubscribe link and supports one-click unsubscribe in mail apps that offer it. It sends from a separate domain, dvtagent.com, so that product email from dvt.dev stays separate.

• Who we contact. People at U.S. companies, at their work address, in data and analytics roles. We don't deliberately email personal webmail addresses (like Gmail or Outlook), and we don't contact anyone who has asked us not to. We send at most one follow-up.
• Where the data comes from. Public job postings, company websites, and public talks or articles. We also contact some people our founders know from professional communities and user groups they take part in. For those people we start from the work contact details our founders already have, and we verify those addresses with Hunter too. We never say or imply anything about what they said or did in that community. When we use a commercial contact-data provider to find or verify a work address, we list it on our subprocessors page before we use it. We don't scrape LinkedIn, we don't use email addresses taken from GitHub, and we don't buy or rent lists.
• What we store. Your work email address, name, title, and company; the public posting or page that prompted the message; whether your details came from public sources or from our founders' professional communities; and the messages and replies.
• Who processes it. Google Workspace (the mailbox the agent sends from), Anthropic (the model the agent uses to research and draft a message, and to sort replies to our messages — it receives your name, title, company, and the public information above, whether your details came from public sources or our founders' communities, and the subject and text of those replies, from whoever sends them), Cloudflare (the service that runs the agent and its database), and Hunter (the contact-data provider we use to find and verify a work email address — it receives a company's domain and, to find or verify an address, the person's name and their work address). These vendors are listed on our subprocessors page.
• How long we keep it. We delete it 12 months after we last contacted you. If we find your details but never email you, we delete them 90 days after we found them. If you unsubscribe or ask us to delete your data, we delete it. Whenever we delete your details, for any of these reasons, we keep only a one-way, keyed hash of your email address, so we never contact that address again. We keep that hash for as long as we run outreach. Gmail threads are moved to Trash at 12 months, and Gmail keeps Trash for up to 30 more days; deleted database records can stay in our database provider's 30-day recovery window.
• How to opt out or ask for deletion. Click the unsubscribe link in any message, reply to the message, or email [email protected]. We act on deletion requests within 10 business days.

10. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, or export your personal data, or to object to or restrict certain processing. Within the product, role-based controls let admins manage members and access directly. To exercise any right, or to request a DPA, email [email protected] and we'll respond. We won't discriminate against you for exercising these rights.

11. International data transfers

dvt and its subprocessors are primarily hosted in the United States (Cloudflare operates a global edge). Hunter, the contact-data provider for our outbound outreach email, processes data in Belgium (EU). If you access dvt from outside the U.S., your data may be processed there. We rely on appropriate safeguards for such transfers where required by law.

12. Children's privacy

dvt is a business tool and is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, email[email protected] and we'll delete it.

13. Changes to this policy

We may update this policy as the product and our practices evolve. We'll revise the "last updated" date above, and for material changes we'll provide a more prominent notice.

October 15, 2026: §9 now separates the unsubscribe link in each message from one-click unsubscribe in mail apps. Before, it described the link in each message as one-click.

October 11, 2026 (update): §2 and §9 now say we also contact some people our founders know from professional communities and user groups they take part in, starting from work contact details our founders already have and verifying those addresses with Hunter. §9 also now lists, among what we store and what Anthropic receives, whether your details came from public sources or from those communities, and the subprocessors page says the same. Before, §9 listed only public sources and commercial contact-data providers. This adds a source of personal data, so we are calling it out here rather than only changing the date.

October 11, 2026: §9 and the subprocessors page now say that Anthropic also receives the subject and text of replies to our outreach messages, from whoever sends them, so the agent can sort them (for example, a question, a "not now", or a request to opt out or delete data). Before, they said Anthropic received only the details used to research and draft a message. §1 now also covers people who reply to our outreach email.

October 10, 2026 (update): §9 now says that whenever we delete your details, including at the 12-month and 90-day limits, we keep only a one-way, keyed hash of your email address so we never contact that address again. Before, §9 said this only for unsubscribes and deletion requests.

October 10, 2026: named Hunter as the contact-data provider for outbound outreach email in §5, §9, and on the subprocessors page. Hunter finds and verifies work email addresses; its servers are in Belgium. We list it before the outreach agent uses it, as §9 says we would. Also added to §9: if we find your details but never email you, we delete them 90 days after we found them.

October 7, 2026: added §9 (Outbound outreach email) and renumbered the former §9–§13 to §10–§14. Because outreach recipients' details are sent to Anthropic to draft emails, we qualified the model-provider statements in the summary and §8 to say they cover product and warehouse data. We also added Google Workspace and Anthropic (outreach only) to §5 and the subprocessors page, and added matching items to §2, §4, and §6. §1 now also covers people we contact by outbound email, and the subprocessors page lists Google Workspace, Anthropic, and Cloudflare's outreach role in a separate outreach table (not DPA subprocessors). The model-provider qualification narrows a published statement, so we are calling it out here rather than only changing the date.

October 3, 2026: added a disclosure for the homepage video (§2): the YouTube player loads from youtube-nocookie.com only after you click play.

July 30, 2026: corrected the image-export retention statement (§6). An earlier version of this policy said image exports (PNG/PDF) were automatically deleted within 30 days. No such deletion schedule was ever in place — those exports are retained indefinitely, and closing your organization does not delete them. You can email[email protected] to have them deleted. Nothing was lost; the effect was that exports were kept longer than this policy stated. Personal-data and trial-upload retention are unchanged.

July 28, 2026: corrected the scope of the retention commitment in §6. The previous wording said departure left "only de-identified records," which was broader than what our systems do: the 90-day scrub covers account details (email, name, avatar) and does not reach a scheduled-export recipient address or free text typed into a change history. §6 now names both, states that the clock starts on account deletion rather than on removal from an organization, and gives you a route to have those records removed. It also corrects "within 90 days" to "after 90 days": the job runs daily and acts on records that have passed the 90-day mark, so the scrub happens just after that point rather than before it. These changes narrow a published commitment, so we are calling them out here rather than only changing the date.

July 25, 2026: added warehouse catalog structure as an opt-in collected data category (§2), and sharpened the "raw data" language throughout this policy to be explicit about data rows and values, so it can't be read as also covering warehouse object or column names.

14. Contact

Questions about this policy or how we handle your data? Email[email protected]. Our machine-readable security policy is published at /.well-known/security.txt.