Privacy Policy

Effective Date: March 1, 2026

Last updated: October 17, 2026

Corrected October 15, 2026: the descriptions of hosting, storage, third-party services, security measures and browser storage (Sections 3, 5, 6 and 8) now match how the Service operates.

Updated October 16, 2026: retention of logs, traces and job records (Section 4), Cohere for text embeddings (Section 5) and the TLS versions accepted (Section 6).

Updated October 17, 2026: the features that use Anthropic (Section 5) and the console settings kept in browser storage (Section 8).

This Privacy Policy describes how InvariantDB Inc. ("InvariantDB," "we," "us," or "our") collects, uses, and protects your information when you use the InvariantDB platform, website, APIs, and related services (the "Service"). By using the Service, you consent to the practices described in this policy.

1. Information We Collect

We collect the following categories of information:

Account Information

• Name and email address provided during registration
• Authentication credentials managed through AWS Cognito (we do not store your password directly)
• Account plan type and billing status

Usage Data

• API request logs, including timestamps, endpoints accessed, and response status codes
• Query execution metadata (query count, execution time) for performance monitoring
• IP addresses and user agent strings from HTTP requests
• Feature usage patterns within the web console

Graph Data (Customer Data)

• All nodes, edges, properties, and associated metadata that you create and store through the Service
• Temporal versioning records (_version, _valid_from, _valid_to) generated by the system

2. How We Use Information

We use the information we collect to:

1. Provide, operate, and maintain the Service
2. Authenticate your identity and authorize access to your data
3. Monitor and improve Service performance, reliability, and security
4. Communicate with you about your account, including service announcements and security alerts
5. Enforce our Terms of Service and protect against abuse
6. Comply with legal obligations

We do not sell your personal information to third parties. We do not use your Customer Data for advertising, training machine learning models, or any purpose other than providing the Service.

3. Data Storage

1. Customer Data is stored on Amazon EBS (Elastic Block Store) volumes attached to our servers on Amazon EC2 in the us-east-1 (N. Virginia) region.
2. Each graph's data is stored in its own files, separate from the data of other graphs.
3. Backups of these volumes are stored as EBS snapshots in the same region.
4. Files you provide for bulk import are read from Amazon S3 in the same region.
5. All data is stored within AWS infrastructure and is subject to AWS's physical and environmental security controls.

4. Data Retention

1. Active Accounts. Your Customer Data is retained for as long as your account is active. Due to the append-only architecture, all versions of your data (including soft-deleted records) are preserved.
2. Account Deletion. Upon account termination, we will retain your data for up to 30 days to allow for data export. After this period, all Customer Data associated with your account will be permanently deleted.
3. Logs, Traces and Job Records. Server request logs, request traces kept for troubleshooting, and the records of ended background jobs (including their inputs and results) are deleted after at most 30 days. Copies in backups are deleted when the backup expires. Audit and access records that the Service keeps with a graph are part of that graph’s Customer Data and are kept with it.

5. Third-Party Services

We use the following third-party services (sub-processors) to operate the platform:

• Amazon Web Services (AWS). Infrastructure hosting, including Amazon EC2 (compute), Amazon EBS (data storage and backups), Elastic Load Balancing (routing of incoming connections), Amazon S3 (files for bulk import), and Amazon CloudFront (delivery of SDK downloads). Subject to the AWS Privacy Policy.
• Amazon Cognito. User authentication and identity management, including account registration, password management, and JWT token issuance. Subject to the AWS Privacy Policy.
• Cohere. On graphs created on the hosted Service from October 15, 2026, text embeddings for memory and search features are computed with Cohere’s Embed model. The text being embedded (saved memories and facts, document passages, search queries, and property values declared for embedding) is sent to Cohere’s API to produce the embedding. Amazon Bedrock (AWS) may also be used to run the same model. Graphs created before that date use an embedding model that runs on our servers, unless an administrator of the graph moves the graph to Cohere’s model. Subject to Cohere’s Privacy Policy.
• Anthropic. Full document ingestion (saving a document with fact extraction) uses a large language model: it sends the content needed for the request, such as the document text, graph schema or graph data, to Anthropic's API to generate the response. Until October 17, 2026, natural-language queries, the console assistant and investigations also sent your question, graph schema and graph data to Anthropic's API. Subject to Anthropic's Privacy Policy.

We do not integrate with any advertising networks, analytics platforms, or social media tracking services.

6. Security Measures

We implement the following security measures to protect your data:

• Encryption at rest. Customer Data on our server storage volumes and in their backups is not currently encrypted at rest. Files staged in Amazon S3 for bulk import are encrypted at rest by Amazon S3 (AES-256).
• Encryption in transit. Connections between clients and the Service use HTTPS with TLS 1.2 or TLS 1.3; older TLS versions are refused. Requests sent over plain HTTP are redirected to HTTPS.
• Data separation. Each graph's data is stored separately from the data of other graphs.
• Authentication. Access to your graphs requires a credential: a sign-in token issued through Amazon Cognito, an OAuth access token issued by the Service, or an API key issued to your tenant.
• Rate limiting. API endpoints are rate-limited to prevent abuse and protect service availability.

While we take reasonable measures to protect your data, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

7. Your Rights

You have the following rights regarding your data:

1. Access. You can access all of your Customer Data at any time through the API or web console.
2. Export. You can export your graph data in JSON format through the API at any time.
3. Deletion. You can request deletion of your account and all associated Customer Data by contacting us at privacy@invariantdb.com. We will process deletion requests within 30 days.
4. Correction. You can update your account information through the Service settings.
5. Objection. You may object to certain data processing activities by contacting us. Note that some processing is necessary to provide the Service.

8. Cookies and Local Storage

The InvariantDB web application uses browser localStorage for the following purposes only:

• Theme preference. Storing your selected light or dark theme preference.
• Query history. Storing recent Cypher queries in the web console for convenience.
• Authentication tokens. Storing session tokens issued by AWS Cognito for maintaining your signed-in state.
• Console settings. Storing your console preferences, such as the selected graph, display settings and query options. The console no longer accepts an AI provider API key; a key entered in an earlier version of the console is deleted from your browser the next time you open the console.

We do not use tracking cookies, third-party cookies, or any browser fingerprinting techniques. We do not serve advertisements and do not integrate with any ad networks.

9. Children's Privacy

The Service is not directed to individuals under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@invariantdb.com and we will take steps to delete such information.

10. International Data Transfers

The Service is hosted in the United States (AWS us-east-1 region). If you access the Service from outside the United States, your information will be transferred to and processed in the United States. By using the Service, you consent to the transfer of your information to the United States.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by posting a notice on the Service at least 30 days before the changes take effect. The "Effective Date" at the top of this page indicates when the policy was last revised. Your continued use of the Service after any changes constitutes your acceptance of the updated policy.

12. Contact Information

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at:

InvariantDB Inc.
Email: privacy@invariantdb.com