Privacy policy

Datwise is operated by Excellence and Quality Software Solutions, a software company in Jordan, at Al Madina St, Amman, Jordan. We decide how the information described here is handled, and we are the people to write to about it: info@getdatwise.com.

Two kinds of information pass through Datwise. The first is information about you and your workspace: your account, your settings, your billing records and the records our systems keep as you work. The second is the content you bring: the datasets you upload or connect and everything inside them, which only you and the people you invite can see. This policy covers both, on the Datwise website and in the Datwise application. It does not cover what someone else does with data after you choose to share it with them, for example by publishing a public dashboard link or sending an export.

Almost all of this exists because you typed it, uploaded it or asked for it.

• Account details: your name, email address, chosen language, your password stored only as a hash, and — if you sign in with Google — the account identifier Google gives us, plus the name, email address and profile picture Google returns.
• Workspace settings and branding: the workspace name, its members and their roles, and the logo, colours, fonts and default formats you set.
• Uploaded and connected data: the files you upload, the rows inside them, the databases and Google Sheets you connect, and the credentials for those sources.
• The work you do: dashboards, charts, metric definitions, comments, mentions, dashboard version history and the exports you generate.
• Sign-in sessions: each session records the IP address and the browser user agent it was created from, so that you can recognise your own sessions and revoke the ones you do not.
• Audit logs: a record of significant actions in a workspace — who acted, what changed and the IP address they acted from.
• Notifications and email preferences.
• AI use: the questions you ask the assistant, the answers it returns, and a record of how many AI credits each request used.
• Email addresses you give us about other people: people you invite to a workspace, stored from the moment you invite them and before they have an account; the recipients of scheduled reports; and the addresses that form submissions are sent to.
• Billing records: your Stripe customer and subscription identifiers, your plan, invoices and payment status. We never receive your card number, its security code or your billing address.
• Affiliate details: if you join the affiliate programme, the payout details you give us and the commissions recorded against your account.
• How the product is used: a short, fixed list of moments — an account created and by which method, a file imported, a dashboard generated, a template chosen, a question asked, a link shared, a checkout started — measured by Google Analytics with no name, address or content attached, and with counts and file sizes rounded into bands first.
• Visits to public links and SnapShots: counted as described in section 9, without storing the visitor’s IP address, user agent or full referrer.

We use the information above for these purposes and no others.

• To run the service: build your dashboards, refresh your data, produce exports, send the reports and alerts you configure, deliver form submissions and show the links you publish.
• To answer your questions with the AI assistant, in the limited way described in section 6.
• To manage your account: sign you in, verify your email address, show your active sessions and let you end them.
• To bill you, collect payment and keep the financial records a business has to keep.
• To keep the service safe and working: enforce limits, investigate abuse, keep an audit trail and diagnose faults.
• To answer you when you write to us, and to send service messages such as email verification, invitations, security notices and changes to this policy.

We do not sell personal information and we never have. We do not share it with advertisers, Datwise carries no advertising pixel, sets no advertising cookie and builds no advertising profile. We do measure how the product is used, with Google Analytics: what that means, and what it is never given, is in section 12 and in our cookie policy. We do not use your datasets, dashboards or AI conversations to train AI models, and neither does our AI provider — see section 6. Our staff do not browse the contents of customer workspaces as a matter of routine; access is limited to the people who need it to run the service, and is used to fix a fault, to answer a support request you made, or where we are legally required to act.

The Datwise assistant is built on OpenAI models, reached through the OpenAI API. It is not given your dataset. It is given the schema: the name of each column, its type and what kind of value it holds, together with the row count, your metric definitions and the dashboard settings needed to answer. Figures such as counts, sums, averages and ranges are calculated by Datwise when the assistant asks for them, and only the result is sent. When the assistant needs to see how values are actually written — date formats, spellings, units — it can ask for a small sample, capped at 20 rows and 30 columns, with every cell cut to 80 characters. Columns you have marked as hidden are excluded from the schema and from that sample. Requests are sent with storage switched off on OpenAI’s side, and Datwise uses OpenAI under its standard API business terms, under which API inputs and outputs are not used to train models. Answers are cached for seven days in our own systems, keyed to the version of the dataset, so that asking the same question twice does not send it twice.

Datwise’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Signing in with Google asks Google for no access to your data at all: Google hands the browser a signed identity token, and from it we take your name, email address, profile picture and the identifier Google gives your account, and use them only to create and sign in to your Datwise account. Connecting a private Google Sheet is separate, and the only file access Datwise requests there is the drive.file scope, alongside the basic openid and email scopes that identify the account. The drive.file scope reaches only the files you pick yourself in Google’s own file picker; it gives Datwise no access to the rest of your Google Drive. The refresh token that keeps the connection alive is encrypted before it is stored and is never returned by any part of the product. You can disconnect Google at any time from your Datwise source settings, which also asks Google to revoke the grant, or revoke Datwise from the security page of your Google account. We use Google data only to sign you in and to read the sheets you connected — never for advertising, never to build profiles, and never to train models.

When you connect a PostgreSQL or MySQL database, the connection details are encrypted before they are written to our database, and Datwise runs only the query you saved — a single statement that reads and cannot write. When you connect a private Google Sheet, Datwise reads only the file you picked. You can disconnect or delete a source at any time, and deleting it removes the stored connection details. Data already imported into a dataset stays in your workspace until you delete the dataset.

A public link makes a dashboard readable by anyone who has the address, so publish one only if the numbers on it can be public. You can protect a link with a password, which is stored only as an argon2id hash that we cannot read back; the password a visitor types stays in that browser tab. We count visits so you can see how a link is doing, and we do it without identifying the visitor: their IP address and user agent are combined with a secret that changes every day and turned into a one-way hash, and only that hash is stored. It cannot be reversed, and because the secret changes daily it cannot be used to follow a visitor from one day to the next. Of the page a visitor came from we keep only the host name, never the full address. These records are deleted after 90 days. SnapShot images are drawn entirely in the visitor’s own browser and never reach our servers.

If you publish a Datwise form, what people type into it is stored exactly as they typed it and emailed to the addresses you configured. We also store the origin of the page the form was posted from and the language that page declared, so that submissions from different places can be told apart. We do not store the IP address of the person filling in the form. It appears only inside the key of a counter that limits how many submissions a form accepts in a minute, and that counter expires sixty seconds after it is created. Whatever you ask people for in a form is your responsibility, and the acceptable use policy sets out what must never be collected.

Stripe processes card payments and holds the card details. Datwise stores only your Stripe customer and subscription identifiers and the invoice records that go with them: amount, currency, date, plan and payment status. We never store a card number, a security code or a billing address. Stripe handles what it collects under its own privacy policy.

We share information only with the companies below, and only as far as each one needs it to do its job.

• OpenAI — the AI features. It receives the schema and, when needed, the small sample described in section 6.
• Amazon Web Services (S3) — storage for uploaded files, dataset rows, logos, avatars and generated exports.
• Stripe — card payments, subscriptions and invoices.
• Google — sign-in when you choose it, and Google Drive and Sheets when you connect a private sheet.
• Google Analytics — measuring how the website and the application are used. It receives the pages you open and the fixed list of product moments in section 3, the address of the page, the page that sent you, your browser and screen, and an approximate location derived from your IP address. It is given no name, no email address, no workspace, dashboard or column name, no file name and nothing from inside your data, and it is not loaded on a shared dashboard link or an embed. Advertising uses are refused, so nothing it receives is used to target ads.
• Vercel — hosting for the Datwise website and application.
• Our infrastructure provider — the servers that run the Datwise API and the database.
• Our email delivery provider — verification emails, invitations, alerts, scheduled reports and form notifications.

Beyond the companies in section 12, we disclose information only when we have to: to comply with a legal obligation or a valid order, to enforce our terms, to protect the rights and safety of our customers or the public, or as part of a merger or sale of the business — in which case we will tell you, and this policy continues to apply until it is replaced.

Customer data is stored in the European Union. Uploaded files, dataset rows, logos, avatars and exports are kept in Amazon S3 in Stockholm, Sweden. The servers that run the Datwise API and the database are also in the European Union. Because we are a Jordanian company and use the providers listed in section 12, your information may be accessed from Jordan and from the countries those providers operate in, for support, maintenance and the parts of the service they provide. Analytics is the exception: the usage events in section 12 are processed by Google on its own infrastructure, which includes servers outside the European Union. For visitors in the European Union, the United Kingdom and Switzerland, Google derives the approximate location on servers in those regions and discards the IP address rather than logging it.

Most of what you put into Datwise stays while your workspace exists, because it is what the product shows you. These are the parts that expire on their own.

• Records of visits to public links and SnapShots: 90 days.
• Anomaly records used for alerts: 90 days.
• Upload sessions that were started but never finished: 24 hours.
• Cached AI answers: 7 days.
• Dashboard version history: the most recent 100 versions of each dashboard.
• Database backups: 14 days. Backups cover the database only; the files stored in Amazon S3 are not part of them.
• Everything else — audit logs, notifications, AI conversations, form submissions, datasets and dashboards — is kept while the workspace exists, until you delete it or ask us to.

You can delete your account from your account settings. Deleting it turns off sign-in, replaces your email address with an address that cannot receive mail, changes your name to “Deleted user”, deletes your avatar, removes your password and any Google connection, revokes every session on every device, and removes your workspace memberships and any invitations you had not yet accepted. A workspace in which you were the only member is marked as deleted rather than erased at that moment. A workspace you shared with other people is left alone, because it is theirs too; if you are its last owner, Datwise asks you to hand ownership over before it will delete your account. If you want stored content erased rather than marked as deleted, write to info@getdatwise.com and ask, and we will confirm what was removed. We do not promise a fixed deadline for erasure, because backups and other records expire on the schedules in section 15.

You can see and change most of your information in the app: your profile and language in account settings, your active sessions, your workspace settings and branding, your datasets and dashboards, and your email preferences. You can export a dataset or a dashboard at any time. If you would rather we did it, write to info@getdatwise.com and ask for a copy of the personal information we hold about you, a correction, an export, or deletion. We will ask you to confirm who you are before we act, and we will answer as quickly as we can. If our answer does not satisfy you, tell us — we would rather put it right. Analytics is the one thing you can refuse without asking us at all: any content blocker, or blocking cookies for this site, stops Google Analytics from loading, and nothing else changes.

Datwise is for people aged 18 and over. We do not knowingly collect information about anyone under 18. If you believe a child has given us information, write to info@getdatwise.com and we will remove it.

Traffic travels over TLS, passwords are hashed with argon2id, database credentials and Google refresh tokens are encrypted before they are stored, access tokens are short-lived, workspaces are isolated from one another and sensitive endpoints are rate limited. Our security page describes the controls in detail, and is equally clear about what we do not have: there is no two-factor authentication yet, and not every field in the database is encrypted with a key we hold. No service is completely safe. If a security incident affects your information, we will tell you what happened and what we did.

Datwise sets four cookies: one to keep you signed in, one to remember the language you chose, and two that belong to Google Analytics. None of them is an advertising cookie. The analytics pair is not strictly necessary and there is no consent banner in front of it today — any content blocker refuses it, and the product is unaffected. Our cookie policy lists all four, says how long each lasts, and explains the preferences your browser keeps locally and never sends to us.

We may update this policy. The effective date at the top shows the current version. If a change matters — a new kind of information, a new purpose, or a new company in section 12 — we will announce it in the app and by email at least fourteen days before it takes effect.

Excellence and Quality Software Solutions, Al Madina St, Amman, Jordan. For privacy questions, requests about your information or a complaint, write to info@getdatwise.com.