Privacy Policy

We collect the minimum needed to operate RestWard:

• Account data - name, email address, and organization details you provide at sign-up.
• Connection metadata - database host and schema information you configure to generate APIs. Connection strings are encrypted at rest; rows from your database are proxied to the caller and not stored (an optional per-endpoint response cache is held in memory for the TTL you set, and is off by default).
• Operational data - API request logs, rate-limit counters, and audit events generated as we serve your API.
• Billing data - handled by our payment provider (Stripe); we store plan and invoice status, not card numbers.

We use your data to provide and operate the service:

• To generate, serve, and secure the APIs you configure.
• To enforce tenant isolation, rate limits, and access control.
• To process billing and maintain audit trails.
• To communicate with you about your account and the service.

We do not sell your data. We do not use your database contents for model training or any purpose beyond operating your API.

We keep your data only as long as needed to operate the service and meet legal obligations:

• Active organizations - your organization's configuration, members and APIs are retained while the organization is active.
• Operational logs - API request audit is kept for 90 days; security events (sign-ins, key and role changes) are kept for the life of the organization. If the organization is later deleted, those security events are anonymized (the organization is replaced by a pseudonym, user references and details are cleared) and kept under the same retention.
• Backups - encrypted nightly backups are not rewritten when data is deleted. Deleted data remains in backups for up to 22 days (about three weeks) and is gone once the backups that hold it are pruned.

Deleting your organization. An active Administrator can delete the organization from its settings; the request is confirmed through a one-time link e-mailed to that administrator's verified address. From that moment the organization is read-only, its APIs stop serving and existing sessions end, and it can be restored by any Administrator for 30 days (a reminder e-mail is sent on day 25). During the grace period SCIM provisioning is blocked, but SSO sign-in still works, so a single sign-on organization can still sign in to restore or to download its data. After 30 days without a restore, everything belonging to the organization is erased: members and invitations, verified domains, database connections and their credentials, APIs and their routes, API keys, SSO/SCIM configuration, usage counts and sessions. A member's user account is erased only if this was their only organization; members of other organizations keep their account.

What is kept after a deletion. Invoices and payment records are kept for 5 years from the end of the financial year they relate to, as required by Danish bookkeeping law; everything else is erased 30 days after deletion. Subscription records, the payment-provider customer reference and a deletion record are kept for the same period, and the organization's slug is quarantined for 90 days so it cannot be reused.

Getting your data before deletion. An Administrator can request a GDPR report - a copy of the personal data we hold on the organization and its members, in machine-readable form plus a readable summary - before deleting, or during the 30-day grace period. The report is delivered as an encrypted download link e-mailed to the requesting administrator and valid for 7 days; the e-mail itself contains no data.

Details: Deleting your organization and Getting your GDPR report.

Depending on your jurisdiction (GDPR, UK GDPR, and similar), you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate personal data.
• Request deletion of your personal data, subject to legal retention obligations.
• Object to or restrict certain processing.
• Receive your data in a portable format.
• Withdraw consent where processing relies on it.

To exercise any of these rights, contact us.

For privacy questions or to exercise your rights, contact us.

This policy is a draft and will be finalized before launch.