Privacy Policy

Last updated: June 15, 2026

1. Introduction

Vistra Nova Ltd ("we", "us", or "our") operates https://querybolt.io (the "Service"). This Privacy Policy informs you of our policies regarding the collection, use, and disclosure of personal data when you use our Service and the choices you have associated with that data.

We are committed to protecting your privacy and ensuring compliance with the UK General Data Protection Regulation (UK GDPR) and the EU General Data Protection Regulation (GDPR).

2. Information We Collect

2.1 Personal Information

We collect the following personal information:

  • Account Information: Name, email address, password (hashed)
  • Payment Information: Processed securely through Stripe (we do not store card details)
  • Usage Data: SQL queries you submit for optimization, optimization results, usage statistics
  • Optional Query-Pattern Data: If you opt in for an upload, we may retain a keyed anonymous fingerprint, structural feature flags, database/workload category, schema-source category, and aggregate optimization outcome. This dataset excludes raw SQL, literals, identifiers, result data, and account identity.
  • Technical Data: IP address, browser type, device information, session data

2.2 How We Collect Information

  • Information you provide when registering an account
  • Information you provide when using our optimization services
  • Automatically collected technical data through cookies and similar technologies
  • Payment information processed through Stripe (PCI DSS compliant)

3. How We Use Your Information

We use your personal information for the following purposes:

  • Service Provision: To provide and maintain our SQL optimization services
  • Account Management: To manage your account, process payments, and provide customer support
  • Communication: To send you service-related emails, updates, and notifications
  • Marketing: Where you have opted in, to send you product news and offers
  • Security: To detect and prevent fraud, abuse, and security threats
  • Legal Compliance: To comply with legal obligations and protect our rights
  • Service Improvement: To analyze usage patterns and improve our services (anonymized where possible)
  • Optional Pattern Coverage: With your explicit per-upload consent, to identify query-pattern categories where our optimizer needs better support

3a. Email We Send You

We send four kinds of email, and they are governed by different rules. You control three of them.

  • Security and service-critical notices. Outages, security incidents, and anything that materially affects the availability or safety of your account. These are sent for the duration of your subscription and cannot be turned off, because we cannot responsibly leave you unaware of them.
  • Job completion and failure emails. A link when a long-running optimization completes or reaches a final failure after its automatic retries. These are part of delivering the optimization service you requested (Article 6(1)(b)), are off by default, and can be enabled independently in account settings.
  • Product and service announcements. Feature launches, breaking changes, planned maintenance, and changes to pricing or terms. These are sent to paying customers under our contract with you (Article 6(1)(b)) rather than on the basis of consent, but you can turn them off at any time in your account settings or from the link in any such email.
  • Product news and offers. Promotional email. We send this only if you have opted in, and never by default. You can withdraw that consent at any time from your account settings or the unsubscribe link in every message, and we record when and how consent was given and withdrawn.

We do not sell, rent or share your email address with third parties for their own marketing.

4. Legal Basis for Processing (GDPR)

We process your personal data based on the following legal bases:

  • Contract Performance: To fulfill our contract with you (providing optimization services)
  • Legitimate Interests: For security, fraud prevention, and service improvement
  • Consent: Where you have given explicit consent (for example, marketing communications and optional query-pattern telemetry). Marketing email is never sent without a recorded opt-in
  • Legal Obligation: To comply with applicable laws and regulations

5. Data Sharing and Disclosure

We do not sell your personal information. We may share your data with:

  • Service Providers: Third-party services that help us operate (Stripe for payments, Mailgun for emails)
  • Legal Requirements: When required by law or to protect our rights
  • Business Transfers: In connection with a merger, acquisition, or sale of assets

All third-party service providers are required to maintain appropriate security measures and comply with data protection laws.

6. Data Retention

We retain your personal data for the following periods:

  • Account Data: Retained while your account is active and for 30 days after account deletion, except records we must retain for legal, tax, security, or fraud-prevention purposes
  • Optimization Jobs and Results: Retained for 90 days unless you delete them sooner or request deletion
  • Query History: While Query History is enabled, saved scripts are retained for 730 days unless you delete them sooner or turn history off. Disabling Query History deletes your stored scripts; residual copies may persist for a short period in encrypted backups before being overwritten
  • SQL Execution Logs: Retained for 90 days for debugging, abuse prevention, and service reliability
  • Optional Query-Pattern Aggregates: Retained without an account identifier while needed to measure optimizer coverage; you can decline collection by leaving the upload option unchecked
  • Session Data: Retained for 7 days after session expiry
  • Legal Records: Retained as required by law (e.g., financial records for 7 years)

You can request deletion of your data at any time (see "Your Rights" below).

6.1 Account Deletion and Abuse Prevention

To prevent abuse and fraud (such as repeatedly creating and deleting accounts to access the free tier), we maintain a minimal, pseudonymized record of deleted accounts for a limited period. This record contains:

  • A cryptographic hash of your email address (not the email itself)
  • The date and time of account deletion
  • The IP address at the time of deletion (for fraud detection)

This data is retained for 30 days after account deletion and is automatically purged thereafter. This practice is compliant with GDPR Article 6(1)(f), which allows processing for legitimate interests including fraud prevention. If you attempt to register with the same email address during this period, registration will be temporarily restricted. If you believe this restriction is in error, please contact our support team.

7. Your Rights (GDPR)

Under UK GDPR and GDPR, you have the following rights:

  • Right to Access: Request a copy of your personal data
  • Right to Rectification: Correct inaccurate or incomplete data
  • Right to Erasure: Request deletion of your personal data ("right to be forgotten"). Note: We maintain minimal pseudonymized data (email hash) for 30 days after account deletion to prevent abuse, as permitted under GDPR Article 6(1)(f).
  • Right to Restrict Processing: Limit how we use your data
  • Right to Data Portability: Receive your data in a structured, machine-readable format
  • Right to Object: Object to processing based on legitimate interests
  • Right to Withdraw Consent: Withdraw consent at any time (where processing is based on consent). Email preferences can be changed under Settings → Data & Privacy, or from the unsubscribe link in any email we send you — no sign-in required

To exercise these rights, please contact us at support@querybolt.io or use the account settings in your dashboard.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

  • Encryption of data in transit (HTTPS/TLS)
  • Provider-managed storage security controls where available
  • Secure password hashing (bcrypt)
  • Security reviews, dependency updates, and access controls
  • Access controls and authentication
  • Documented retention and recovery procedures for configured production environments

However, no method of transmission over the Internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

9. International Data Transfers

Your data may be transferred to and processed in countries outside the UK/EEA (e.g., US-based service providers). We ensure appropriate safeguards are in place, including:

  • Standard Contractual Clauses (SCCs) with service providers
  • Data Processing Agreements (DPAs) with processors
  • Compliance with applicable data protection laws

10. Children's Privacy

Our Service is not intended for children under 16 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

11. Cookies

We use cookies and similar technologies. For detailed information, please see our Cookie Policy.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. You are advised to review this Privacy Policy periodically for any changes.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us:

  • Email: support@querybolt.io
  • Company: Vistra Nova Ltd
  • Registered number: 17056517
  • Registered office: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ
  • Registered in: England and Wales

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) (UK) or your local data protection authority.