ScyllaDB powers real-time AI with low latency, high throughput, and billion-scale data.
Learn MoreLast Modified: February 2, 2026
ScyllaDB Ltd. together with its affiliated companies (“ScyllaDB”, “we” or “us”), provides NoSQL proprietary software and cloud-based database infrastructure services (“Services”).
This privacy policy (“Privacy Policy”) describes how ScyllaDB collects, stores, uses, shares and otherwise process information, including Personal Data (as defined below), in connection with your interactions with us. It applies to individuals and entities who use or evaluate our Services (“Customer”) and their designate personnel (including third party contractors, agents, etc.) that are authorized by Customer to use the (“Authorized Users”), participate in our online communities (each a “Community Member”), or otherwise interact with our website (including our blog), registered for or attend an event we host, use interactive website features (including chat features, such as AI chat) or engage with other forums made available through the website or additional landing pages (“Prospect”). Unless otherwise stated herein, Customer, Community Member and Prospect shall be, collectively and separately, referred to as “you” or “your”.
This Privacy Policy does NOT apply to:
1. The content that our Customers and their Authorized Users upload or integrated while using the Service (“Customer Data”). ScyllaDB processes Customer Data solely on behalf of the Customer, in its role as a “processor” or “service provider” as such terms are defined under applicable data protection laws and is governed by the Data Processing Addendum.
IPPL Disclosure: The information you provide will be stored in ScyllaDB’s databases and will be used solely as detailed herein. The information will not be transferred to third parties, except as detailed herein, or to comply with legal obligations. You acknowledge that you are not under any statutory obligation to provide personal data to ScyllaDB. However, if you do not provide certain personal data, we may be unable to fulfill certain purposes, such as providing specific services or responding to your inquiries. You have the right to review your information and request corrections in accordance with the provisions of the Protection of Privacy Law, 5741-1981 (Israel).
CCPA Notice: https://www.scylladb.com/ccpa-privacy-notice/
US State Privacy Specifications: see Section 13
DPF Statement: https://www.scylladb.com/data-privacy-framework/
We reserve the right to periodically amend or revise this Privacy Policy at our sole discretion. The most recent version of this Privacy Policy will be reflected in the “Last Modified” heading located at the top of this Privacy Policy. We will not implement any substantial changes in our privacy practices without providing you prior notice. We recommend that you periodically review this Privacy Policy to ensure that you understand our most updated privacy practices and to check for any amendments.
ScyllaDB Ltd., incorporated under the laws of the state of Israel, is the Controller (as such term is defined under the EU and UK General Data Protection Regulations “GDPR” or equivalent privacy legislation). This means that we are responsible for deciding how your Personal Data is processed (purpose and means), as well as implementing applicable measures to secure the Personal Data we store, and where applicable, enable you to exercise your rights.
If you have any questions, inquiry or concern regarding the processing of your Personal Data, or would otherwise like to contact us in connection with this Privacy Policy, you can contact us through the following means:
We may collect two types of information from you, depending on your interaction with us:
“Non-Personal Data”: During your interaction with our Services, we may collect aggregated, non-personal, non-identifiable information, which may be made available or gathered via your access to and use of the Services. We are not aware of the identity of the user from which the Non-Personal Data is collected. The Non-Personal Data being collected may include your aggregated usage information and technical information transmitted by your device, such as the type of browser or device you use, language preference, time and date stamp, country location, etc.
“Personal Data”: We may also collect from you, during your access or interaction with the Services, individually identifiable information, namely information that identifies an individual or may, with reasonable effort, be used to identify an individual.
For the avoidance of doubt, any Non-Personal Data connected or linked to any Personal Data shall be deemed as Personal Data as long as such connection or linkage exists.
The types of Personal Data the purpose we process, the purpose, lawful basis, and our processing operations are specified in the table below:
| Type of Personal Data | Purposes and operations | Lawful basis under the GDPR |
Analytics, Profiling & Telemetry Data: When you interact with our website, marketing pages, our blog and other content published by us, we collect an online identifiers, such as Internet Protocol (IP) address and Cookie ID, unique identifiers (“Online Identifiers”). These Online Identifiers may be used to derive additional details, such as your approximate geographic location (for example, your country or ZIP code). Additional information is automatically collected regarding your browsing data, interests, including the pages you viewed, actions conducted on such webpages and digital assets, click stream data, access time stamp, referrals, telemetry data, type of browser, device, etc. (all collectively “Tracking Data”). Tracking Data is collected automatically by our third-party service providers and detailed below. | We will use this data to operate our websites, blogs, and forums and enable its proper functionality. For debugging, enhance security, monitor, error corrections, perform activities to maintain the quality or safety of our digital marketing assets. Specifically understand your preferences to enhance and personalize our offering, marketing and sale offers, insights. We need the analytic data to analyze operations, targeting, and advertising, including measure effectiveness of campaigns, track correspondence, build targeted and market the Services. We use one or more third party service providers to serve ads about our products and Services on other Websites, to Prospects that have shown interest in our Services by accessing the websites. This information will be integrated and shared with AI sales tools to analyze your interest and engagement and optimize the marketing and sales activity. | Personal Data (i.e., the Online Identifiers) collected through strictly necessary cookies which are required for the proper and basic operation of the website will be processed in our legitimate interest. Tracking Data is processed subject to your explicit consent provided through the cookie banner placed on the website. You can withdraw at any time by using the cookie preference settings available on the website footer. See our cookie policy for more information. |
| Contact Information: If you voluntarily contact us, register to our newsletter, webinar, demo or other inquiries, including registration for events we host, you may be required to provide us with certain information such as your name, job title, company name, email address, and any additional information you decide to share with us (collectively “Contact Information”). We may also obtain your Contact Information from third-party data enrichment tools. | We will use your Contact Information to respond to your inquiry, provide you with our newsletter (“Newsletter”), communicate with you about our Services and marketing information on Services you have shown interest (“Direct Marketing”), and send related information, including updates, communicate about events or webinars and demos, updates. We may process and retain our correspondence with you to improve our customer service and in the event, we believe it is required to continue to store it, for example, in the event of any claims or in order to provide you with any further assistance (if applicable). | We process Contact Information subject to our legitimate interest when you register for events, webinars, etc. Direct Marketing processing is based on our legitimate interest. You can opt-out at any time using the “unsubscribe” option within the body of the message. Marketing activities processing such as sending Newsletters are based on consent which you can withdraw at any time. |
Communications Data: Any communication between us – whether by email, phone, Zoom, ChatAI, Slack, Zendesk, or other channels – may be processed, recorded and stored, summarized and transmitted. | We use such data to develop, maintain and enhance the quality of our sales activity, provide staff training and AI agent training (for example, with respect to recorded or monitored phone calls or Zoom calls), and train marketing staff. Analyze our calls with you for quality monitoring, compliance purposes [for example in the event of any claims or in order to provide you with any further assistance (if applicable). | Based on our legitimate interest in improving our customer services, training staff. Call recordings are based on consent or notices, as required by law, if you provided your consent, it can be withdrawn at any time during or after the call. |
AI Tools – Chatbot: We use AI powered chat placed on the website (“Chat AI”) which generates automated responses to Prospects’ inquiries. ScyllaDB is not responsible for any content uploaded to the Chat AI (“Prompts”). The Outputs are provided based on the Prompts and are meant to be used solely for convenience, operations, and informational purposes only and do not constitute advice or recommendations. | We process the information provided through Chat AI to provide you with the requested service and support needed, including to provide additional assistance where requested, to communicate with you and to enhance the function of the website and our Services. | We process the information you provide through Chat AI to respond to your inquiries based on our legitimate interests. |
Community Data: When you create an account or participate in ScyllaDB community channels, we may collect information such as your name, username, email address, password (or authentication token if you log in via a third-party single sign-on provider such as Google, GitHub, or LinkedIn), profile photo/ avatar, organization/ employer and role information you choose to provide, and any information you choose to publish or share in the community (including posts, comments, replies, reactions, messages/chats, and other content) (collectively, “Community Data”). | We use Community Data to create and administer your community account, authenticate you (including via single sign-on, where available), provide community features, enable participation in discussions, moderate content and enforce our community rules/terms, respond to your requests, and maintain the security and integrity of our community spaces. | We process Community Data based on our legitimate interest in operating and securing our community spaces and enabling community engagement. |
Customer and Authorized Users’ Account Information: In order to use our Services (including the free trial services) you will need to create an account. The information provided during the registration process will include Customer’s or Authorized Users’ full name, email address, your job title, company name, etc. (“Registration Information”). | We use the Registration Information to create your account, provide account management (including billing and invoices), support and to provide the Services. Identification and authentication and monitoring Account access and use. In addition, we might use your email for Direct Marketing purposes operational emails. | We process Registration Information for the performance of our contract with you. Direct marketing is processed subject to our legitimate interest. You can opt-out at any time using the “unsubscribe” option appears on the bottom of the message. Please note that if you choose to unsubscribe from our direct marketing, we will still retain your contact details and send you service-related emails, such as invoices. |
Customer Testimonials and Published Feedback: If you choose to provide feedback, a testimonial, or agree to be listed as ScyllaDB Customer or otherwise have your feedback published (for example, on our “users” page), we will collect and publish Personal Data such as your name, job title, company name, and photo you provide and approve for publication (collectively, “Testimonial Data”). | We use Testimonial Data to publish and promote customer feedback and experiences with our Services, including on our website and in marketing materials, and to maintain an accurate record of the approval provided for such publication. | We process the Testimonial Data subject to our legitimate interest in marketing and promoting our Services. Where required by applicable law, or where we explicitly request and you provide approval for publication of your name/photo/quote, we will process such Testimonial Data based on your consent, which can be withdrawn at any time by contacting us; withdrawal will not affect processing already performed prior to withdrawal. |
Service Usage Data: When you use our Services or access the Account, we automatically generated and collect Online Identifiers access logs, duration of use, click stream, session recording, Services use, errors or bugs, crash data and analytics, login data, how you interact with the Services and Platform (“Usage Data”). | We use the Usage Data to help us to understand how you are using our Services, and how to better provide and improve our Services. This helps us to better understand our business, analyze our operations, maintain, improve, innovate, plan, design, and develop the Service and our new products, features and technologies that benefit our customers and the public. We may also use Usage Data to resolve technical issues you encounter, to respond to your requests for assistance, to analyze crash information, and to repair the Services. | We process the Usage Data subject to our legitimate interest. |
Customer Support Communications: We will collect and retain customer support communication, ticketing and correspondence, Contact Information, as well as records of our communications which may include email correspondence, chat correspondence, call recording or other means of communication including Chat AI and customer support/customer success AI Agents. The support services can be provided by human, bot, and AI technologies. | We will use the Contact Information to provide the customer support needed. We will retain such correspondence for as long as needed, and to evidence the support was provided. Improve the quality of our products and services, provide staff training (for example, with respect to recorded or monitored phone calls to our contact numbers), and maintain information security. Our correspondence with you, its content and the call recording may be processed and stored by us in order to analyze our customer support efforts, for quality monitoring, training and compliance purposes (for example in the event of any claims or in order to provide you with any further assistance (if applicable)). Internal records to evidence the support was provided or in the event we find needed subject to any potential, actual or threatened claim or dispute with us. | Customer support services are processed subject to contract necessity. Processing the information provided through communications with our customer support for our internal records and service improvement, is based on our legitimate interest. Call recordings will be processed based on your consent. You have the right to withdraw consent at any time. |
Please note that the actual processing operation for each purpose of use and lawful basis detailed in the table above may differ. Such processing operation usually includes a set of operations made by automated means, such as collection, storage, use, disclosure by transmission, erasure, or destruction. The transfer of personal data to third-party countries, as further detailed in Section 10 below “Cross-Border Data Transfer”, is based on the same lawful basis as stipulated in the table above.
In addition, we may use certain Personal Data to prevent potentially prohibited or illegal activities, fraud, misappropriation, infringements, identity thefts, and any other misuse of the Services and to enforce the Terms, as well as to protect the security or integrity of our databases and the Services, and to take precautions against legal liability. Such processing is based on our legitimate interests.
We may collect different categories of Personal Data and Non-Personal Data from you, depending on the nature of your interaction with the Services provided through the website and Platform, as detailed above.
Note however, we will not use your Personal Data for any purpose that is materially different from the purposes for which the information was originally collected as detailed in the table above or subsequently authorized by you or required by applicable law.
Depending on the nature of your interaction with the website and Services, the above detailed data is collected as follows:
We use “cookies” (or similar tracking technologies) when you access our website. The use of cookies is a standard industry-wide practice. A “cookie” is a small piece of information that a website assigns and stores on your computer while you are viewing a website.
Cookies may be used for different purposes such as: (i) allowing you to navigate between pages efficiently; (ii) enabling automatic activation of certain features; (iii) remembering your preferences; and (iv) making the interaction between you and our Services quicker and easier. Cookies are also used to help customize your experience and for advertising purposes (including personalized advertising).
Please see our cookie policy available here, which details the cookies we use on our website, as well as our cookie setting tool available here enabling you to change your settings and preferences ant any time.
Most browsers will allow you to erase cookies from your device, block acceptance of cookies, or receive a warning before a cookie is stored. You may set your browser to block all cookies, including cookies associated with our website, or to indicate when a cookie is being used by us, by adjusting the privacy and security settings of your web browser.
We share your Personal Data with third parties, including our partners or service providers that help us manage our business operations. You can find in the table below information about the categories of such third-party recipients.
| Category of recipient | Data that will be shared | Purpose of sharing |
| Essential service providers, which process data on our behalf, for the purpose of providing the Services, securing and improving the Services. | All types of Personal Data as strictly necessary and on a case-by-case basis. | We may disclose Personal Data to our trusted service providers that provide technology or platforms that are essential for providing the Services (“Essential Service Providers”). Such Essential Service Providers include hosting, and server co-location services, communications and content delivery networks (CDNs), internet service providers, operating systems and platforms, data and cyber security services, fraud detection services, billing and payment processing services, session or activity recording services, support and customer relation management systems. Essential Service Providers are prohibited from using your Personal Data for any purpose other than providing us with requested services. |
| Marketing service providers | Contact Information, Registration Information, Online Identifiers. | Our marketing service providers, that either process on our behalf certain data which we use to target you and offer you our Services, or they provide us with tools to do so. |
| ScyllaDB, Inc. | All types of Personal Data as strictly necessary and on a case-by-case basis | We may share certain information with ScyllaDB Ltd.’s fully-owned subsidiary – ScyllaDB Inc., which provides us with certain required services such as sales services and customer support, as well as for internal compliance. |
| Consultants | All types of Personal Data as strictly necessary and on a case-by-case basis | Our legal, financial and compliance advisors (“Consultants”) may be exposed to certain Personal Data. The Consultants are bound by privilege obligations or confidentiality agreements and are prohibited to share any Personal Data except for providing the services we requested. |
| Necessary Disclosures | All types of Personal Data as strictly necessary and on a case-by-case basis | To the extent permitted or required by applicable law, we may disclose information about you to third parties to: (i) enforce or apply our Terms or any applicable service agreement; (ii) comply with laws, subpoenas, warrants, court orders, legal processes or requests of government or law enforcement officials; (iii) protect our rights, reputation, safety or property, or that of our users or others; (iv) protect against legal liability; (v) establish or exercise our rights to defend against legal claims; or (vi) investigate, prevent or take action regarding known or suspected illegal activities; fraud; our rights, reputation, safety or property, or those of our customers or others; violation of our applicable policies and agreements; or as otherwise required by law. |
When we share information with services providers and partners, we ensure they only have access to such information that is strictly necessary for them to provide the services to us. These parties are required to secure the data they receive and perform their services while ensuring compliance with all applicable data protection regulations.
Note, we will not share your Personal Data with additional third parties or for purposes not detailed in the table above or subsequently authorized by you or required by applicable law. You may contact us directly at: [email protected] regarding our use or disclosure of your Personal Data.
We retain the Personal Data we collect for the minimum period of time necessary to fulfil the purpose for which it was collected, as set forth above, all under the applicable regulation, or until you express your preference to opt out, where applicable. Other circumstances in which we will retain your Personal Data for longer periods of time include: (i) where we are required to do so in accordance with legal, regulatory, tax, or accounting requirements, or (ii) for us to have an accurate record of your dealings with us in the event of any complaints or challenges, or (iii) if we reasonably believe there is a prospect of litigation relating to your Personal Data. Please note that except as required by applicable law, we will not be obligated to retain your data for any particular period, and we may delete it for any reason and at any time, without providing you with prior notice if our intention to do so.
We work hard to protect the Personal Data we collect from unauthorized access, alteration, disclosure, or destruction. We have implemented physical, technical, and administrative security measures for the Services that comply with applicable laws and industry standards, as we further explain in our Security Policy. Further, ScyllaDB undergoes independent third-party audits to confirm that it meets strict industry standards for security, availability, processing integrity, confidentiality, and privacy.
ScyllaDB has been certified to be compliant with the following standards: SOC 2, ISO 27001, ISO 27017 and ISO 27018.
Note that we cannot be held responsible for unauthorized or unintended access beyond our control, and we make no warranty, express, implied, or otherwise, that we will always be able to prevent such access.
Please contact us at: [email protected] if you feel that your privacy was not dealt with properly, in a way that was in breach of our Privacy Policy, or if you become aware of a third party’s attempt to gain unauthorized access to any of your Personal Data. We will make a reasonable effort to notify you and the appropriate authorities (if required by applicable law) in the event that we discover a security incident related to your Personal Data.
We may store or process your Personal Data in various countries, including the United States. As a result, any information you provide to us may be transferred to and processed in countries other than the one from which you accessed our Services. Personal Data transferred from the EU, the UK, or Switzerland to ScyllaDB Inc. is subject, as applicable, to the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”), the UK Extension to the EU-U.S. DPF (“UK Extension”), and the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF”) (collectively, the “DPF Principles”), as further described in our Data Privacy Framework Statement.
Your personal information may be transferred and stored in countries outside the EEA that are subject to different standards of data protection. We will take appropriate measures to ensure that your Personal Data receives an adequate level of data protection upon its transfer. When Personal Data collected within the European Economic Area (“EEA”) is transferred outside of the EEA to a country that has not received an adequacy decision from the European Commission, we will take necessary steps in order to ensure that sufficient safeguards are provided during the transferring of such Personal Data, in accordance with the provision of the EU standard contractual clauses approved by the European Union (SCCs). Additionally, following the withdrawal of the United Kingdom (UK) from the European Union on January 31, 2020, the UK is no longer considered to be a part of the EEA and therefore, the transferring of Personal Data from the EEA to the UK is subject to and made pursuant with the UK standard contractual clauses. In addition to the standard contractual clauses mentioned above we are certified under the EU-US Data Privacy Framework (“DPF”), the UK Extension to the EU-US DPF, and the Swiss-US DPF, which entered into force on July 10, 2023. For more information about our DPF certifications please see our Data Privacy Framework Statement.
Our Services are not directed nor is it intended for use by children and we do not knowingly collect information about anyone under the age of 16. We will discard any information that we receive from a user that is considered a “child” immediately upon our discovery that such a user shared information with us. Please contact us at: [email protected] if you have reasons to believe that a child has shared any information with us.
This section applies to California residents only pursuant to the California Consumer Privacy Act of 2018 as amended by the CPRA (“CCPA”). Please see the CCPA Privacy Notice here which discloses the categories of Personal Information collected, purpose of processing, source, categories of recipients with whom the Personal Information is shared with for a business purpose, whether the Personal Information is sold or shared, the retention period, and how to exercise your rights as a California resident.
Additional notice for United States residents: notice at collection, supplemental U.S. privacy policy, and your privacy rights
This Section contains additional information for residents in the United States, including a summary of our personal information handling practices and your rights under U.S. state privacy laws. “Personal Information” (also referred to as “Personal Data” in this Privacy Policy) means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked (directly or indirectly) with you or your household. We do not offer financial incentives or bond-fide loyalty programs in exchange for the collection, use, or disclosure of Personal Information. For more details regarding our personal information handling practices, please review this Privacy Policy.
13.1. Categories of Personal Information Collected
We may collect, and have collected in the prior 12 months, the following categories of personal information:
Please note that we do not collect, and have not collected in the prior 12 months, personal information that is considered sensitive personal information or data under data privacy laws in the United States.
13.2. Sources of Personal Information
We collect the categories of personal information described in Section 13.1 of this Privacy Policy from the following sources:
13.3. Business or Commercial Purpose for Personal Information Collected
We collect the categories of personal information described in Section 13.1 – Categories of Personal Information Collected – for the following business or commercial purposes:
13.4. Retention of Personal Information
Except as required by applicable law, we are not obligated to retain Personal Information for any particular period, and we may delete it at any time in accordance with our retention practices. For more information, please see Section 8 of this Privacy Policy prior notice.
13.5. Disclosure of Personal Information
We disclose, and may have disclosed in the prior 12 months, the categories of personal information described in Section 13.1 – Categories of Personal Information Collected – in the circumstances described below and for the purposes described in Section 13.1 – Business or Commercial Purpose for Personal Information Collected.
13.6. “Sale” and “Sharing” of Personal Information
We do not “sell” information in the conventional sense of the term (i.e., we do not exchange Personal Information directly for money). However, for retargeting and analytics purposes when promoting our Services, we may use third-party providers, tracking tools, advertising networks, and social media platforms. These services may function by placing cookies, pixels, or other tracking technologies on our website and disclosing online identifiers and browsing or engagement information to these vendors.
13.7. Opt-Out Preference Signals and Do Not Track
A. Opt-Out “do not sell or share my personal information”
You can use the cookie manager available at the footer of the website to opt-out from the sell or share at any time.
B. We Honor Opt-Out Preference Signals
We honor opt-out preference signals. An opt-out preference signal is a signal that is sent by a platform, technology or mechanism on your behalf that communicates your choice to opt-out of the sharing for targeted advertisements or sale of your personal information. You can learn more about implementing opt-out preference signals here or by exploring other developing technologies and services that offer this tool.
We treat opt-out preference signals as valid requests to opt-out of the sale or sharing of your personal information under privacy laws. Ordinarily, an opt-out preference signal is sufficient for us to honor your request, but in some instances, we may request additional information to help facilitate your request for offline sales or sharing. We will not use, disclose or retain this additional information for any purpose other than to facilitate the request.
Please note that you may also opt out of the sale or sharing of your personal information through the other methods described in the Instructions on How to Exercise Your Privacy Rights section below.
C. Do Not Track Requests
Some browsers have incorporated “Do Not Track” features. Most of these features, when turned on, send a signal or preference to the websites you visit indicating that you do not wish to be tracked. Because there is not yet a common understanding of how to interpret the do not track signal, we currently do not respond to the browser do not track signals. However, as noted above, we do honor opt-out preference signals.
13.8. Children
The Website and Services are not intended for or directed at children under the age of 18, and we do not knowingly collect personal information from children under the age of 18. We also do not knowingly sell or share the personal information of children under the age of 18.
13.9. Your Privacy Rights
U.S. state privacy laws may provide consumers certain rights with respect to their personal information, subject to exceptions. Subject to applicable limitations, you may have the following rights:
Instructions on How to Exercise Your Rights:
You may exercise your privacy rights by completing our DSR Form and contact us at [email protected]. You may also exercise your opt-out right by clicking on the Do Not Sell or Share My Personal Information button available on our website.. In some instances, we will need to verify your identity before honoring your privacy right request. We will verify your identity by asking you to provide personal information related to your recent interactions with us. We will honor your privacy rights request within 45 calendar days of receipt, unless we request an extension as permitted by data privacy laws. However, we will honor your opt-out request within 15 business days.
Appealing:
You may appeal a denial of your privacy right requests by contacts us at [email protected]. Within 45 days of receipt of an appeal, we will inform you in writing of any action taken in response to the appeal, including a written explanation of the reasons for the decisions. If we deny your appeal, you may submit a complaint to the Attorney General of your state.
Authorized Agents:
If permitted or required by applicable law, you may exercise your privacy rights through an authorized agent (which may include a guardian or conservator). If we receive your request from an authorized agent, we may ask for evidence that you have provided such agent with a power of attorney or that the agent otherwise has valid written authority to submit requests to exercise rights on your behalf. If you are an authorized agent seeking to make a request, please contact us at [email protected].
Shine the Light Law Disclosure for California Residents:
California law permits residents of California to request certain details about how their information is shared with third parties for direct marketing purposes.
13.10. Questions
You may contact us through the means listed in Section 2 of this Privacy Policy.
