Privacy Policy

1. Overview

This Privacy Policy explains how SlashPeak, Inc. ("SlashPeak", "we", "us") collects, uses, and protects information when you use the SlashPeak website and application (the "Service"). SlashPeak connects to a customer's Google BigQuery project and analyzes query and usage metadata to surface cost analytics, savings findings, and — where you choose to use it — AI-assisted answers and fixes.

The commitment behind this policy: SlashPeak is built around read-only, metadata-only access. We do not read the contents of your BigQuery tables, and the key we use to scan never includes the IAM permissions that would let us. Section 3 lists the few optional features you can turn on that go beyond it.

2. Information we collect

We collect the following categories of information:

• Account information — name, work email, account region, timezone, plan, and notification preferences. If you sign in with a password, we store only a one-way argon2id hash of it, never the password itself. If you sign in with Google or Microsoft, we receive your name, email address, and account ID from that provider, and no password.
• Billing information — if you buy a paid plan, Dodo Payments, our reseller and Merchant of Record, collects your card and billing details. We never see or store your full card number. We store your Dodo Payments customer ID, your plan, billing interval, subscription status, and billing dates, so we can show your plan and send billing emails.
• Free trial requests — who asked for the 30-day free trial and when. Our team receives this request by email so it can approve the trial.
• Demo bookings, contact forms, and brochure requests — the name, work email, company, job title, topic, BigQuery spend range, and message you enter, the meeting time and time zone you pick, and the link parameters on the page you came from (for example, utm_source). A demo is booked through Cal.com, our scheduling provider, which sends the calendar invite. We use these details to schedule the meeting and follow up with you.
• API keys (optional) — if you create an API key, we store only a hash of it and a short prefix that helps you recognize it. We cannot show the full key again after we create it.
• Team members — because accounts are shared by everyone at the same email domain, we store which teammates have joined your account and their role (owner or viewer).
• Connection configuration — the GCP project ID, BigQuery region(s), optional dataset scope, and an encrypted copy of the service-account key you provide to authorize scans.
• BigQuery metadata collected during scans — job history (including query text with personal values masked as described in section 3, timestamps, bytes billed/processed, slot usage, the user email attached to each job, and referenced tables), table metadata and DDL, storage sizes, dataset billing configuration, and reservation/slot timeline data. All of it is read from BigQuery's INFORMATION_SCHEMA views — never from your tables' contents.
• Billing export data (optional) — if you link a Cloud Billing export dataset, we read its cost and usage rows to reconcile against BigQuery's own metering.
• dbt metadata (optional) — if you upload a dbt manifest or connect dbt Cloud, we store model, source, test, and lineage metadata (names, owners, tags, config, and dependencies) to map warehouse spend to your dbt project. We never store your compiled SQL. If you connect dbt Cloud, we store your access URL, account ID, and an encrypted copy of the service token you provide. We use the token to read your latest run's artifacts once a day and, only if you set up the optional CI check, to start the one dbt Cloud job you choose on a fix branch.
• GitHub access (optional) — if you install the SlashPeak GitHub App, we store the installation's repository access, limited to the repositories you select, and the repositories you map to a connection. To prepare a fix, we read the files it needs from those repositories through GitHub's API, with short-lived tokens scoped to one repository. To find the code behind a query, we may download a copy of the repository's code files; that copy is held in memory only, never written to disk, and discarded when the step ends. We do not clone or keep your repositories. For each fix, we store the file paths and the small edits it makes, so the change can be reviewed and rolled back. The app can create branches and open pull requests on those repositories; it never merges a pull request or pushes to a branch it did not create.
• Lineage metadata (optional) — if enabled, we read table lineage links from Google Cloud Dataplex to show what a table feeds and depends on.
• Cognis AI conversations — the questions you ask Cognis and the answers it returns, so you and your team can revisit them. When you use the AI query optimizer on a query, we also keep its result (the masked query, the suggested rewrite, and the checks it ran), encrypted.
• Cognis AI DBA operator credentials and actions (optional) — if you enable the AI DBA, an encrypted copy of the separate operator service-account key you create for it, plus a full record of every action it proposes, that you approve or reject, and that it applies, verifies, or rolls back. For each AI-written fix we also keep a record of what was sent to the AI model (user emails removed first) and the answer it returned.
• Alert destinations — a Slack incoming webhook URL, an HTTPS webhook URL, and/or the email addresses you choose to receive scan and alert notifications.
• Usage and diagnostic data — device and browser information, pages viewed, and application logs, used to operate, secure, and troubleshoot the Service. Our servers also send PostHog a limited set of product events (for example, "scan finished" or "plan chosen") linked to your account, server error reports, and a record of each AI request: the model, token counts, and timing. That record never includes your question or the AI's answer. We also keep our own record of each AI request's feature and cost, to measure your plan's monthly AI usage.
• Bot checks — when you sign in with a password, sign up with email, request a brochure, or a support staff member opens support access, Cloudflare Turnstile checks that a real person is using the form. Cloudflare receives your IP address and technical signals from your browser for this check.
• Sign-in sessions — for each device signed in to your login: the IP address and browser type at sign-in, when it signed in, and when it was last active. You see a device name and an approximate location, never the IP address. We find the approximate location with a location database on our own servers, so the IP address is not sent to a third party for this. Account owners see how many devices each teammate has signed in and when each was last active.
• Cookies and local storage — see the Cookies section below and our full Cookie Policy.

3. What we never collect

The key SlashPeak uses to scan never issues a query against the contents of your BigQuery tables. We do not request roles/bigquery.dataViewer or any IAM permission that would grant access to row-level or column-level data for it — the access model enforces this, not just policy. Two optional features go beyond it, and only if you set them up. If you link a Cloud Billing export, you give us BigQuery Data Viewer on that one export dataset, which holds cost rows, not your business data. If you enable Cognis AI DBA fixes that run dry runs, create materialized views, or rebuild a table, the separate operator key includes the bigquery.tables.getData permission, and setup tells you it is an escalation.

Query text in your job history can contain literal values, for example a customer's email address or phone number in a WHERE clause. We do not collect these values. Each scan masks them inside your own BigQuery project, in the same INFORMATION_SCHEMA query that reads the text, so only the masked text is returned to us. Email addresses become <email>, phone numbers become <phone> and IP addresses become <ip>.

The mask covers query text, job error messages, query plan steps and view definitions. Account owners can add their own patterns in Settings → Privacy (for example customer IDs); matches become <redacted>. A new pattern applies from the next scan. Table names are not masked, and neither is the user email attached to each job, which identifies the member of your team who ran it (section 2).

The Cognis AI query optimizer uses only this masked copy of a query and never reads query text from BigQuery itself, so neither the optimizer nor the AI model behind it receives the real values.

4. AI features

When you ask Cognis a question or use Cognis AI DBA, your question and the account metadata relevant to answering it (for example, spend and usage figures, table names, the emails of users who ran queries, and masked query text, not table contents) are sent to third-party AI model providers who act as subprocessors on our behalf to generate the response. This data is not used to train those providers' models — it is sent under terms that prohibit training on your data.

AI-written Cognis AI DBA fixes, which send the finding, the query text, the table schema, and the files being fixed to Anthropic's Claude model, run only after an account owner allows "Send SQL to the LLM" on the AI DBA Privacy tab of Cognis Settings. Without that consent, only rule-based fixes run. User emails are removed before that data is sent.

The AI model providers we use today are named on our Subprocessors page, and we update that page when the list changes. AI features are not part of the free trial; they are available on paid plans only. AI-generated answers and recommendations may be inaccurate — see "Findings and AI outputs" in our Terms of Service.

5. How we use information

We use the information described above to:

• Operate the Service — run scans, compute findings and estimated savings, answer AI questions, and render reports and dashboards.
• Maintain and secure your account, including authentication, tenant isolation, bot checks, and abuse prevention.
• Process payments, manage your subscription, review free trial requests, and send billing emails such as receipts, trial reminders, and failed-payment notices.
• Communicate with you about scan results, anomaly alerts, product updates, and — only if you opt in or request one — sales or demo outreach, including the calendar invite for a demo you book.
• Improve SlashPeak's product using aggregated, de-identified usage patterns.
• Comply with legal obligations and enforce our Terms of Service.

6. Legal basis for processing (EEA/UK users)

Where the GDPR or UK GDPR applies, we process personal data under the following legal bases: performance of a contract (operating the Service you signed up for and billing you for it), legitimate interests (securing the Service, bot checks, server-side product events, and improving the Service), consent (analytics cookies in your browser, marketing communications, and optional demo requests), and legal obligation (tax, accounting, and compliance record-keeping).

7. Support access to your account

A small number of authorized SlashPeak staff can, when needed to help you or investigate an issue, open your account in a read-only support mode. That mode cannot change your data, every use of it is logged, and a staff member's own login always opens their own account first — support access is a separate, deliberate step.

8. Data sharing and subprocessors

We do not sell personal information. We share data only with service providers who help us operate SlashPeak, under contractual confidentiality and data-protection obligations. These include infrastructure and database hosting, application hosting, email delivery, AI model providers, payment processing and reselling (Dodo Payments), network delivery and bot checks (Cloudflare), product analytics (PostHog), demo scheduling (Cal.com), and — only when you use them — Google or Microsoft sign-in, GitHub, and Slack. The current list, with each provider's purpose, location, and the data it processes, is on our Subprocessors page.

9. Data retention

Account and connection data are retained for as long as your account is active. Scanned BigQuery job and usage history is retained for your plan's history window plus about one month, and is removed in whole calendar months; table snapshots are retained for 120 days. The extra time supports incremental scanning. The result of an AI query optimizer run is kept 30 days, the record of what was sent to an AI model for an AI DBA fix 120 days, and the audit log of AI and AI DBA actions 365 days. You may delete a connection at any time, which removes its service account key and its associated scans, findings, cached metadata, and the BigQuery audit log entries we copied from your Cloud Logging. If your free trial ends without a paid plan, or your paid plan ends, your account is locked: only Settings stays open, so you can choose a plan. We keep the account's data for 30 more days (counted from the end of the trial or of your last paid period), so it is all still there if you choose a plan in that time. After that, we delete it. Billing records, such as invoices, are kept as long as tax and accounting law requires. Demo and contact requests are kept as long as we need them to follow up, and are deleted on request. When an owner deletes the account, everyone is signed out at once, a paid plan is canceled so it does not renew, and the scanned warehouse data (service account keys, scans, jobs, findings, cached metadata, and the BigQuery audit log entries we copied) is deleted at once. The rest of the account (team members, the billing records we hold, and our own activity and email logs) is deleted 7 days after the end of the last paid period, or 7 days after the request when nothing is paid ahead, except where retention is required by law or to resolve disputes. A team member who deletes their own login is removed at once. Encrypted database backups are kept on a rolling 30-day cycle, so data deleted from the live database leaves our backups within 30 days. A sign-in session record is deleted when you sign out, when it expires, or when your account's login policy ends it.

10. Security

Service-account keys, AI DBA operator keys, and dbt Cloud service tokens are encrypted at rest with AES-256 before being stored, and are never returned to your browser after initial submission. Passwords are stored only as argon2id hashes, and API keys only as hashes. Sign-in and sign-up forms are protected by a bot check. All traffic to the Service is encrypted in transit (TLS). Tenant isolation between accounts is enforced in application code, with database row-level security as a second check on account records. Sensitive actions are recorded in audit logs, and internal access follows least-privilege. On the Enterprise plan, account owners can set a login policy that limits how many devices each member keeps signed in and signs members out after a period of inactivity. See our Security page for the full access model.

11. International data transfers

SlashPeak's infrastructure may process and store data in the United States and other regions where our hosting providers and subprocessors operate. Where required, we rely on appropriate safeguards — including Standard Contractual Clauses (SCCs) — for cross-border transfers of personal data.

12. Your privacy rights

Depending on your location, you may have rights to access, correct, delete, restrict, or port your personal data, and to object to certain processing.

• EEA/UK residents (GDPR/UK GDPR) — the rights above, plus the right to withdraw consent at any time and to lodge a complaint with your local supervisory authority.
• California residents (CCPA/CPRA) — the right to know what personal information we hold, to delete it, to correct it, and to opt out of the sale or sharing of personal information. SlashPeak does not sell personal information.

13. Cookies

We use strictly necessary cookies for authentication and session management, and browser local storage for interface preferences such as theme and sidebar state. With your consent, we also use PostHog analytics cookies to understand how the product is used. We do not use advertising or cross-site tracking cookies. See our Cookie Policy for the full list.

14. Children's privacy

The Service is intended for business use and is not directed to individuals under 16. We do not knowingly collect personal information from children.

15. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the effective date above, and where appropriate, we will notify account holders by email.

16. Contact us

Questions about this policy or your data can be sent to [email protected]. Security-specific questions can be sent to [email protected].