PraqtorDB ("PraqtorDB", "we", "us") is a multi-tenant AI memory layer operated as a solo-founder business from Las Vegas, Nevada. This page is the honest version of how we handle your data. If anything here is unclear, email hello@praqtordb.com and we will explain it in plain English.
The short version
We collect what we need to run the service, encrypt the sensitive stuff, host it in AWS us-east-1, isolate every workspace at the database level, and never train AI models on your data or sell it to anyone. You can delete your account whenever you want.
1. Data we collect
Account information
When you sign up, our identity provider (Clerk) collects your email address, an optional display name, and a session token. We never see your password. If you sign in with Google or another SSO provider, Clerk receives the OAuth claims that provider releases and we get back a verified email + a stable user ID.
Your content (notes, documents, conversations, bookmarks)
Everything you create or save inside the product — chat conversations with AI models, notes, deep-memory documents, web bookmarks, files imported from Google Drive / OneDrive / Dropbox / Box / Adobe Document Cloud / GitHub — is stored against your workspace. This includes text, embeddings (numeric vectors derived from the text), extracted entities, and the relationships between them in the Knowledge Graph.
Chrome extension captures
If you install the PraqtorDB Chrome extension and use it to capture a web page, the page text, source URL, and optional screenshot you triggered are sent to your workspace. Captures only happen when you click the extension; we do not background-scrape your browsing.
BYOK API keys
If you connect your own OpenAI, Anthropic, Google, Groq, xAI, or Perplexity key (Bring-Your-Own-Key), the key is encrypted with AWS KMS using an EncryptionContext bound to your workspace ID before it ever touches the database. Only your workspace can decrypt it. We never log or display the plaintext key after you save it.
Usage and billing data
We record the model you queried, token counts, the timestamp, and the resulting charge (free / debited credits / BYOK) for every AI call. This drives your billing page, your daily-quota counter, and our cost reconciliation. We do not store your question text or the AI response text in the billing log — those live in your conversation history (under per-tenant isolation).
Cookies and analytics
- Auth cookies (Clerk): required to keep you signed in across pages. Strictly necessary; you cannot opt out and still use the product.
- No ad cookies. No third-party analytics cookies. No cross-site trackers. We do not run Google Analytics, Facebook Pixel, Mixpanel, Segment, or any similar tooling on the dashboard.
- Marketing site (praqtordb.com): we use Vercel Web Analytics to count page views and identify which pages and referrers people arrive from. It is cookieless, sets no identifiers in your browser, collects no personal data, and does not track you across other sites. We use this only to understand traffic to the marketing pages.
2. How we use your data
- To run the service: retrieve your memory, route your queries to the AI model you picked, render your dashboard, sync your connected drives.
- To bill you: charge subscription fees, debit credit packs, send invoices via Stripe, prevent abuse and quota overruns.
- To keep the service working: server logs, error traces, performance metrics. These are short-retention (≤30 days) and aggregated where possible.
- To improve the product: we may look at aggregated, de-identified usage patterns (e.g. "how often do users hit the daily limit on the Pro plan"). We do not read your conversations or documents for product research.
What we will never do
- Train AI models on your content.
- Sell your data to advertisers, brokers, or any third party.
- Use your conversations or documents to recommend products or target ads.
- Read your data for purposes other than running the service you signed up for — except when required to investigate a specific incident you reported, or comply with a legal order we cannot lawfully refuse.
3. How we store your data
All production data lives in AWS, region us-east-1 (Northern Virginia, USA).
- Database: Amazon Aurora PostgreSQL. Every workspace has its own dedicated Postgres schema (the "schema-per-tenant" model). Cross-workspace queries are blocked at the database engine itself — not just by application code — via row-level security with FORCE on shared tables.
- File storage: Amazon S3, with a separate, dedicated S3 bucket per workspace. Files are encrypted at rest with AWS-managed keys.
- BYOK keys: AWS KMS with EncryptionContext binding. A leaked ciphertext from one workspace cannot be decrypted under another workspace's context, even by us.
- In transit: TLS 1.2+ on every connection (browser → API, API → database, API → AI providers, API → AWS services).
4. Third-party services we use
Some parts of the service rely on other companies' platforms. When your data flows to them, they handle it under their own privacy policies (linked).
- Stripe — payment processing, subscription billing, credit-pack checkout. Stripe receives your billing email, card information (we never see your card number), and the amount of each charge. stripe.com/privacy
- Clerk — sign-in, session management, password hashing, SSO. Clerk holds your account credentials. clerk.com/legal/privacy
- AI providers (LLM inference): when you send a query, the prompt + your retrieved memory context is forwarded to the provider you selected:
When you use BYOK, your prompt goes directly from us to your provider under your account and is subject to your account's data-handling terms with them.
- Connected data sources — Google Drive, Microsoft OneDrive, Dropbox, Box, Adobe Document Cloud, GitHub. Read-only OAuth tokens you grant let us sync the files you authorize. You can revoke the connection at any time from the source provider's account settings or from PraqtorDB Settings.
- AWS — infrastructure (compute, database, storage, KMS, CloudWatch). aws.amazon.com/privacy
5. Data retention and deletion
While your account is active, we keep your data so the service works. When you delete your account, here's what happens:
- Your tenant Postgres schema is dropped. All notes, documents, conversations, bookmarks, embeddings, and the Knowledge Graph it contained are removed.
- Your per-tenant S3 bucket is emptied and removed.
- Your BYOK ciphertexts and the KMS key context references are deleted.
- Billing records (invoices, payment history, tax records) are retained for 7 years to comply with U.S. tax and accounting law. These contain account email + transaction amounts and timestamps, not product content.
- Short-lived logs (≤30 day retention) referencing your account ID may persist until they rotate.
To delete your account, email hello@praqtordb.com from the address on the account. We act on deletion requests within 30 days (usually within 48 hours). A self-service "Delete account" button is on the roadmap.
6. Your rights (GDPR, CCPA, and similar laws)
Whether or not you live somewhere with a strong data-protection law, you have these rights with us:
- Access — request a copy of the personal data we hold on you.
- Portability — request an export of your workspace (JSON + files).
- Correction — ask us to fix data that is wrong.
- Deletion — close your account and remove your data (see Section 5).
- Restriction / objection — tell us to stop processing for a specific purpose.
- Withdraw consent — for anything we relied on your consent for, you can withdraw it at any time.
Email hello@praqtordb.com from the address on the account to exercise any of these. We do not charge for requests at reasonable frequency. We respond within 30 days. We will never retaliate against a user for exercising a privacy right.
7. International users
All our infrastructure is in the United States (AWS us-east-1). If you sign up from outside the U.S., your data is transferred to and stored in the U.S. By using the service, you accept that transfer. We rely on the standard data-protection commitments AWS makes for its U.S. infrastructure; if you require region-specific hosting (EU, UK, APAC), email us — we can talk about a custom arrangement, but it is not on the standard plan today.
8. Children
PraqtorDB is an enterprise product and is not for minors. You must be at least 18 years old to create an account, regardless of where you are. If you believe a minor has created an account, email us and we will remove it.
9. Security
We take security seriously because the data we hold is sensitive by design. Layers in place today:
- TLS in transit, AES-256 at rest (S3, Aurora, KMS-managed).
- Per-tenant Postgres schema + row-level security FORCE on shared tables.
- Per-tenant S3 buckets (no shared-bucket-with-prefix design).
- AWS KMS EncryptionContext binding on BYOK keys.
- Webhook signature verification (Stripe HMAC, Clerk Svix).
- Short-retention logs; secrets stored in AWS Secrets Manager.
No system is impenetrable. If you discover a vulnerability, please report it to hello@praqtordb.com before disclosing publicly. We will respond within 72 hours and credit you in a disclosure thank-you list if you would like.
10. Changes to this policy
If we change anything material, we will email every active account at least 14 days before it takes effect and update the "Effective" date at the top. Non-material edits (typos, clarifications) may happen without notice.
11. Contact
PraqtorDB
Las Vegas, Nevada, USA
hello@praqtordb.com