Privacy Policy

1. Introduction

Waltail is a hosted Postgres change data capture service operated by Appsjet Solutions LLP (“we”, “our”, or “us”). This policy explains what information we handle when you visit waltail.com or use Waltail, why we handle it, and what rights you have over it.

For our other products and the Appsjet Solutions website, see the Appsjet Solutions privacy policy.

2. Our Two Roles

Waltail handles two very different kinds of data, and our responsibilities differ for each:

• Your account data — the details of you and your organization. We decide how this is handled, so we are the controller for it.
• The row changes your pipelines carry — the contents of your database. You decide what Waltail captures and where it is delivered, so you are the controller and we act as your processor, handling that data only to run the pipelines you configure.

3. Information We Collect

• Account information — your email address, your name if you provide one, your organization's name, and your role in it. Sign-in is passwordless, so we never hold a password for you.
• Pipeline configuration — the connection details for your source database, the destinations you deliver to and their credentials, and the tables you select.
• Operational data — delivery attempts, error messages returned by your destinations, bytes delivered for billing, and replication lag.
• Product usage — which pages and features are used, and when. See section 6.
• Communications — emails and support correspondence you exchange with us.

4. Data Your Pipelines Carry

When a pipeline is running, Waltail reads the changes you selected from your database's replication stream, stores each change so it can be delivered and retried, and delivers it to the destinations you configured. Those rows may contain personal data — that is entirely determined by the tables you choose.

• We capture only the tables you select, and only from the moment a pipeline starts. Waltail does not read your database's history.
• Captured changes are retained for 30 days so that delivery, retries and replay can work, then deleted automatically. Deleting a pipeline removes its queued changes.
• We do not inspect, mine, sell, or use the contents of your rows for any purpose other than delivering them, diagnosing a delivery failure you have asked us to look into, or where the law requires it.
• You are responsible for having a lawful basis for the data you stream through Waltail, and for informing the people it concerns.

5. How We Use Your Information

• Provide, operate and maintain Waltail.
• Authenticate you and keep your account secure.
• Measure egress and bill your subscription.
• Respond to enquiries and provide support.
• Diagnose failures and improve reliability and usability.
• Send occasional product updates, only where you have consented.
• Comply with legal obligations and enforce our agreements.

6. Cookies and Analytics

We use Amplitude, hosted in the European Union, to understand how Waltail is used. It runs cookieless everywhere, signed in or not:

• Nothing is stored on your device — no cookies, no local storage, no session storage. The identifier analytics uses lives in the page's memory and is gone when you close the tab. Because nothing is stored on your device, no consent banner is required.
• Signed in to the console — events are labelled with your account and organization, which is how we diagnose problems you report and understand which features are used. That label comes from your signed-in session, not from anything stored in your browser.
• Signing out drops the label, and analytics is anonymous again.

We do not use advertising cookies or share analytics data with advertising networks. Session recording is switched off across Waltail: your connection strings, API keys and row payloads are never captured in a recording. Signing in does require a session cookie, which is strictly necessary to keep you signed in.

7. Sharing of Information

We do not sell, rent or trade your personal information. We share it only with the service providers that make Waltail work, each under confidentiality obligations, and where the law requires it:

• Railway — hosting for the Waltail service and its control database.
• Amplitude — product analytics, on their European Union infrastructure.
• Amazon SES — delivery of sign-in codes and account email.
• Dodo Payments — subscription billing and payment processing. Card details are handled by them and never reach our systems.

The destinations your pipelines deliver to — your Kafka cluster, your S3 bucket, your webhook endpoint — are chosen and controlled by you, not by us, and are not our sub-processors.

8. Data Security

We implement reasonable technical and organisational measures to protect the information we hold. All traffic between your browser, Waltail, your database and your destinations is encrypted in transit with TLS, and access to production systems is restricted to the people who need it. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

If you believe you have found a security issue, please report it to [email protected] rather than disclosing it publicly.

9. Data Retention

Captured row changes are retained for 30 days, as described in section 4. Account and organization records are kept for as long as your account is open, and deleted or anonymised within a reasonable period after you close it, except where we are required to keep billing records for tax and accounting purposes. Product analytics events are retained according to our Amplitude project's retention settings.

10. Your Rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Request deletion of your personal information.
• Request a copy of your data in a portable format.
• Object to or restrict certain processing.
• Withdraw consent to marketing communications at any time.

To exercise any of these, contact us at [email protected]. If you are asking about data inside one of your pipelines, note that you are its controller — we will act on your instructions in respect of it.

11. International Transfers

Appsjet Solutions LLP is based in India. Your information may therefore be handled outside the country you live in, including by the providers listed in section 7. Where personal data is transferred out of the European Economic Area or the United Kingdom, we rely on appropriate safeguards, such as the European Commission's standard contractual clauses.

12. Third-Party Links

Waltail may link to third-party websites. We are not responsible for their privacy practices or content, and we encourage you to review their policies.

13. Changes to This Policy

We may update this policy from time to time. Any changes will be posted on this page with a revised “Last updated” date, and material changes will be notified to account holders by email. Continued use of Waltail after changes constitutes acceptance of the updated policy.

14. Contact Us

For questions about this policy or how we handle your data, contact Appsjet Solutions LLP at [email protected]. Our Terms & Conditions and Refund / Cancellation Policy govern the rest of your relationship with us.