Privacy Policy

Last updated: October 15, 2026

1. Who we are and how to contact us

This page explains what STYD (Speak to Your Database) stores when you use the STYD website and app, who receives it, how long it is kept, and what you can do about it. STYD is operated by Imperium Villas Limited, a company registered in Hong Kong. Company No. 77875822. Registered office: Room 1301, 13/F., Prosper Commercial Building, 9 Yin Chong Street, Mong Kok, Kowloon, Hong Kong.

If you have questions about privacy, reach out at contact@speaktoyourdatabase.com.

2. What we store and why

We use this data only to run STYD for you: to sign you in and keep accounts secure, to connect to your data sources and answer your questions, to run the AI-app connections you approve, to manage your plan and payments, to send the emails the service needs or that you ask for, to answer support requests, and to see how our public pages are used. We do not sell your data.

• Account details. Your name, email address and language preference, and your sign-in sessions. If you sign in with Google, also your Google profile picture and the sign-in tokens Google returns.
• Workspace and members. The workspace name, its members and their roles, invitations (the invited email address), the rules owners and admins set (tables hidden from a member, links between members and Odoo users) and the workspace settings.
• Connection settings and credentials. The address and sign-in details of each database or Odoo connection. Credentials (database addresses with their passwords, Odoo tokens and Odoo API keys) are stored encrypted.
• Database layout and analysis. To understand your data, the analysis reads a limited sample of rows from each table. When a connection is analysed, STYD stores the names and types of its tables and columns, estimated row counts, descriptions (drafted by the analysis or written by you), the business terms and definitions you add, and, collected automatically, sample values and date ranges. Sample values are the most common values of columns that have few distinct values; for other columns, up to three example values, with email addresses and long numbers partly masked. Columns detected as email addresses, phone numbers or secrets keep no sample values. Date ranges are the earliest and latest dates found in each date column. For PostgreSQL and MySQL connections, STYD also keeps a database report: table names, row counts, the first and last date of each table, and a written summary of how the database is organised; the report itself holds no rows. It is deleted with the connection.
• Odoo. The list of Odoo models and fields you can use (no records). For connections through the STYD module for Odoo, also a copy of the Odoo users (login, name, email), groups and access rules, used to limit each member to their linked Odoo user's access rights (accounting, sales, purchase, inventory) and companies. For connections made with an Odoo API key, also the key's Odoo user: its user id, its login (Odoo 15 to 18), its companies and their names, and which accounting, sales, purchase and inventory rights its groups give it.
• Questions, answers and result rows. Every question, its answer and the result rows behind the answer are saved in the workspace's conversations, together with how the answer was calculated.
• Technical traces. For each question: the generated query, the first five result rows, a preview of the answer, the model used, its token count and cost, timings and errors.
• Feedback. When you rate an answer: your rating and comment, the question, the query, the answer and up to 50 of its result rows. A thumbs-up on a database answer also saves the question and answer as a search document, so that similar questions use the same tables.
• Checkup results. The results of business checkups, with their evidence, which can include record details such as invoice names, amounts and customer names.
• Billing records. Your plan, its status and period, payments and top-ups (amounts, dates, Stripe identifiers) and prompt usage. Card details are held by Stripe only.
• Website forms. When you send a request through the form on our home page or on our Odoo service pages, STYD stores what you entered (name, email, company, website, your interest, your data source and your message), the page you sent it from, and the date. Messages sent through the contact form on the support page are not saved in STYD's database: they reach us by email.
• Technical logs. Our web server and the STYD application keep technical logs to run the service securely and investigate errors: IP address, browser or app name, the address requested, date and time, the response status and error details. An address requested can include the token of a sign-in or invitation link. Logs are rotated daily; application logs are kept up to 30 days, web server logs up to 14 days.

3. Who receives data, and exactly what

• OpenAI (United States). OpenAI's models help STYD understand questions and write answers. To write an answer about a PostgreSQL or MySQL database, STYD sends OpenAI the question, the structure of the database and the rows needed for the answer. In detail, OpenAI receives the question, the earlier part of the same conversation, the database layout (table and column names and types), descriptions and business terms, stored sample values, and the result rows needed to write and check the answer. Result rows and sample values come from your own data, so they can include personal data it contains, such as names, email addresses or phone numbers. When a connection is analysed, OpenAI receives table and column names and types and a few example values, with long numbers partly masked, to draft descriptions. Columns STYD detects as personal data (email addresses, phone numbers) or secrets (passwords, tokens, keys, card and bank numbers) are sent without any value. For PostgreSQL and MySQL connections, after an analysis, STYD also sends the database name, table and column names and their types, short table descriptions (drafted by the analysis or written by you), size and activity bands (never exact numbers or row contents) and how tables connect, to write the database summary. OpenAI also turns some text into search vectors: questions, descriptions you write, and the question and answer of an answer you rate with a thumbs-up. For Odoo, answers are computed and written by STYD's own code from your Odoo records, and those records are not sent to OpenAI; OpenAI may receive the question (to understand questions that STYD's own rules do not cover, or questions in a language other than English or French) and, for those other languages, the wording of the answer to translate it, with numbers, dates, codes and the record names STYD recognises replaced by placeholders. How OpenAI handles data is described in OpenAI's privacy policy. If your data must not be processed by an outside AI provider, STYD can install a private assistant on your own server as a custom project: see Private AI on Your Own Server.
• Stripe (payments). STYD sends Stripe your workspace number, the plan, the billing cycle and the number of prompts bought. You enter your email address, name, billing address and card on Stripe's own payment page. Stripe tells STYD whether a payment succeeded.
• Resend (email delivery). Resend delivers the emails STYD sends: sign-in links, workspace invitations and membership changes, payment receipts, the welcome email of complimentary access, emails of the partner programme and the client portal, the confirmation of the Odoo project onboarding form, and the messages you send us through the support and application forms. It also delivers our internal notification of each new free trial to our team, which contains the account's email address, the workspace, the kind of database and its host.
• Google. If you choose to sign in with Google, Google confirms who you are and gives STYD your name, email address and profile picture. Google Analytics runs on our public pages only, never in the app: it receives the pages you visit and the technical details your browser sends with each visit.
• The AI app you connect. An AI app you connect to STYD (for example Claude or ChatGPT) receives what it asks STYD for on your behalf: your workspaces and data sources, descriptions of what can be asked, and the answers, which can include up to 50 rows of data each. Your questions and STYD's answers pass through that app's provider (Anthropic for Claude, OpenAI for ChatGPT) and are handled under that provider's own terms and privacy policy. See Use STYD from Claude.
• Contabo (hosting). Contabo hosts the server that runs STYD and its database (section 4), so the data described on this page is stored on Contabo's infrastructure.
• Google Drive (encrypted backup storage only). A daily copy of STYD's database backup is encrypted on our server before it is sent, then stored on Google Drive for 90 days. Google holds only the encrypted files.

4. Where your data is

Our server is hosted by Contabo in Singapore, and STYD's database runs on it. Your own databases and your Odoo stay where you host them: STYD connects to them to read.

STYD's database is backed up automatically every 4 hours on the same server; each backup carries a checksum and is kept 7 days. Once a day, a copy is encrypted and stored on Google Drive, where it is kept 90 days.

5. How long we keep it

• We keep workspace data (conversations, answers and result rows, analysis results, traces, feedback and checkups) until you ask us to delete it, with one exception: when a newer checkup of the same connection completes (on a Bridge connection, a newer checkup by the same person), older checkup results lose their record lists (customer names, document numbers); their totals remain.
• We keep account details until you ask us to delete the account.
• Technical logs are rotated daily; application logs are kept up to 30 days, web server logs up to 14 days.
• Database backups are kept 7 days on our server, and the daily encrypted copy on Google Drive 90 days. Deleted data can remain in encrypted backups until they expire, at most 90 days.
• AI-app connections end after 30 days without use, and after 90 days at most; expired AI-app tokens are removed automatically.
• Sign-in sessions end after 30 days without use, or when you sign out.
• Billing records are kept for accounting.

6. Your choices

• Deletion on request. Email us at contact@speaktoyourdatabase.com to delete a workspace or an account; we do it within 30 days. On request we delete your workspace data from STYD's database: its conversations, answers and result rows, traces, feedback, analysis data, checkups, connections with their credentials, API keys and members' access to it. Members' own accounts are not deleted with a workspace; each person can ask for their account to be deleted. Deleting an account removes the account, its sign-in records, memberships, AI-app connections and the conversations the person wrote. Billing records are kept for accounting. We keep an anonymous fingerprint showing that a database has already used its free trial. It contains no name, address or password. Deleted data can remain in encrypted backups until they expire, at most 90 days. What was already sent to the services in section 3 is handled under their own policies.
• In the app. Conversations cannot be deleted from the app today; ask us. You can disconnect an AI app at any time (section 7).
• Workspace owners and admins decide who is a member and with which role, which tables each member can see, and whether AI apps can be used in the workspace. Owners and admins can archive a connection: STYD hides it, erases its password, Odoo token or API key, and deletes its database report. Its address and login (without the secret), past answers, sample values, descriptions and business terms, linked Odoo users and checkup results stay until the workspace is deleted. To use it again, reconnect it.
• STYD only reads your data. Asking a question or running a checkup only runs read queries on your databases, each inside a read-only transaction, and only calls read methods in Odoo. STYD does not check what the database user you connect with is allowed to do, so connect with a user that can only read. Odoo may record STYD's sign-ins and reads in its own logs.

7. AI apps

• What is stored. When you connect an AI app such as Claude or ChatGPT, STYD stores the app's name as the app declares it, the address it returns to, when you approved it and when it was last used, and its access tokens, as hashes only. Questions you ask through the app are saved in your STYD conversations, marked with the app's name.
• Who can see it. Workspace owners and admins see which members connected an AI app: the member's name and email address, the app's name, the address it returns to, and when it was connected and last used in their workspace.
• How to disconnect. In STYD: Settings → AI apps → Your connected apps → Disconnect. The app loses access immediately and its tokens are deleted; the record that it was connected is kept, marked as disconnected. You can also remove the connector in the app itself. Owners and admins can turn AI apps off for a whole workspace.

8. Cookies and analytics

STYD sets the cookies the site needs: the sign-in cookie, which keeps you signed in and expires after 30 days without use or when you sign out; short-lived cookies used while you sign in and while you approve an AI app; in the app, a cookie that remembers the workspace you last opened, for 30 days; a cookie that remembers a partner's referral link for 60 days, when you arrive through one; and cookies for the public demo's session.

Google Analytics runs on our public pages only, never in the app, and sets its own cookies there.

9. Security

• Connection credentials are stored encrypted (AES-256-GCM).
• STYD API keys and AI-app tokens are stored only as hashes.
• Customer accounts have no STYD password: you sign in with a link sent to your email address, or with Google. The few accounts we create for app-directory reviewers sign in with a password, stored only as a salted hash.
• Questions only read: database questions run inside a read-only transaction, STYD only calls read methods in Odoo, and requests to change data are refused.
• Each member sees only the workspaces they belong to, with their role. On an Odoo connection through the STYD Bridge, each member is linked to an Odoo user, and STYD limits their answers to that user's access rights (accounting, sales, purchase, inventory) and companies; Odoo's record rules are not reproduced. On an Odoo connection made with an API key, every member sees what the key's Odoo user may read. Checkup results follow the same rule: on an API-key connection they are shared with the workspace; on a Bridge connection only the person who ran the checkup sees them. On a database, tables an owner or admin has hidden from a member are left out of that member's answers.
• Answers hide values that STYD recognises as passwords, tokens, keys, or card and bank numbers. Names, email addresses and phone numbers are not hidden.
• People at STYD who run the server can read the data stored in STYD's database. When reviewing rated answers, STYD's platform admins see the full answer and its result rows.

10. Changes to this page

When what STYD stores or shares changes, we update this page and the date at the top.