Privacy notice
Effective 3 September 2026
Controller and contact
CognitionHub.com Ltd, company number 15198385, trading as OnDemandDB, is the controller for the personal data described in this notice. Our registered office is Office 1, 2a Curzon Road, Ealing, London, W5 1NF, United Kingdom. Contact support@ondemanddb.app for privacy requests.
Personal data we collect
For preview applications we collect email, your primary agent or workflow, your use case, your acknowledgement, and optional name and company. We do not write the application submission IP address to our database. Cloudflare necessarily processes network metadata to deliver and protect the service. Accounts store verified email addresses, password hashes when password sign-in is enabled, passkey public material, security and recovery records, usage, database metadata, customer-provided database and context content, audit records, collaborator relationships, and support correspondence. Stripe and Link receive payment, tax, identity, and transaction data; OnDemandDB stores provider identifiers and subscription state, not card details.
Purposes and lawful bases
We use application information to take steps at your request before a possible contract and to pursue our legitimate interest in selecting a safe, useful preview cohort. We use account, service, and billing state to perform our contract, operate the service, enforce limits, provide support, and recover data. We use security, audit, fraud, cancellation, tax, and transaction records for our legitimate interests and to meet legal obligations. We do not use the application form to obtain marketing consent and do not send marketing because you applied.
Retention
Applications remain until an operator manually deletes them, as the application form explains. Account and audit records are kept for as long as the account is active and afterward only as needed for security, disputes, deletion completion, and legal duties. Deleted database recovery material is encrypted and retained for up to 30 days before lifecycle expiry. Operational records are kept according to their security and support purpose. Stripe and Link retain transaction records under their own policies and legal duties.
Sharing and transfers
We use Cloudflare for edge, storage, and analytics; Hetzner for Helsinki compute; GitHub for delivery; and Stripe/Link for Managed Payments. Cloudflare Web Analytics is cookie-free and does not use client-side identifiers. Public marketing analytics exclude account, authentication, OAuth, recovery, invitation, and API paths. Providers may process data outside the UK using an adequacy regulation or contractual and organisational safeguards. Contact us for information about the relevant safeguard.
Your rights
Depending on the processing, you may request access, correction, deletion, restriction, portability, or object to our use of your data. You have an explicit right to object to processing based on legitimate interests. Some records must be retained for security, transaction, or legal reasons. You may complain to the UK Information Commissioner’s Office at ico.org.uk.
Required information and decisions
Required application and account fields are necessary to review an application, secure an account, or provide the service; without them we cannot admit or serve you. Preview admission is reviewed by a person and is not based solely on automated decision-making. Stripe and Link may make separate automated fraud or payment decisions under their own notices.