Our privacy promises at a glance
✓ Zero real data. We work from your schema's structure; real rows are stripped before anything is sent or stored.
✓ Never used to train AI. Our AI, a frontier AI model, is used on paid terms that prohibit using your content to train or improve its models, and we train no models ourselves.
✓ No PHI or real personal records ever enter the platform: every value we produce is synthetic.
✓ Auto-delete: generated files are erased after 30 days.
✓ Your data, your control: download everything we hold about you, or delete your account, in one click from your Profile.
✓ We never sell or share your data, and we use no advertising or tracking cookies.
✓ Encrypted in transit and at rest, hosted on Google Cloud, which is SOC 2 and ISO 27001 certified.
✓ GDPR and India DPDP Act ready, with a privacy contact below.
Effective date
Effective 2 October 2026; last updated 28 October 2026. This policy explains what GenerateRealData ("we") collects, why, who processes it, how long we keep it, and your rights.
1. What we collect
Account: your name, email address, sign-in method and whether your email is verified. What you submit: use-case descriptions, field lists, instructions and SQL schemas (table and column structure only). What we generate: the synthetic datasets you request. Billing and usage: your plan, credit balance, a record of credit grants and charges, dataset activity, and payment records from PayPal or Gumroad (order or sale ID, amount, date). Abuse prevention: a one-way hash of your email address and of your network (IP) address when you start a free trial. API: if you create an API key, we store only a one-way hash of it, its first characters, when it was created and last used, and a log of API requests (time, endpoint, result) for security and abuse prevention, kept for up to 30 days.
2. What we do not collect
We never need real data. When you upload a SQL schema we read only its structure: any rows in the file (INSERT/COPY statements) are removed in your browser and again on our servers before processing, and are never stored. We never see or store your card or bank details; PayPal (or Gumroad, for customers in India, Pakistan, Bangladesh and Turkey) handles payments.
3. Why we use it, and on what legal basis
To provide the service you signed up for (contract): running your account, generating datasets, charging and refunding credits, and a few emails about your own account (one during your free trial, one when it ends, and a reminder 3 days before a paid pass ends), which you can switch off in your profile or with the link in each email. To keep the service safe and working (legitimate interests): preventing abuse such as repeated free trials, and monitoring errors and usage. To meet legal obligations: keeping payment and accounting records. With your consent: when you accept these terms at sign-up. We do not sell your data, share it for advertising, or make automated decisions about you that have legal effects.
4. AI processing
To design schemas and write AI-generated columns, your prompts and schemas are processed by a frontier AI model under a paid commercial plan. Under those terms your content is not used to train or improve the provider's models; the provider may keep it briefly to detect abuse. We do not train any models on your content. Synthetic datasets are not sent to the AI except for the rows needed to fill AI-generated columns.
5. Who processes your data
We use a small number of carefully selected providers. Each acts on our instructions under a data processing agreement and its own security controls:
• Google Cloud / Firebase (Google LLC): hosting, sign-in, database, file storage and computing, in the United States.
• A frontier AI model: AI features, on paid commercial terms that do not allow training on your content.
• PayPal: payments for most countries. Card and bank details go to PayPal only.
• Gumroad: payments for customers in India, Pakistan, Bangladesh and Turkey. Card details go to Gumroad only.
• Titan (business email): our support mailbox, for emails you send us and our replies.
Google Cloud is independently certified for SOC 2 and ISO 27001; those certifications cover Google's infrastructure, not GenerateRealData itself. We will update this list, and the date at the top, before adding or changing a provider. Business customers can request a data processing agreement (DPA) at support@generaterealdata.com.
6. How long we keep it
Generated files are deleted automatically 30 days after creation. Dataset records (name, settings, status) stay in your dashboard until you delete your account. Payment and credit records are kept as long as accounting and tax law requires, even after account deletion. Trial-abuse hashes are kept so a deleted account cannot claim a second trial; they cannot be turned back into your email or IP. Server logs are kept for up to 30 days.
| What | How long |
|---|---|
| Generated files (CSV, Excel, JSON, SQL, SQLite) | 30 days, then deleted automatically |
| Dataset records and schema structure (name, settings, status, tables and columns) | Until you delete your account |
| Your saved designs (My designs, and schemas saved through the API) | Until you delete them or your account |
| Account profile (name, email, sign-in method) | Until you delete your account |
| API request log | Up to 30 days |
| Server logs | Up to 30 days |
| Payment and credit records | As long as accounting and tax law requires, even after account deletion |
| Trial-abuse hashes (one-way, cannot be reversed) | Kept, so a deleted account cannot claim a second trial |
| Emails you send to support | As long as needed to handle your request |
7. Download or delete your data
From your Profile, Download My Data gives you everything we hold about you (profile, datasets, saved designs, credit history, payments) as a JSON file, and Delete Account permanently deletes your generated files, dataset records, profile, usage statistics and sign-in, apart from the records described in section 6.
8. Your rights
Depending on where you live (including under the EU/UK GDPR, India's Digital Personal Data Protection Act, 2023, and US state laws such as the CCPA), you may have the right to access, correct, delete or port your personal data, to object to or restrict its use, to withdraw consent, to nominate someone to act for you, and to complain to a data protection authority. Most of these you can do yourself from your Profile; for anything else, email us and we will respond within 30 days.
9. International transfers
Your data is stored and processed on Google Cloud in the United States. Where data leaves your country, we rely on our providers' approved safeguards, such as the European Commission's Standard Contractual Clauses.
10. Cookies and tracking
We use only what sign-in needs to keep you logged in (stored in your browser by our sign-in service). We do not use advertising or third-party analytics cookies, so there is nothing to opt out of.
11. Security
Data is encrypted in transit (HTTPS with HSTS) and at rest by our providers. Access is restricted by security rules; payment and credit records cannot be changed from the browser; the site sends modern security headers (clickjacking, content-type sniffing and referrer protections). No system is perfectly secure; if a breach affects you, we will notify you and the relevant authority as the law requires.
12. Children
GenerateRealData is not intended for anyone under 18, and we do not knowingly collect their data.
13. Changes and privacy contact
If we change this policy we will update the date above and, for significant changes, tell you in the app. For privacy questions or requests, write to our Privacy Contact at support@generaterealdata.com. We acknowledge requests promptly and resolve them within 30 days.