Privacy Policy

The short version

We don’t have accounts, we don’t have a database of your content, and we don’t store the SQL you paste. The only data that leaves your browser is the request needed to do the thing you asked for — parse your SQL, render your diagram, or verify a Pro purchase you made.

Who we are

The data controller is Nianxi Labs, operator of erd.tools (an independently developed web tool). For any privacy matter, write to support@yizuo.com — a real person reads every message.

What we collect

• Your pasted SQL — sent to our parsing service to render your diagram, and used for nothing else. It is processed in memory and not stored; there is no database of pasted schemas.
• Standard server logs — our host (Vercel) records request metadata such as IP address, user agent and timestamps for security and abuse prevention, under its own retention policy.
• Payment data — if you buy Pro, our merchant of record (Waffo Pancake) collects your email and payment details to take payment and remit taxes. We receive your email and an order reference, which we use only to verify your entitlement and handle refunds.
• Browser storage — your Pro activation token is stored in your browser’s localStorage. It contains an order reference and expiry, and you can erase it any time by clearing site data.

How long we keep things

• Pasted SQL — not stored at all. It lives in memory for the second or two your parse takes, then it is gone.
• Request logs — kept by our host on a short rolling window (currently about an hour on our hosting plan) for security and abuse prevention. We never export or analyse them.
• Payment records — the email address and order reference we receive from Waffo Pancake are kept while your subscription is active, plus 24 months, so we can honour renewals, refunds and payment disputes.
• Support emails — kept for up to 24 months after your request is resolved.
• Pro activation token — stored in your browser only, never on a server. It expires by itself after 35 days (monthly plan) or 370 days (annual plan).

What we don’t do

• No analytics or advertising trackers.
• No marketing email — the only email we ever send is a reply to a message you sent us.
• No accounts, passwords, or profile building.
• No training of any model on your SQL.
• No cookies beyond what the hosting and font providers technically set; share links encode your schema in the URL itself, never on a server.

Third parties

Waffo Pancake (pancake.waffo.ai) — merchant of record: payments, tax, receipts and subscription management. Card details are processed entirely by Waffo Pancake on its PCI-DSS certified infrastructure and never reach our servers. Vercel — hosting and request logs. Google Fonts — serving the typefaces this site renders with. We share nothing else, and we don’t sell data to anyone.

Minors

The service is not directed at anyone under 18, and we do not knowingly collect personal data from anyone under 18. If you believe a minor has given us personal data, email us and we will delete it.

International transfers

Our host (Vercel) and font provider (Google Fonts) may process data in countries other than yours. Vercel maintains a GDPR data processing addendum with standard contractual safeguards. No other transfers happen, because there is no other party.

If something goes wrong

In the unlikely event of a personal-data breach, we will notify affected users within 72 hours of discovering it — what happened, what data was involved, and what to do.

Your rights

There is so little data that “erasure” mostly means clearing your browser storage — the Pro token is the only thing we put there, and it expires on its own. For anything else, email support@yizuo.com and we will respond within 30 days: access what we hold, correct it, delete it, or tell us to stop processing it. EU/UK/California residents keep all statutory rights.

Changes

If this policy materially changes, we update the version and date at the top and note the change on the site before it takes effect.