Privacy Policy

This Privacy Policy explains what information DataMeans handles, why, how long we keep it, and the choices you have.

1. Overview

This Privacy Policy explains how DataMeans ("DataMeans," "we," "us," or "our") handles information in connection with the DataMeans service at datameans.com (the "Service").

The short version: DataMeans is a tool that extracts data from legacy database files and converts it to modern formats. We take your uploaded file, process it, give you the converted output to download, and then delete both on a set schedule. We do not build profiles, sell data, or use your files to train machine-learning models. We hold your data only as long as needed to provide the Service to you.

This Policy is incorporated into our Terms of Service.

2. Two Kinds of Information

It helps to separate two very different things:

2.1 The contents of your uploaded files ("Customer Data"). When you upload a legacy database, that file, and the converted output we generate from it, may contain personal information about other people (for example, customer or employee records stored in the original database). With respect to that information, you are the controller and we act as a processor on your behalf. We only access, process, and store Customer Data to provide the conversion service you requested. We do not analyze it for our own purposes, and we do not retain it beyond the windows described in Section 5.

2.2 Information about you, the user ("Account/Usage Information"). Separately, we handle limited information about the person using the Service, for example an email address you provide to receive download links, payment details handled by our payment processor, and basic technical and security logs. We act as the controller of this information.

3. What We Collect

Customer Data (your uploaded files and their outputs):

• The database files you upload
• The converted output (CSV, SQL, Excel, JSON, etc.) generated from them
• Schema metadata derived during processing (table names, column names, record counts)

Account/Usage Information:

• Email address: only if you provide one. It is required to deliver download links for any conversion, free or paid (so we can email and re-send them), and is not required for the in-browser preview. It is stored with your job record so download links can be recovered.
• Payment information: processed by Stripe. We do not store full card numbers; we keep a Stripe reference (checkout ID) tied to your job. See Section 6.
• Job identifiers and access tokens: the unique link and token that control access to a job and its outputs.
• Security and rate-limiting data: to prevent abuse, we record a SHA-256 hash of the uploading IP address (for per-IP upload limits) and a SHA-256 hash of the email address used for link re-sends and free-tier usage limits (for per-email limits). These are one-way hashes, not the raw values, and are kept only for short rate-limit windows.
• Contact-form messages: if you send us a message through the contact form, we store what you submit (your name, email address, the topic, the subject, and the message body) so we have a durable record of your request, can route it to the right team, and can follow up, including if our email system is temporarily unavailable when you submit. We also record a SHA-256 hash of your IP for the form's rate limiting.
• Launch-notification signups: if you ask to be notified when paid exports open (the "notify me" form shown while checkout is paused), we store the email address you provide, together with which page you signed up from and, where applicable, the job it relates to, solely so we can send you that notification. We also record a SHA-256 hash of your IP for the form's rate limiting.
• Technical and error logs: when an error occurs, our error-monitoring provider (Sentry) may record technical details such as the error, browser/runtime type, and timestamps to help us debug. Error monitoring only; we do not run performance tracing or session replay.
• Site usage analytics: we use Vercel Web Analytics, a privacy-friendly, cookieless analytics service, to count page views and key product events (for example, that a conversion was started or an export was downloaded). It does not use cookies, does not track you across sites, and does not build advertising profiles; the data is aggregated and is not used to identify you.

We do not require you to create a traditional account. Access to a job and its outputs is controlled by a unique job link and token.

4. How and Why We Process Information

We process information to:

• Detect, parse, convert, and package your uploaded files into the output you requested
• Deliver download links and, for paid exports, send email notifications
• Process payments for paid tiers
• Receive, route, store, and respond to messages you send us through the contact form
• Send you a one-time launch notification if you signed up for one while checkout was paused
• Maintain security, prevent abuse (including bot and rate-limit protection), debug errors, and operate the Service
• Comply with legal obligations

We do not:

• Sell or rent your information
• Use your Customer Data to train machine-learning models
• Use Customer Data for advertising or profiling

5. How Long We Keep Data (Retention & Deletion)

We are a processing tool, not a long-term host. Retention is deliberately short.

Download links and converted output expire based on your tier:

Tier	Retention period
Preview	7 days
Free (CSV / Excel / JSON utility conversions)	7 days
Explorer	30 days
Standard	30 days
Professional	90 days

Uploaded source files and converted output are deleted together when the job's retention window above ends. At that point both are permanently removed from active storage, the job record is marked deleted, and expired download requests are refused. Uploaded files belonging to jobs that fail or are abandoned are removed within 7 days. Automated cleanup runs daily. After deletion, residual copies may persist for a limited period in our providers' encrypted, access-controlled backups before being overwritten or purged in the ordinary course; we do not use these copies to provide the Service and they are not accessible to you.

Account/Usage Information is retained after the uploaded file and downloadable output are deleted, only as long as reasonably necessary for the purpose it was collected:

• The job record: when a job's files are deleted, its database record is marked deleted rather than erased, and retains limited account metadata (such as the email used to deliver download links, payment references, the original file name, and file size) for support, fraud-prevention, and accounting continuity. The customer-derived content, meaning the detected schema and any sample rows captured for the preview, is deleted along with the files, not kept on the record. This record is not used to market to you. You may request full erasure of a job and its record at any time by emailing info@datameans.com.
• Payment references (Stripe checkout/payment IDs): retained as long as required for accounting, tax, and chargeback purposes, which may be up to seven (7) years under applicable law.
• Security and rate-limiting hashes: short-lived; cleared automatically (rate-limiting IP/email hashes within about 24 hours).
• Error logs: retained by our error-monitoring provider on a rolling basis and then aged out.

Contact-form messages are retained as a support and correspondence record so we can reference past requests and maintain continuity, and are kept until you ask us to delete them. You may request deletion of a message you sent at any time by emailing info@datameans.com. The IP hash used for contact-form rate limiting is short-lived and cleared automatically (within about 24 hours).

Launch-notification signups are kept until the notification they exist for has been sent, after which the list is no longer needed for its purpose. You may request removal from the list at any time by emailing info@datameans.com. The IP hash used for the form's rate limiting is short-lived and cleared automatically (within about 24 hours).

You may request deletion of a job and its associated data at any time by emailing info@datameans.com.

6. Who We Share Data With (Subprocessors)

We use a small number of trusted service providers to operate the Service. They process data only as needed to perform their function:

Provider	Purpose
Vercel	Application hosting, file storage (uploads & outputs), large-file processing, privacy-friendly site analytics (Web Analytics), and bot classification (BotID) on job creation
Supabase	Database hosting (job records and metadata)
Stripe	Payment processing
Resend	Transactional email (download links, notifications)
Sentry	Error monitoring (technical error logs; DSN-gated, errors only)
Cloudflare	Bot and abuse protection on upload (Turnstile)

We may also disclose information if required by law, to enforce our Terms, or to protect the rights, safety, or property of DataMeans or others. If DataMeans is involved in a merger, acquisition, or asset sale, information may be transferred as part of that transaction.

7. Cookies and Local Storage

We do not use cookies for advertising or cross-site tracking. For site analytics we use Vercel Web Analytics, which is cookieless: it reports aggregate page views and product events without cookies, cross-site tracking, or advertising profiles (see Section 3). We store your light/dark theme preference in your browser's local storage so the site remembers it. Our bot-protection tools (Cloudflare Turnstile and Vercel BotID) and our payment provider (Stripe) may set their own cookies or tokens when you interact with those features, as needed to function securely.

Do Not Track and Global Privacy Control. Because we do not track you across sites or serve advertising, we do not behave differently in response to a browser "Do Not Track" signal. Where required by law, we treat a recognized Global Privacy Control (GPC) signal as a valid request to opt out of any "sale" or "sharing" of personal information, though, as noted below, we do not sell or share personal information in any case.

8. Security & Incident Response

We use reasonable, industry-standard technical and organizational measures to protect data, including encryption in transit (TLS) and at rest, access controls, deliberately short retention windows, and one-way hashing of IP addresses and emails used for rate-limiting. No method of transmission or storage is completely secure, and we cannot guarantee absolute security, but because retention is short, the window during which any given file is stored is deliberately limited.

Breach notification. If we become aware of a security incident that compromises your personal information, we will investigate promptly and notify affected users and any applicable regulators as, and within the timeframes, required by applicable law. Where we hold an email address associated with an affected job, we will use it to notify you.

9. Your Responsibilities Regarding Personal Data

Because your uploaded files may contain other people's personal information, you are responsible for ensuring you have a lawful basis to upload that data and to have it processed by the Service. If you are subject to privacy laws such as the GDPR, CCPA/CPRA, or sector-specific rules (e.g., HIPAA, GLBA), you are responsible for your obligations as the controller of that data, including any required notices or agreements. Business customers who require a Data Processing Addendum may contact us at info@datameans.com.

10. Your Rights

Depending on where you live, you may have rights to access, correct, delete, or restrict use of personal information we hold about you, to obtain a portable copy, or to object to certain processing. To exercise these rights, contact us at info@datameans.com. We will respond as required by applicable law and will not discriminate against you for exercising them. Note that for the contents of your uploaded files ("Customer Data"), you are the controller and we act as your processor (see Section 2); requests concerning individuals whose data appears inside those files should generally be directed to you, and we will assist you as your processor as required.

California residents (CCPA/CPRA). We do not sell and do not share personal information as those terms are defined under the California Consumer Privacy Act, as amended by the CPRA, and we have not done so in the preceding 12 months. We do not use or disclose sensitive personal information for purposes that would require a right to limit. California residents have the rights to know, access, correct, delete, and opt out of sale/sharing (which we do not do), and may exercise them, including through an authorized agent, at info@datameans.com.

EEA/UK residents (GDPR/UK GDPR). Where we act as controller of your Account/Usage Information, our legal bases are: performance of a contract (to provide the Service you request and deliver your outputs), our legitimate interests (to secure the Service, prevent abuse, and debug), and compliance with legal obligations (accounting and tax). You have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with your local supervisory authority. Where we act as processor of Customer Data, we process it only on your documented instructions.

11. Children

The Service is not directed to anyone under 18, and you may not use it to process data in violation of laws protecting children's information.

12. International Users

The Service is operated from the United States, and data is processed on U.S.-based cloud infrastructure (primarily the U.S. East region). It is intended for users in the United States, and we do not target or market it to individuals in the EEA or UK. If you access the Service from outside the United States, your information will be transferred to and processed in the United States, where data-protection laws may differ from those in your country. Where personal information is transferred from the EEA, UK, or Switzerland, we and our subprocessors rely on appropriate safeguards for such transfers, such as the European Commission's Standard Contractual Clauses (and, where applicable, our providers' participation in the EU-U.S. Data Privacy Framework). Business customers who require a Data Processing Addendum, including transfer terms, may contact us at info@datameans.com.

13. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will notify you by email or a notice on the Service. The "Last updated" date above reflects the most recent revision.

14. Contact

Questions about this Policy or your data may be sent to info@datameans.com.