Privacy Policy

1. Introduction

Waltail is a hosted Postgres change data capture service operated by Appsjet Solutions LLP (“we”, “our”, or “us”). This policy explains what information we handle when you visit waltail.com or use Waltail, why we handle it, and what rights you have over it.

For our other products and the Appsjet Solutions website, see the Appsjet Solutions privacy policy.

2. Our Two Roles

Waltail handles two very different kinds of data, and our responsibilities differ for each:

• Your account data — the details of you and your organization. We decide how this is handled, so we are the controller for it.
• The row changes your pipelines carry — the contents of your database. You decide what Waltail captures and where it is delivered, so you are the controller and we act as your processor, handling that data only to run the pipelines you configure.

3. Information We Collect

• Account information — your email address, your name if you provide one, your organization's name, and your role in it. Sign-in is passwordless, so we never hold a password for you.
• Pipeline configuration — the connection details for your source database, the destinations you deliver to and their credentials, and the tables you select.
• Operational data — delivery attempts, error messages returned by your destinations, bytes delivered for billing, and replication lag.
• Product usage — which pages and features are used, and when, together with your approximate location. See section 6.
• Communications — emails and support correspondence you exchange with us.

4. Data Your Pipelines Carry

When a pipeline is running, Waltail reads the changes you selected from your database's replication stream, stores each change so it can be delivered and retried, and delivers it to the destinations you configured. Those rows may contain personal data — that is entirely determined by the tables you choose.

• We capture only the tables you select, and only from the moment a pipeline starts. Waltail does not read your database's history.
• Captured changes are retained for 30 days so that delivery, retries and replay can work, then deleted automatically. Deleting a pipeline removes its queued changes.
• We do not inspect, mine, sell, or use the contents of your rows for any purpose other than delivering them, diagnosing a delivery failure you have asked us to look into, or where the law requires it.
• You are responsible for having a lawful basis for the data you stream through Waltail, and for informing the people it concerns.

5. How We Use Your Information

• Provide, operate and maintain Waltail.
• Authenticate you and keep your account secure.
• Measure egress and bill your subscription.
• Respond to enquiries and provide support.
• Diagnose failures and improve reliability and usability.
• Send occasional product updates, only where you have consented.
• Comply with legal obligations and enforce our agreements.

6. Cookies and Analytics

We use Mixpanel, a product analytics service, to understand how Waltail is used. Mixpanel is a third-party provider and acts as our processor: it receives the events described below and processes them on our instructions, on its European Union infrastructure. It runs without cookies, signed in or not:

• No cookies — analytics sets no cookies and sends nothing to advertising or tracking networks. What it keeps on your device are two random identifiers in your browser's local storage, so that a returning browser is counted as one visitor rather than a new one on every visit. They contain nothing about you, identify only the browser installation, and you can remove them at any time by clearing site data.
• Approximate location — your IP address is sent with each event and used to work out the country, region and city it came from, so we can see where Waltail is being used. Location is never resolved more precisely than a city.
• Signed in to the console — events are labelled with your account and organization, which is how we diagnose problems you report and understand which features are used. That label comes from your signed-in session, not from anything stored in your browser.
• Signing out drops the label, and analytics is anonymous again.

We never share analytics data with advertising networks. Session recording and automatic click tracking are switched off everywhere in Waltail: every event is one we send deliberately, so your connection strings, API keys and row payloads are never captured. Signing in does require a session cookie, which is strictly necessary to keep you signed in.

Separately from analytics, we use Google Ads on this website (waltail.com) to measure how many people sign up for Waltail after seeing or clicking one of our ads. When these cookies are allowed, Google receives the pages you visit on this site, your IP address, and the ad you arrived from, and may use that information to personalise the ads you are shown elsewhere. Google processes this data in the United States. It is not used in the Waltail console, and it receives none of the pipeline or account data described above.

If you are in the European Economic Area, the United Kingdom, or Switzerland, these cookies are switched off until you accept them. You will be asked when you first visit, and you can change your answer at any time using the “Cookie settings” link in the footer of any page. If you reject, Google still receives a record that a visit happened, but without cookies or identifiers that single you out. You can also control or disable cookies through your browser settings.

7. Sharing of Information

We do not sell, rent or trade your personal information. We share it only with the service providers that make Waltail work, each under confidentiality obligations, and where the law requires it:

• Infrastructure and hosting — the providers that run the Waltail service and its control database.
• Transactional email — the provider that delivers sign-in codes and account email.
• Payment processing — Dodo Payments handles subscription billing. Card details are entered with them directly and never reach our systems.
• Product analytics — Mixpanel receives the usage events described in section 6, so we can see which features are used and where people get stuck.
• Advertising measurement — Google, on this website only, through Google Ads, so we can tell which ads lead to sign-ups. See section 6 for what it receives and how to control it.

A current list of the sub-processors that handle the data your pipelines carry is available on request at [email protected].

The destinations your pipelines deliver to — your Kafka cluster, your S3 bucket, your webhook endpoint — are chosen and controlled by you, not by us, and are not our sub-processors.

8. Data Security

We implement reasonable technical and organisational measures to protect the information we hold. All traffic between your browser, Waltail, your database and your destinations is encrypted in transit with TLS, and access to production systems is restricted to the people who need it. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

If you believe you have found a security issue, please report it to [email protected] rather than disclosing it publicly.

9. Data Retention

Captured row changes are retained for 30 days, as described in section 4. Account and organization records are kept for as long as your account is open, and deleted or anonymised within a reasonable period after you close it, except where we are required to keep billing records for tax and accounting purposes. Product analytics events are retained on our self-hosted analytics instance according to its retention settings.

10. Your Rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Request deletion of your personal information.
• Request a copy of your data in a portable format.
• Object to or restrict certain processing.
• Withdraw consent to marketing communications at any time.

To exercise any of these, contact us at [email protected]. If you are asking about data inside one of your pipelines, note that you are its controller — we will act on your instructions in respect of it.

11. International Transfers

Appsjet Solutions LLP is based in India. Your information may therefore be handled outside the country you live in, including by the providers described in section 7. Where personal data is transferred out of the European Economic Area or the United Kingdom, we rely on appropriate safeguards, such as the European Commission's standard contractual clauses.

12. Third-Party Links

Waltail may link to third-party websites. We are not responsible for their privacy practices or content, and we encourage you to review their policies.

13. Changes to This Policy

We may update this policy from time to time. Any changes will be posted on this page with a revised “Last updated” date, and material changes will be notified to account holders by email. Continued use of Waltail after changes constitutes acceptance of the updated policy.

14. Contact Us

For questions about this policy or how we handle your data, contact Appsjet Solutions LLP at [email protected]. Our Terms & Conditions and Refund / Cancellation Policy govern the rest of your relationship with us.