Privacy Policy

CoconutDB ("the Platform") is a collaborative backend platform developed and operated by CoconutDB. It allows teams to design and manage data tables, control access permissions, track data changes, automate workflows, and expose REST APIs — all through a unified interface.

This Privacy Policy applies to all users of the CoconutDB platform, including Global Administrators, Workspace Admins, Editors, and Viewers. By accessing or using the Platform, you agree to the collection and use of information described in this policy.

This policy covers only data processed within the CoconutDB platform itself. Data stored in tables, documents, and workspaces that you create belongs to your organisation. CoconutDB acts as a data processor for that content, not a data controller.

CoconutDB collects data in three broad categories: account data you provide directly, operational data generated as you use the platform, and technical data collected automatically.

We process your data only to operate, secure, and improve the CoconutDB platform. We do not sell, rent, or trade personal data to third parties for advertising or commercial profiling purposes.

All CoconutDB data — including table records, vault files, and user credentials — is stored in a PostgreSQL database. Workspace data is physically isolated per workspace (tenant), meaning records from one workspace are never accessible to another.

CoconutDB enforces a layered access model. Each layer determines what a user can see and do within a workspace.

Only the Global Admin can block or permanently delete user accounts platform-wide. Workspace Admins can manage roles inside their own workspace only.

CoconutDB issues two types of credentials for API access. Both carry significant security implications and are governed by this policy.

CoconutDB maintains a real-time activity log for every workspace. This log records API calls, user actions, and system events to support security monitoring and audit requirements.

• Timestamp, HTTP method, endpoint path, and response status for every API call.
• The authenticated user responsible for each action.
• Rate limit breach events and the account that triggered the block.
• Record creation, update, and deletion events in per-row version history.
• Document Vault uploads and deletions.
• Workspace member additions and role changes.

Workspace activity logs are accessible to Workspace Admins and the Global Admin. Viewers and Editors cannot access workspace logs. Individuals may see the version history of records they are permitted to read.

To protect platform stability, CoconutDB automatically blocks any user account that makes 30 or more API calls within a 30-second window. Blocks expire after 5 minutes. Persistent violations may be escalated to the Global Admin.

CoconutDB supports integrations with external systems through webhooks, the Email Dispatcher, and Automation Workflows. When you configure these features, data may be transmitted to third-party systems you control.

CoconutDB is not responsible for the data handling practices of external systems that receive data via webhooks, Email Dispatcher, or Automation Workflows.

Data is retained for as long as your account or workspace is active, plus a defined period after termination to allow dispute resolution, legal obligations, and data recovery requests.

Depending on your jurisdiction, you may have rights over the personal data CoconutDB holds about you. CoconutDB respects these rights and will respond to valid requests within applicable legal timeframes.

• Right to access: request a copy of the personal data we hold about you.
• Right to rectification: correct inaccurate or incomplete personal data via My Profile.
• Right to erasure: request deletion of your personal data, subject to legal constraints.
• Right to portability: receive your personal data in a structured, machine-readable format.
• Right to object: object to processing based on legitimate interest, including activity logging.
• Right to restriction: request that processing of your data is limited in specific circumstances.

To exercise any of these rights, contact us at the address in Section 13. We will verify your identity before processing any request. Requests will be fulfilled within 30 days.

CoconutDB is a professional backend platform intended for use by organisations and adult individuals in a business context. The platform is not directed at, and we do not knowingly collect personal data from, anyone under the age of 18.

If you believe a person under 18 has registered an account or provided personal data through the platform, please contact us immediately using the details in Section 13 so we can remove the data and close the account.

CoconutDB may update this Privacy Policy from time to time to reflect changes to the platform’s features, applicable law, or our data practices. When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Where feasible, notify active workspace administrators via in-platform notification or email at least 14 days before changes take effect.
• For significant changes affecting how we use your personal data, seek fresh consent where required by applicable law.

Continued use of the CoconutDB platform after the effective date of an updated policy constitutes your acceptance of the changes.

If you have questions about this Privacy Policy, wish to exercise your data rights, or need to report a privacy concern, please reach out through the following channels.

For security vulnerabilities or suspected data breaches, please email us with the subject line [SECURITY]. We treat such reports as high priority.

This document constitutes the complete Privacy Policy for the CoconutDB platform. It supersedes any previous versions.