DBGorilla Privacy Policy

Effective date: August 4, 2026 · Last updated: August 4, 2026

1. Introduction and Scope

This Privacy Policy explains how Furious Engineering Corp. d/b/a DBGorilla (“Company,” “DBGorilla,” “we,” “our,” or “us”) collects, uses, discloses, and protects personal information.

It applies to our marketing website (dbgorilla.com), our hosted AI database assistant and platform, and related tools, integrations, local components (such as the customer telemetry collector), CLI, MCP server, APIs, and support services (together, the “Services”).

Our Services are designed for business and technical use by developers, database administrators, and engineering teams. DBGorilla is a B2B product, but the rights described here also apply to individual visitors and users in the European Union / EEA and United Kingdom, U.S. states with privacy laws, and Canada. This Policy is referenced by, and supplements, our Terms of Service.

This Privacy Policy does not apply to the data you manage, store, or process within your own databases and infrastructure, defined in our Terms of Service as “Your Content.” Handling of Your Content is governed by the Terms of Service and, where applicable, a separately executed Data Processing Addendum (“DPA”), which control to the extent of any conflict with this Policy. Customers with a separately negotiated written agreement may be subject to additional or different data-processing terms set out in that agreement.

2. Who We Are and How to Contact Us

Furious Engineering Corp. d/b/a DBGorilla Attention: Legal Department 3005 Lamar Blvd, STE D‑109 #314, Austin, Texas 78704, USA

• Privacy inquiries: legal@dbgorilla.com
• General / legal: legal@dbgorilla.com
• Support: support@dbgorilla.com

3. Personal Information We Collect

We collect only the information necessary to operate, secure, and support the Services, in three contexts:

a. Website visitors. IP address, device and browser characteristics, cookie and similar identifiers, pages viewed, referring URL, timestamps, approximate (coarse) location, and events from analytics, marketing, and sales‑intelligence technologies such as Google Analytics, Google Tag Manager, Microsoft Clarity, PostHog, HubSpot, Apollo, and the LinkedIn Insight Tag (see Section 6). Some of these technologies capture how you interact with pages (including session replay and heatmaps), and some may identify or enrich business‑contact information about site visitors.

b. Product users. Account and profile information (name, email address, company name, role, and where provided, phone number and billing address); authentication identifiers and settings (including password hashes, SSO/identity‑provider data, and multi‑factor settings); billing information (processed by our payment processor; we do not store full card numbers); product usage, logs, and telemetry; and support and feedback communications.

c. Environment and usage metadata from connected systems. To provide the Services you may connect databases, clusters, cloud accounts, repositories, and CI/CD systems. We are designed to work with metadata about your environment, schema structures, table relationships and index information, query patterns, query text and structure, execution plans and performance metrics, system and resource metrics, configuration data, cluster topology, CI/CD and repository metadata, and error messages and diagnostic logs, not the underlying values stored in your database tables unless you explicitly enable a feature that requires broader access. We do not intend or want to collect personally identifiable information (PII) from your databases, and you are responsible for configuring the Services to avoid sending restricted or sensitive data (see the Terms of Service). For most deployments, telemetry is pushed to us by a customer‑controlled collector; we do not require or store your database credentials for standard monitoring. This data forms part of “Your Content” and is governed as described in Section 1.

4. How We Collect Personal Information

• Directly from you: account signup, purchases, support requests, and in‑product feedback.

• Automatically: cookies, pixels/tags, local storage, server logs, product telemetry, analytics, and advertising technologies including the LinkedIn Insight Tag (Section 6).

• From your organization and partners: SSO/identity providers, and integrations you enable (cloud providers, repositories, CI/CD, monitoring).

5. Purposes and Legal Bases for Processing

Where the law requires a legal basis (EU/UK) or identified purposes (PIPEDA), we rely on:

Purpose

Legal basis (EU/UK)

Providing, operating, and supporting the Services

Performance of a contract

Securing the Services, preventing fraud and abuse

Legitimate interests; legal obligation

Product analytics and improvement

Legitimate interests; consent where required

Marketing and advertising, including LinkedIn Ads and retargeting

Consent (EU/UK/where required); legitimate interests / opt‑out (US)

Legal, compliance, and record‑keeping

Legal obligation; legitimate interests

6. Cookies and Similar Technologies

We use cookies and similar technologies (pixels, tags, beacons, and local storage) on our website and in our product. Some are set by us (first‑party) and some by third parties such as analytics and advertising partners.

6.1 Types of cookies we use

• Strictly necessary: authentication, security, and core functionality (first‑party; cannot be turned off).

• Analytics / performance: understanding how the site and product are used, including Google Analytics, Google Tag Manager, Microsoft Clarity, PostHog, and HubSpot. Some of these tools (notably Microsoft Clarity and PostHog) also provide session replay and heatmaps, which record interactions such as mouse movement, clicks, scrolling, and page navigation to help us diagnose issues and improve usability.

• Functional: remembering preferences; includes HubSpot forms and chat.

• Marketing, sales‑intelligence, and advertising: measuring and delivering advertising, identifying and building audiences from site visitors, and retargeting, including the LinkedIn Insight Tag, HubSpot, Apollo, and Google advertising technologies (including Google Ads conversion tracking).

These include both first‑party and third‑party technologies, and the list may change as our tools change.

6.2 Our consent banner and how to manage cookies

We operate a cookie consent banner and preference center. Because consent requirements differ by region, it works differently depending on where you are:

• European Union, EEA, United Kingdom, and Switzerland: non‑essential analytics and advertising technologies are not loaded until you consent. The banner is presented on your first visit, and you may accept, reject, or change your choices at any time.
• United States: consistent with U.S. state privacy laws, which are opt‑out rather than opt‑in regimes, analytics and advertising technologies are enabled by default. You may opt out at any time using the mechanisms below, and we honor opt‑out signals as described in Section 7.

You can also manage cookies and similar technologies at any time through:

• your browser settings (blocking or deleting cookies and clearing local storage);
• Global Privacy Control (GPC): where your browser or extension sends a GPC signal, we treat it as an opt‑out of “sale,” “sharing,” and targeted advertising (see Section 7);
• LinkedIn’s own ad and data settings, to control how LinkedIn uses data collected by the Insight Tag;
• applicable industry opt‑out tools, such as the NAI and DAA “YourAdChoices” programs; and
• for U.S. residents, the choices described in Section 7 (“Do Not Sell or Share”).

6.3 LinkedIn Insight Tag and advertising

We use the LinkedIn Insight Tag, a tracking technology provided by LinkedIn Corporation (and, for EU/UK visitors, LinkedIn Ireland Unlimited Company). It collects information about visits to our website, including pages viewed, actions taken (such as form submissions), conversions, URL and referrer, IP address, device and browser characteristics, and timestamps.

This data is transmitted to LinkedIn and used to measure the effectiveness of our LinkedIn advertising, understand the aggregated professional profile of our visitors (LinkedIn Website Demographics), and build audiences for retargeting and ad optimization. If you are logged into LinkedIn while visiting our site, LinkedIn may associate the visit with your LinkedIn account and use that data for its own advertising and analytics as an independent controller.

For visitors in the European Union, EEA, and United Kingdom, applicable law generally requires your prior consent before a non‑essential advertising technology like the Insight Tag is set. The cookie consent banner described in Section 6.2 is how we obtain and record that consent; where you have not consented, non‑essential advertising and analytics technologies are not loaded.

7. “Do Not Sell or Share” and Targeted Advertising (US State Laws)

Certain tracking technologies on our site (including the LinkedIn Insight Tag) may be considered “sharing” or “targeted advertising” / “sale” under some U.S. state privacy laws because they enable cross‑context behavioral advertising.

Residents of those states may opt out of this “sharing,” “sale,” or targeted advertising. You can do so by:

• enabling Global Privacy Control (GPC) in a supporting browser or extension, since we detect and honor GPC signals as a valid opt‑out request, without requiring you to submit anything further;
• using the browser, LinkedIn, and industry opt‑out tools described in Section 6;
• adjusting your choices in our cookie consent banner and preference center; or
• emailing legal@dbgorilla.com with your request.

We do not discriminate against you for exercising these rights.

8. How We Use Personal Information

We use personal information to: provide, operate, maintain, secure, and support the Services; generate Output (recommendations, query optimizations, schema visualizations, health checks, migration‑safety analysis, and related insights) as described in our Terms of Service; process payments and manage subscriptions and Gorilla Credits; communicate about your account, billing, security, and product updates; analyze and improve the Services; deliver and measure marketing and advertising; detect, investigate, and prevent fraud, abuse, and security incidents; and comply with law and enforce our Terms. We do not sell or rent your personal information.

9. AI and Machine Learning Features

DBGorilla’s Services include AI‑powered features that analyze environment metadata, query patterns, and related diagnostic information in order to generate Output.

9.1 Data processed for AI features

AI features may process query text and structure, schema information, performance metrics, and error messages and diagnostic logs.

9.2 Limitations on AI processing

• We do not use the actual data values stored in your database tables for AI processing unless you explicitly enable a feature that requires it.

• We do not use your Input or Output to train foundation models on behalf of other customers.

• Processing is limited to pattern analysis reasonably necessary to generate the Output you request.

9.3 Model‑training exclusions

We do not use any of the following for model training: actual data values from your databases; personal information; sensitive business data; customer credentials, API keys, or access tokens; or proprietary or confidential business information.

9.4 AI data retention

• Processing data used to generate Output is retained for up to 30 days for troubleshooting and quality purposes, unless a longer period is required by law or a different retention term applies to your plan.

• Aggregated, de‑identified usage patterns may be retained for up to 90 days to improve reliability and performance.

• You may disable optional AI features where available in your plan; disabling a feature does not affect previously generated Output.

10. How We Share Personal Information

• Service providers / processors: hosting, infrastructure, observability/analytics, email and communications, payment processing, and support tools, acting on our instructions and bound by contractual obligations to protect your information.

• Advertising, analytics, and marketing partners (subprocessors): including Google (Google Analytics, Google Tag Manager, and Google Ads conversion tracking), Microsoft (Microsoft Clarity: product analytics, session replay, and heatmaps), PostHog (product analytics and session replay), HubSpot (CRM and marketing automation), Apollo (sales intelligence and website‑visitor identification), and LinkedIn Marketing (LinkedIn Insight Tag; an independent controller for its advertising platform; see Section 6.3). These partners may receive online identifiers, device/usage data, and, for HubSpot/Apollo, business‑contact information.

• Legal and safety: to comply with law, respond to lawful requests, and protect the rights, safety, and integrity of the Services.

• Corporate transactions: in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to standard confidentiality protections.

• With your direction: where you direct us to share information with a specific third‑party integration or service you connect to the Services.

We do not sell your connected database contents. We may use aggregated or de‑identified data that does not identify you or any individual.

11. International Data Transfers

We operate the Services using infrastructure and vendors primarily based in the United States, and may process data in the United States and other jurisdictions where our providers operate. Certain subprocessors, including Google and LinkedIn, operate global infrastructure, and their processing occurs under their own terms and safeguards. Where we transfer personal information across borders, we use appropriate safeguards required by applicable law, such as Standard Contractual Clauses, and we apply consistent protections regardless of where information is processed.

12. Data Retention

We retain personal information only as long as necessary for the purposes described here, to comply with legal obligations, resolve disputes, and enforce our agreements.

• Product data (agent observation history, telemetry, investigation transcripts, metadata, logs, outputs, clone records) follows your plan’s retention window, currently Free: 7 days; Pro: 30 days; Business: 180 days; Enterprise: as set out in your agreement. See your plan details or the pricing page for current terms.
• AI processing data: as described in Section 9.4 (up to 30 days; 90 days for aggregated, de‑identified patterns).
• Account and billing records: for the life of your account and as required for legal, tax, and audit purposes.
• Cancelled accounts: personal information associated with a cancelled account is retained for up to 90 days after cancellation, then deleted or de‑identified except where a longer period is required by law.
• Security and audit logs: a minimum of 12 months.
• Backups: on a rolling basis (approximately 30–90 days) before deletion in the ordinary course.
• Marketing and advertising data: retained per our and our partners’ settings until you opt out or it is no longer needed.

Your databases themselves are not stored by us as full database copies.

13. Data Security

We apply administrative, technical, and physical safeguards, including encryption in transit (and at rest where appropriate), role‑based access controls, least‑privilege access, multi‑factor authentication for privileged access, access logging, network segmentation, data segregation between customer environments, and periodic security review and testing.

No method of transmission or storage is 100% secure, but we take reasonable steps to protect your information. In the event of a security breach affecting your personal information, we will notify affected customers without undue delay and in accordance with applicable law.

14. Your Privacy Rights

You may exercise the rights below by contacting us at legal@dbgorilla.com or through in‑product settings. We may need to verify your identity before acting, and some requests may be subject to legal or contractual exceptions (for example, information we must retain for tax, accounting, or legal‑compliance purposes).

14.1 EU/UK residents

Access, rectification, erasure, restriction, data portability, objection, and the right to withdraw consent. You may also lodge a complaint with your supervisory authority.

14.2 U.S. residents (including CCPA/CPRA and similar state laws)

The rights to know, access, delete, and correct personal information; to opt out of “sale,” “sharing,” and targeted advertising; and to not be discriminated against for exercising your rights. To opt out of advertising‑related “sale” or “sharing,” use the mechanisms in Sections 6 and 7, including Global Privacy Control (GPC), which we honor as a valid opt‑out, our cookie consent banner and preference center, or a request to legal@dbgorilla.com.

14.3 Canadian residents (PIPEDA)

The rights to access your personal information, challenge its accuracy, and withdraw consent (including for secondary purposes such as behavioral advertising). Opt‑outs for behavioral advertising take effect promptly. You may complain to the Office of the Privacy Commissioner of Canada.

15. Children’s Privacy

The Services are intended for businesses and professional use and are not directed to individuals under the age of 18. We do not knowingly collect personal information from children; if we learn we have, we will delete it promptly or handle it as required by law.

16. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, or the Services. For material changes we will use reasonable efforts to notify you (for example, by updating the “Last updated” date, posting a notice, or emailing you). Your continued use of the Services after an update takes effect constitutes acceptance of the updated Policy.

17. Contact and Complaints

Questions or complaints about this Policy or our data practices:

Furious Engineering Corp. d/b/a DBGorilla Attention: Legal Department 3005 Lamar Blvd, STE D‑109 #314, Austin, Texas 78704, USA legal@dbgorilla.com

EU/UK, U.S., and Canadian residents may also contact their applicable data protection authority.