Praxion ("we", "us", or "our") is a software project and service currently operated by its founder as an individual, pending the incorporation of a legal entity.
The individual operator of Praxion is the data controller for personal data processed in connection with the operation of the Services, except where Praxion processes personal data on behalf of its customers as a processor.
For privacy-related questions, requests, or concerns, contact us at: privacy@praxionapp.com
If Praxion processes personal data on behalf of a business customer in connection with the Services, Praxion may act as a processor or service provider rather than as an independent controller. In those circumstances, the applicable business customer is generally responsible for determining the purposes and means of processing and for responding to requests concerning such data.
1. WHO WE ARE
2. THE TYPES OF INFORMATION WE PROCESS
Depending on how you interact with Praxion, we may process different categories of information.
2.1 Account and identity information
When you create or use an account, we may process information such as:- Name
- Email address
- Organization or company name
- Authentication identifiers
- User role and permissions
- Organization or workspace identifiers
- Account preferences
2.2 Billing and subscription information
We may process subscription plan, billing status, usage information relevant to your subscription, invoice information, transaction identifiers, and payment status. Payment card information is generally processed directly by our payment service providers.2.3 Service usage and technical information
We may process IP address, browser type, device information, operating system, application logs, authentication events, security events, service usage events, error reports, API requests, and feature interaction data. We use this information to operate, secure, troubleshoot, improve, and monitor the Services.3. CUSTOMER INFRASTRUCTURE AND DATABASE TELEMETRY
Certain Praxion Services may involve the deployment or connection of a Praxion software agent within infrastructure controlled by a customer.
The purpose of the agent is to provide database observability, optimization, governance, metering, health monitoring, and related functionality.
Depending on the Services enabled and customer configuration, the agent may process or transmit operational metadata such as:
Under normal operation, Praxion does not require the contents of customer database rows or production records in order to provide database observability and optimization functionality.
Customers should nevertheless understand that database queries, schema metadata, identifiers, configuration data, and other technical information may themselves contain sensitive or personal information depending on how a customer designs its systems.
The purpose of the agent is to provide database observability, optimization, governance, metering, health monitoring, and related functionality.
Depending on the Services enabled and customer configuration, the agent may process or transmit operational metadata such as:
- Database performance metrics
- Query execution statistics
- Query fingerprints or normalized query representations
- Database schema metadata
- Table and column metadata
- Index metadata
- Database catalog information
- Optimization signals and recommendations
- Agent health and heartbeat information
- Service configuration metadata
- Usage and metering events
- CI/CD database analysis metadata
Under normal operation, Praxion does not require the contents of customer database rows or production records in order to provide database observability and optimization functionality.
Customers should nevertheless understand that database queries, schema metadata, identifiers, configuration data, and other technical information may themselves contain sensitive or personal information depending on how a customer designs its systems.
4. DATA MINIMIZATION AND SANITIZATION
Praxion is designed to minimize the amount of information transmitted from customer infrastructure to the Praxion Control Plane.
Where applicable, the Services may normalize, sanitize, anonymize, redact, or otherwise minimize technical information before transmission. These mechanisms may include processing intended to reduce the transmission of query literal values, personally identifiable values, credentials, secrets, tokens, authentication information, and other sensitive values.
No automated sanitization mechanism should be considered a substitute for appropriate customer security controls or data classification practices. Customers remain responsible for ensuring that their use and configuration of the Services is appropriate for the sensitivity of their environments and applicable legal requirements.
Where applicable, the Services may normalize, sanitize, anonymize, redact, or otherwise minimize technical information before transmission. These mechanisms may include processing intended to reduce the transmission of query literal values, personally identifiable values, credentials, secrets, tokens, authentication information, and other sensitive values.
No automated sanitization mechanism should be considered a substitute for appropriate customer security controls or data classification practices. Customers remain responsible for ensuring that their use and configuration of the Services is appropriate for the sensitivity of their environments and applicable legal requirements.
5. WHAT WE DO NOT INTENTIONALLY COLLECT
Praxion does not intentionally require customers to provide the contents of production database records in order to provide its core database observability and optimization functionality.
Unless explicitly required for a customer-requested feature, support interaction, or separately agreed service, Praxion does not intentionally collect:
Unless explicitly required for a customer-requested feature, support interaction, or separately agreed service, Praxion does not intentionally collect:
- Complete production database tables
- Customer business records
- Customer application records
- Raw customer datasets
- Passwords
- Private keys
- Authentication secrets
- Payment card numbers
6. HOW WE USE INFORMATION
We may process information for the following purposes.
6.1 Providing the Services
To authenticate users; create and administer accounts; provide database observability; generate optimization recommendations; analyze database migrations; provide CI/CD governance functionality; provide semantic layer functionality; generate or analyze SQL where applicable; maintain dashboards and reporting; and calculate usage and subscription entitlements.6.2 Security and fraud prevention
To detect unauthorized access, prevent abuse, investigate suspicious activity, protect accounts, maintain audit logs, detect service misuse, and respond to security incidents.6.3 Service reliability and troubleshooting
To diagnose errors, monitor system health, debug failures, improve reliability, maintain infrastructure, and respond to support requests.6.4 Product improvement
We may analyze aggregated, statistical, or de-identified information to understand feature usage, system performance, reliability trends, product adoption, and common technical issues.6.5 Billing and subscription management
To calculate usage, enforce subscription limits, manage subscriptions, process payments, issue invoices, detect billing fraud, and reconcile transactions.6.6 Legal obligations
To comply with applicable laws, respond to lawful requests, protect legal rights, resolve disputes, and enforce agreements.7. LEGAL BASES FOR PROCESSING
Where the General Data Protection Regulation (GDPR) applies and Praxion acts as a controller, we process personal data based on one or more of the following legal grounds: performance of a contract, legitimate interests, compliance with legal obligations, and consent where required.
Our legitimate interests may include operating and improving the Services, maintaining security, preventing fraud and abuse, protecting our infrastructure, understanding product performance, and communicating with business customers regarding the Services.
Where Praxion processes personal data on behalf of a business customer as a processor, the processing is governed by the customer's instructions and applicable contractual documentation, including any Data Processing Agreement.
Our legitimate interests may include operating and improving the Services, maintaining security, preventing fraud and abuse, protecting our infrastructure, understanding product performance, and communicating with business customers regarding the Services.
Where Praxion processes personal data on behalf of a business customer as a processor, the processing is governed by the customer's instructions and applicable contractual documentation, including any Data Processing Agreement.
8. PRAXION AS CONTROLLER AND PROCESSOR
The role Praxion plays under data protection law depends on the nature of the information and the Services involved.
Praxion as a controller
Praxion generally acts as a controller for information relating to website visitors, prospective customers, account administration, user authentication, direct business relationships, billing and subscriptions, security logs related to Praxion accounts, and marketing communications where applicable.Praxion as a processor
Praxion may act as a processor or service provider when processing personal data on behalf of a business customer through the Services. Depending on the customer's implementation, certain infrastructure metadata, identifiers, or technical information may constitute personal data under applicable law. In such cases, the customer's agreement with Praxion, including any applicable Data Processing Agreement, governs the processing relationship.9. ARTIFICIAL INTELLIGENCE FEATURES
Certain Praxion features may use artificial intelligence or machine learning technologies, including natural-language-to-SQL functionality, SQL analysis, query explanation, database optimization workflows, and technical assistance.
Depending on the feature and configuration, information submitted for AI processing may include user prompts, natural language questions, relevant schema metadata, semantic definitions, generated SQL, and technical context necessary to provide the requested functionality.
Customers should avoid submitting unnecessary sensitive personal information to AI-powered features.
Praxion may use third-party AI service providers to deliver certain functionality. Where such providers process information on Praxion's behalf, Praxion seeks to use appropriate contractual and technical safeguards.
Praxion will not intentionally use customer database row contents to train Praxion's own general-purpose AI models unless expressly agreed with the customer. Any statement regarding whether a particular third-party AI provider uses customer inputs for model training is subject to the applicable configuration, contractual terms, and service offering of that provider.
Depending on the feature and configuration, information submitted for AI processing may include user prompts, natural language questions, relevant schema metadata, semantic definitions, generated SQL, and technical context necessary to provide the requested functionality.
Customers should avoid submitting unnecessary sensitive personal information to AI-powered features.
Praxion may use third-party AI service providers to deliver certain functionality. Where such providers process information on Praxion's behalf, Praxion seeks to use appropriate contractual and technical safeguards.
Praxion will not intentionally use customer database row contents to train Praxion's own general-purpose AI models unless expressly agreed with the customer. Any statement regarding whether a particular third-party AI provider uses customer inputs for model training is subject to the applicable configuration, contractual terms, and service offering of that provider.
10. HOW WE SHARE INFORMATION
We do not sell personal information in exchange for monetary compensation. We may disclose information to infrastructure and cloud providers, authentication providers, payment providers, AI service providers, professional advisors, authorities and legal recipients where required, and parties involved in corporate transactions, where necessary to operate the Services or comply with applicable law.
11. SUBPROCESSORS
Praxion may use subprocessors to provide components of the Services. These may include providers of cloud infrastructure, authentication, payment processing, AI functionality, monitoring, communications, and customer support.
Where Praxion acts as a processor, applicable subprocessors may be governed by the terms of Praxion's Data Processing Agreement. Praxion may maintain a separate and updated list of subprocessors for customers who require additional transparency regarding service providers involved in the delivery of the Services.
Where Praxion acts as a processor, applicable subprocessors may be governed by the terms of Praxion's Data Processing Agreement. Praxion may maintain a separate and updated list of subprocessors for customers who require additional transparency regarding service providers involved in the delivery of the Services.
12. INTERNATIONAL DATA TRANSFERS
Praxion may process information in countries other than the country in which the information was originally collected.
Where personal data subject to the GDPR or similar laws is transferred outside the European Economic Area, United Kingdom, or Switzerland, as applicable, Praxion will seek to implement appropriate safeguards where required by law. Such safeguards may include Standard Contractual Clauses approved by the European Commission, adequacy decisions, the UK International Data Transfer Addendum, or other legally recognized transfer mechanisms.
Where personal data subject to the GDPR or similar laws is transferred outside the European Economic Area, United Kingdom, or Switzerland, as applicable, Praxion will seek to implement appropriate safeguards where required by law. Such safeguards may include Standard Contractual Clauses approved by the European Commission, adequacy decisions, the UK International Data Transfer Addendum, or other legally recognized transfer mechanisms.
13. DATA RETENTION
We retain information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Services, comply with legal obligations, resolve disputes, enforce agreements, and maintain security.
Retention periods may vary depending on the category of information.
Where information is no longer necessary, we may delete, anonymize, aggregate, or otherwise de-identify it, subject to applicable law and technical limitations.
Retention periods may vary depending on the category of information.
| Information Category | General Retention Principle |
|---|---|
| Account information | For the duration of the account and as necessary afterward |
| Billing records | As required by contractual, accounting, and tax obligations |
| Security logs | For a period reasonably necessary to maintain security and investigate incidents |
| Audit records | According to applicable contractual, security, and compliance requirements |
| Infrastructure telemetry | According to service configuration and operational requirements |
| Backups | Until overwritten or deleted according to backup retention cycles |
| Support communications | As reasonably necessary to resolve issues and maintain service history |
14. SECURITY
Praxion uses technical and organizational measures designed to protect information against unauthorized access, alteration, disclosure, or destruction.
Depending on the applicable Services and deployment, these measures may include encryption in transit, access controls, authentication mechanisms, role-based permissions, tenant or workspace separation, audit logging, security monitoring, network controls, infrastructure isolation, secrets management, and data minimization practices.
No system can be guaranteed to be completely secure. Customers are also responsible for maintaining appropriate security controls within their own environments.
Depending on the applicable Services and deployment, these measures may include encryption in transit, access controls, authentication mechanisms, role-based permissions, tenant or workspace separation, audit logging, security monitoring, network controls, infrastructure isolation, secrets management, and data minimization practices.
No system can be guaranteed to be completely secure. Customers are also responsible for maintaining appropriate security controls within their own environments.
15. MULTI-TENANT SERVICE ACCESS
Praxion provides Services to multiple organizations. Where applicable, the Services are designed to logically separate customer organizations and workspaces.
Access to customer information may be restricted based on authentication, organizational membership, workspace identifiers, role-based access controls, application-level authorization, and database-level controls where implemented.
Customers are responsible for managing their authorized users and organizational access.
Access to customer information may be restricted based on authentication, organizational membership, workspace identifiers, role-based access controls, application-level authorization, and database-level controls where implemented.
Customers are responsible for managing their authorized users and organizational access.
16. AUDIT AND SECURITY EVENTS
Praxion may generate and retain audit information relating to actions performed within the Services. Audit information may include user identity, organization or workspace, timestamp, action performed, relevant technical identifiers, and security-related context.
Audit information may be used to investigate security incidents, support compliance activities, troubleshoot operational issues, maintain accountability, and detect unauthorized activity.
Audit information may be used to investigate security incidents, support compliance activities, troubleshoot operational issues, maintain accountability, and detect unauthorized activity.
17. COOKIES AND SIMILAR TECHNOLOGIES
Praxion may use cookies and similar technologies that are necessary to operate and secure our websites and Services. These technologies may be used for authentication, session management, security, fraud prevention, preferences, service functionality, and limited analytics.
Where legally required, we will request consent before placing non-essential cookies or similar tracking technologies.
Praxion does not intentionally use customer infrastructure telemetry collected through its software agents for behavioral advertising. If Praxion uses third-party analytics or advertising technologies on public marketing websites, those technologies will be subject to applicable cookie and consent requirements.
Where legally required, we will request consent before placing non-essential cookies or similar tracking technologies.
Praxion does not intentionally use customer infrastructure telemetry collected through its software agents for behavioral advertising. If Praxion uses third-party analytics or advertising technologies on public marketing websites, those technologies will be subject to applicable cookie and consent requirements.
18. MARKETING COMMUNICATIONS
Where permitted by applicable law, we may send business-related communications concerning product updates, security notices, service announcements, events, and relevant Praxion products.
You may opt out of promotional communications by following the unsubscribe instructions included in the communication. Operational, transactional, security, and legally required communications may continue where necessary.
You may opt out of promotional communications by following the unsubscribe instructions included in the communication. Operational, transactional, security, and legally required communications may continue where necessary.
19. YOUR PRIVACY RIGHTS
Depending on your location and applicable law, you may have rights concerning your personal information, including the right to access personal data, correct inaccurate information, request deletion, restrict processing, object to certain processing, request data portability, withdraw consent, and lodge a complaint with a supervisory authority.
To exercise applicable rights, contact us at privacy@praxionapp.com.
If Praxion processes information solely on behalf of a business customer, we may direct your request to the relevant customer because that customer may be responsible for responding to the request. We may need to verify your identity before responding to certain requests.
To exercise applicable rights, contact us at privacy@praxionapp.com.
If Praxion processes information solely on behalf of a business customer, we may direct your request to the relevant customer because that customer may be responsible for responding to the request. We may need to verify your identity before responding to certain requests.
20. GDPR RIGHTS
If the GDPR applies to the processing of your personal data, you may have rights of access, rectification, erasure, restriction of processing, data portability, objection, and withdrawal of consent, subject to applicable limitations.
You also have the right to lodge a complaint with a competent data protection supervisory authority.
If Praxion acts as a processor on behalf of a business customer, the customer responsible for the relevant processing may be the appropriate party to contact regarding your data protection rights.
You also have the right to lodge a complaint with a competent data protection supervisory authority.
If Praxion acts as a processor on behalf of a business customer, the customer responsible for the relevant processing may be the appropriate party to contact regarding your data protection rights.
21. CALIFORNIA AND OTHER REGIONAL PRIVACY RIGHTS
Depending on your location, additional privacy rights may apply under laws such as the California Consumer Privacy Act (CCPA) and other applicable state or regional privacy laws.
Where applicable, Praxion will provide information required by those laws regarding categories of information collected, sources of information, purposes of processing, categories of recipients, and applicable consumer rights.
Praxion does not sell personal information for monetary consideration. Where applicable law defines certain sharing for cross-context behavioral advertising as "sharing," Praxion will comply with applicable opt-out requirements.
Where applicable, Praxion will provide information required by those laws regarding categories of information collected, sources of information, purposes of processing, categories of recipients, and applicable consumer rights.
Praxion does not sell personal information for monetary consideration. Where applicable law defines certain sharing for cross-context behavioral advertising as "sharing," Praxion will comply with applicable opt-out requirements.
22. CHILDREN'S PRIVACY
The Services are intended for business and professional users and are not directed toward children. Praxion does not knowingly collect personal information from children where prohibited by applicable law.
If you believe that a child has provided personal information to Praxion in violation of applicable law, please contact us so that we can investigate and take appropriate action.
If you believe that a child has provided personal information to Praxion in violation of applicable law, please contact us so that we can investigate and take appropriate action.
23. THIRD-PARTY SERVICES
The Services may contain integrations with third-party services. This Privacy Policy does not govern the privacy practices of independent third parties.
Customers should review the privacy policies and contractual documentation of third-party services they choose to connect to Praxion.
Customers should review the privacy policies and contractual documentation of third-party services they choose to connect to Praxion.
24. CUSTOMER RESPONSIBILITIES
Customers are responsible for determining whether their use of the Services is appropriate for their data; configuring the Services securely; managing authorized users; classifying sensitive information; complying with applicable laws; obtaining required permissions or legal bases for data processing; and avoiding unnecessary submission of sensitive information to AI features or support channels.
Customers operating regulated environments should evaluate the Services against their own compliance and security requirements.
Customers operating regulated environments should evaluate the Services against their own compliance and security requirements.
25. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy from time to time to reflect changes in our Services, applicable laws, security practices, technology, or business operations.
When we make material changes, we will update the "Last updated" date and, where required by law, provide additional notice. We encourage users to review this Privacy Policy periodically.
When we make material changes, we will update the "Last updated" date and, where required by law, provide additional notice. We encourage users to review this Privacy Policy periodically.
26. CONTACT US
For questions, concerns, or requests relating to privacy or personal information, contact us at: privacy@praxionapp.com
27. DATA PROCESSING AGREEMENT
Business customers whose use of the Services involves Praxion processing personal data on their behalf may be entitled to enter into a Data Processing Agreement.
The Data Processing Agreement may address matters including:
Corporate Transition. Praxion is currently operated by its founder. The operator may establish or designate a legal entity to operate the Services in the future. Upon such transition, the relevant rights, obligations, contracts, assets, and data protection responsibilities relating to the Services may be transferred to the successor entity in accordance with applicable law. The successor entity will assume the applicable obligations relating to the Services.
The Data Processing Agreement may address matters including:
- Subject matter and duration of processing
- Nature and purpose of processing
- Categories of personal data
- Categories of data subjects
- Customer instructions
- Confidentiality
- Security measures
- Subprocessors
- International transfers
- Data subject rights
- Security incident notification
- Return or deletion of data
Corporate Transition. Praxion is currently operated by its founder. The operator may establish or designate a legal entity to operate the Services in the future. Upon such transition, the relevant rights, obligations, contracts, assets, and data protection responsibilities relating to the Services may be transferred to the successor entity in accordance with applicable law. The successor entity will assume the applicable obligations relating to the Services.
28. OUR PRIVACY PRINCIPLES
Praxion aims to operate the Services according to the following principles:
Data minimizationWe seek to collect and process only information reasonably necessary to provide and improve the Services.
Security by designSecurity considerations are incorporated into the design and operation of the Services.
TransparencyWe aim to explain clearly what categories of information are processed and why.
Customer controlBusiness customers remain responsible for their infrastructure and data environments.
Purpose limitationInformation should not be used for purposes incompatible with the reason it was collected.
Enterprise accountabilityWe recognize that customers may rely on Praxion within security-sensitive engineering and infrastructure environments.
This Privacy Policy does not limit rights granted under applicable law or contractual agreements between Praxion and its customers.