ViewDB uses Google Analytics cookies to count visits and see which pages help. They are set only if you accept. Privacy policy

Start 3 days free
Last updated: November 1, 2026

Privacy policy

This policy explains what personal data ViewDB Studio collects, why, who else processes it, and how you can see, change or delete it. It follows the Brazilian LGPD (Law 13,709/2018) and, for people in Europe, the GDPR.

01Who is responsible

The controller of your data is DANIEL SANTOS GONCALVES TECNOLOGIA DA INFORMACAO LTDA, CNPJ 56.431.597/0001-83, based in Curitiba, Paraná, Brazil.

For anything about your data, including the data protection officer (encarregado), write to contato@viewdb.app.

02What we collect

We only collect what we need to run ViewDB:

  • Account: name, email, password (stored only as a hash), language, and the name and photo from GitHub or Google when you sign in with them.
  • Projects: project names, DBML, diagram layout, saved versions, share settings and the emails you invite.
  • Sessions: IP address, browser and device, and session dates, so you can see where you are signed in and we can protect your account.
  • Billing: plan, subscription status and the Stripe customer ID. At checkout, Stripe asks for your name, billing address and, on plans in reais, your CPF or CNPJ, which we use to issue the service invoice (NFS-e). Card details are entered on Stripe's pages and never reach our servers.
  • AI assistant: your message and the current DBML pass through our server to the AI provider. We do not keep the conversation; we keep a count of messages per day for the monthly limit.
  • Your own AI keys, encrypted with AES-256-GCM, and your personal agent keys, stored as a hash.
  • Server logs: IP address, page and time of each request, used for security and to fix errors.
  • Usage analytics, only if you accept the cookie banner: pages you visit, approximate location, device and browser, and conversions such as signing up, collected by Google Analytics under a random ID. Never the editor, the content of your projects or share links.

03Why we use it

Each use has a legal basis in LGPD article 7 and GDPR article 6:

  • To run your account, projects, sharing, the assistant and the agents: performance of the contract.
  • To keep accounts secure, prevent abuse and apply rate limits: legitimate interest.
  • To bill you and keep tax records: legal obligation and performance of the contract.
  • To send emails about your account, such as verification and password resets, and the share invitations you send: performance of the contract.
  • To measure which pages help people find and use ViewDB (Google Analytics): your consent, which you can withdraw at any time in Cookie preferences, at the bottom of the public and sign-in pages.

04Who processes it with us

We do not sell your data. These providers process it for us, each only for its part:

  • Hostinger: the server that runs ViewDB and its database, in São Paulo, Brazil.
  • Stripe: payments and subscriptions (United States).
  • Resend: account emails and share invitations (United States).
  • Google: the Gemini model of the assistant on our key, sign-in with Google, and Google Analytics, only with your consent (United States).
  • GitHub: sign-in with GitHub (United States).
  • OpenAI or Anthropic: only if you add your own key from them (United States).

05International transfers

Your projects and account live on our server in Brazil. Stripe, Resend, Google, GitHub, OpenAI and Anthropic process data in the United States and other countries. These transfers rely on the safeguards of LGPD article 33, such as the providers' standard contractual clauses, and on being needed to carry out the contract with you.

06How long we keep it

We keep your data while your account exists. Deleting the account deletes your projects, versions, share links, keys and sessions, and cancels your subscription in Stripe.

Google Analytics keeps usage data for 14 months, then deletes it.

Billing records stay for the period tax law requires, in general 5 years. Database backups are kept for a limited time, and deleted data leaves them as they are replaced.

07Cookies

ViewDB has no advertising cookies. Analytics cookies are set only after you accept them in the banner; the rest is what the app needs to work:

  • Session cookie: keeps you signed in, for up to 30 days.
  • locale: remembers your language, for 1 year.
  • Share link cookie: remembers that you entered the password of a protected link, for 30 days, only on that link.
  • Theme: your light or dark choice, saved in your browser's local storage.
  • analytics_consent: remembers whether you accepted or rejected analytics, for 1 year.
  • _ga and _ga_<ID> (Google Analytics, only if you accept): tell visits apart with a random ID, for up to 2 years. Rejecting later in Cookie preferences deletes them.

08Security

Traffic uses HTTPS. Passwords and share link passwords are stored as hashes, your AI keys are encrypted, and every request checks that the data belongs to you or was shared with you.

If an incident may put you at relevant risk, we tell you and the ANPD, as LGPD article 48 requires.

09Your rights

You can ask us to confirm that we process your data, give you access to it, correct it, anonymize, block or delete data that is not needed, port it, tell you who we share it with, and object to a use. Under the GDPR you can also ask to restrict processing.

Many of these you can do yourself: edit your profile in Account, export projects as DBML or .viewdb, and delete your account. For the rest, write to contato@viewdb.app and we reply within 15 days.

You can also complain to the ANPD (gov.br/anpd) or, in Europe, to your local data protection authority.

10Children

ViewDB is for people 18 and older. We do not knowingly collect data from children or teenagers, and we delete it if we find out.

11Changes to this policy

When we change this policy, we update the date at the top and email you about important changes before they take effect.