OptiHouse

Privacy Policy

Last updated: June 2026

This Privacy Policy describes how OptiHouse (“we”) collects, uses and protects information when you use our ClickHouse optimization platform (“Service”). We are committed to processing as little personal data as possible and storing nothing we don't need.

1. What we collect

Account information

  • Name, email address, password hash (bcrypt — never the plaintext).
  • Organization name and role (owner / admin / member / viewer).
  • Email verification timestamp, last login timestamp.

ClickHouse metadata (read-only)

When you connect a ClickHouse cluster, we read only system tables:

  • system.query_log — anonymized query text, duration, memory, user.
  • system.parts, system.tables, system.columns — schema and storage metadata.
  • system.metrics, system.asynchronous_metrics — server health counters.

We never read your actual row data. The connector uses a read-only ClickHouse user that does not have SELECT permission on your application tables.

Billing information

Payments are processed by Paddle (our merchant of record). We do not store your credit card details. We receive a Paddle subscription ID, plan tier, next renewal date, and your billing country (for VAT/GST calculation).

Telemetry

  • HTTP access logs (IP, user-agent, endpoint, status) retained for 30 days for security and debugging.
  • Application audit log for sensitive actions (member invite/remove, billing changes) retained for 12 months.
  • We do not use third-party advertising trackers, fingerprinting, or session-replay tools.

2. How we use the information

  • Provide and operate the Service (run scans, render dashboards, generate recommendations).
  • Send transactional emails (invitations, password resets, billing receipts, security alerts).
  • Detect, prevent and respond to abuse, fraud and security incidents.
  • Comply with legal obligations (tax records, lawful requests from authorities).
  • Improve the Service in aggregate (e.g., which recommendation types fire most often). Aggregate analytics never include your queries or schema details.

3. Who we share with

We share data only with the minimum set of vetted sub-processors required to operate the Service:

  • Paddle — payments and tax compliance.
  • Hostinger — VPS hosting and email delivery (SMTP).
  • Let's Encrypt — TLS certificates (domain name only).

We do not sell or rent personal data. We do not share data with advertisers. We disclose information only when legally required (court order, subpoena) and notify affected users where the law permits.

4. Data location and retention

  • Application data is stored on EU-based servers (Hostinger).
  • Account data is retained while your subscription is active.
  • On account deletion, data is retained for 30 days for self-service restore, then permanently deleted within an additional 30 days.
  • Backups are kept encrypted for 14 days on rolling rotation.

5. Your rights (GDPR / equivalents)

You can:

  • Access and export your data via Settings → Account → Export.
  • Correct any inaccurate information from Settings → Profile.
  • Request permanent deletion of your account and all associated data — email privacy@optihouse.io.
  • Object to specific processing or withdraw consent — same address.
  • Lodge a complaint with your local data protection authority.

We respond to verified requests within 30 days.

6. Security

  • All traffic is encrypted in transit with TLS 1.2+ (Let's Encrypt).
  • Passwords are stored as bcrypt hashes; we never see the plaintext.
  • ClickHouse credentials in our database are encrypted at rest using AES-256.
  • Access to production systems is limited to vetted personnel and is logged.
  • We follow industry best practices and continuously monitor our infrastructure.

Report suspected vulnerabilities to security@optihouse.io.

7. Cookies

We use only essential first-party cookies and localStorage to keep you signed in and remember your preferences (theme, language). We do not use third-party tracking cookies and do not require a cookie banner because we have no non-essential cookies to ask about.

8. Children

The Service is not directed at children under 16. We do not knowingly collect personal data from children. If we learn that we have, we will delete it promptly.

9. Changes to this Policy

Material changes will be announced by email to account owners at least 30 days before they take effect. Minor clarifications may be made at any time and reflected in the “Last updated” date.

10. Contact

Questions or concerns? Email privacy@optihouse.io.