ClickHouse Privacy Policy

Last modified on May 1, 2024

Archive version here

This Privacy Policy describes how ClickHouse, Inc. and its affiliates and subsidiaries (“ClickHouse”, “we”, “us” and “our”) processes information about you in connection with our business. It covers personal information that is provided to us via websites that link to this Privacy Policy (the “Sites”) and your registration or participation in sales and marketing events sponsored by our partners or by us. It also covers certain information (such as account data and usage data, as described below) that is provided to us via your use of our Software-as-a-Service (SaaS) offering. This Privacy Policy also describes certain rights that you have with regard to our processing of your personal information. We provide additional information for residents of the European Economic Area (“EEA“), Switzerland, or the United Kingdom and United States residents as identified below.

Our SaaS offering is a cloud-based service that provides access to and use of the ClickHouse column-oriented columnar database management, analysis and reporting system (the “Cloud Service''). We also offer support and professional services to better enable Authorized Users (defined below) to configure and use our software and the Cloud Service (such services, together with the Cloud Service, the “Services”). We provide the Services to our customers under an agreement with them and solely for their benefit and the benefit of their personnel and other personnel authorized by them as users of the Cloud Service (“Authorized Users”).

This Privacy Policy does not apply to data that Authorized Users upload or otherwise ingest into the Cloud Service or otherwise provide to us in connection with the Services (collectively, “Content”). We process such Content pursuant to instructions provided by the customer (i.e., the customer is the “controller” or “business”, and we are the “processor” or “service provider”) and our processing is governed by the applicable customer agreement. To the extent that your personal information is included as Content that is provided to us by a customer, you should refer to the applicable customer privacy statement regarding the customer’s processing of your personal information and your rights with respect to such processing.

We recommend that you read this Privacy Policy in its entirety to ensure you are fully informed. Nevertheless, if you only want to access a particular section of this Privacy Policy, then you can click on the relevant link below to jump to that section.

1. Personal information we collect
2. How we use personal information
3. How we share personal information
4. Your choices
5. Processing personal information in the US
6. Other sites and services
7. Data security
8. Children
9. Changes to this Privacy Policy
10. How to contact us
11. Supplemental notice to authorized users
12. Supplemental notice to residents of the EEA, Switzerland and the United Kingdom
13. Supplemental notice to United States residents

---

Information you provide to us, such as:

• Registration, contact and account data. This information is provided to us when you create an account for a Service (“account data”), engage with us through online chat applications, or when your register with our website(s), e.g., to attend an event, watch a video, obtain training or get access to a whitepaper, and includes information such as your first and last name, email address, job function, company name, company size and other information relating your interest in our company or our Services (e.g., type of use case, type of training, etc.).
• Payment and transaction data. If you enter into a self-service transaction with us, we will collect payment and transaction data. This information is collected by our payment service provider and we do not have access to payment card numbers.
• Communications that we exchange with you, including when you contact us with questions, feedback, engage with us through online chat applications, or otherwise.
• Marketing data, such as your preferences for receiving our marketing communications, and details about your engagement with them.
• Other data not specifically listed here, which we will use as described in this Privacy Policy or as otherwise disclosed at the time of collection.

Third party sources. We may also obtain personal information about you from other sources, such as:

• Marketing and/or business partners, such as contact information from business partners with whom we operate co-branded events or other data providers, search results and links from third-party advertisers, and credit history information from credit bureaus.
• Integrated services providers, such as transaction information from our payment service provider.
• Resellers, distributors, joint marketing/co-hosted event providers, such as contact information and conference attendance information from events providers.
• Social media platforms, such as search results and links, including paid listings (such as sponsored links).
• Google sign-in services. If you choose to create or sign into a ClickHouse Cloud account using Google sign-in Services, then Google sign-in services will authenticate your identity and provide you with the option to share with us certain information, such as your full name, language preference, nickname, e-mail address and picture. ClickHouse receives this data from Google as part of the creation, authentication and authorization framework in connection to your ClickHouse Cloud account.

Automatic data collection. We may automatically log information about you when you visit the Sites and/or when you use our Services.

When you visit our Sites, we may automatically collect device data such as the type of computer or mobile device that you are using or your computer’s or mobile device’s operating system type and version, manufacturer and model, browser type, screen resolution, RAM and disk size, CPU usage, IP address, unique identifiers (including identifiers used for advertising purposes), language settings, mobile device carrier, radio/network information (e.g., WiFi, LTE, 5G), and general location information such as city, state or geographic area.

When you visit our Sites, we may also automatically collect online activity data such as pages or screens you viewed, how long you spent on a page or screen, the website you visited before browsing to our Site, navigation paths between pages or screens, information about your activity on a page or screen, access times, and duration of access, and whether you have opened our marketing emails or clicked links within them.

When you use our Cloud Service, we automatically collect certain data (“usage data”) relating to the configuration, use and performance of the Cloud Service by the account holder and other Authorized Users of the Cloud Service. Such data may include:

• Information about the Authorized User’s equipment, such as a user ID or IP address, user email address and/or information about the user’s device (e.g., type of computer or mobile device) and software (e.g., operating system and/or browser versions)
• Information about the Authorized User’s activity, such as click patterns, features accessed, commands used within the Cloud Service, types and size of data and files analyzed by the Cloud Service and other statistical information.
• Technical information about the Cloud Service, such as log files that are generated in connection with access, use and maintenance of the Cloud Service.

To the extent that usage data collected includes personal data, we will process such data in accordance with the terms of this Privacy Policy.

We use standard automated data collection tools such as cookies, web beacons, tracking pixels and the to collect data from our Sites and Services. For more information on the use of cookies and other tracking technologies, including how to opt out of certain collections, please see our Cookie Policy. We may share information about your computer or other device with our third-party service providers for information and network security, including fraud detection.

We use your personal information for the following purposes or as otherwise described at the time of collection:

Site operation and services delivery. We use your personal information to:

• Provide, operate, audit and improve our Sites, our Services and our business;
• Communicate with you about our Sites and our Services, including by sending invoices, announcements, updates, security alerts, and support and administrative messages;
• Provide customer service and support, and respond to your requests, questions and feedback. For example, when you engage with us through online chat applications, we may record and review the chat in order to improve your experience with us or help address your questions;
• Maintain your account(s); and
• Detect bugs, report errors and perform activities to maintain the quality or safety of our Sites and Services.

Research and development. To research, develop, create and implement new features and capabilities for our Sites and our Services.

Marketing and advertising/customer experience. We may use personal information for marketing and advertising purposes and to improve your customer experience, including to:

• Better understand you and your preferences so that we may personalize your experience when using our Sites and/or Services;
• Conduct contests or other marketing campaigns and process awards or rewards;
• Link or combine it with other personal information we get from third parties, to further develop our understanding of you and your preferences and/or to prevent fraud
• Send you marketing communications about our Sites and our Services; and
• Evaluating the effectiveness of our marketing campaigns.

Interest-based advertising. We engage our advertising partners, including third party advertising companies and social media companies, to advertise our Services. We and our advertising partners may use cookies, clear gifs and similar technologies to collect information about your interaction (including the data described in the “Automatic data collection" section above), our communications with you and our Sites, and use that information to serve online ads.

This Privacy Policy does not apply to, and we are not responsible for, cookies or clear gifs in third party ads, and we encourage you to check the privacy policies of advertisers and ad services providers and social media companies to learn about their use of cookies and other technology. You can learn more about your choices for limiting interest-based advertising in the “Your Choices" section below.

Compliance and protection. We may use personal information to:

• Comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas or requests from government authorities;
• Protect our, your or others’ rights, privacy, safety or property (including by making and defending legal claims);
• Audit our internal processes for compliance with legal and contractual requirements and internal policies;
• Enforce the terms and conditions that govern our Site(s) and Services;
• Enhance security and to monitor and verify identity or service access; and
• Prevent, identify, investigate and deter fraudulent, harmful, unauthorized, malicious, unethical or illegal activity, including cyberattacks and identity theft.

We may share your personal information with:

Service providers. Companies and individuals that provide services on our behalf or help us operate our Sites, our Services or our business (such as hosting, information technology, customer support, email delivery, and website analytics services).

Business partners. Distributors, resellers, referral partners and similar third parties that are involved in the marketing, sales or delivery of our services. From time to time, we may engage in joint sales or promotional activity with select business partners. If you purchase or specifically express an interest in a jointly offered product, promotion or service, we may share your personal information with the relevant partner. With your consent, these business partners may also send you marketing communications about their own products and services.

Advertising partners. When you visit our Sites, third party advertising companies may use automated technologies to collect information for interest-based advertising purposes described above. We do not allow advertising partners to collect this data from our Cloud Service after you log into your ClickHouse account.

Professional advisors. Professional advisors, such as lawyers, auditors, bankers and insurers, where necessary in the course of the professional services that they render to us.

Authorities and others. Law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate for the compliance and protection purposes described above.

Other business transferees. Acquirers and other relevant participants in business transactions (or negotiations for such transactions) involving a corporate divestiture, merger, consolidation, acquisition, reorganization, sale or other disposition of all or any portion of the business or assets of, or equity interests in, Company or our affiliates (including, in connection with a bankruptcy or similar proceedings).

ClickHouse affiliates. If your personal information is shared with our affiliates, the processing of the personal information will remain subject to this privacy statement.

As you instruct us. We may also share your personal information where you instruct us to do so or where you have provided consent (for example, when you agree to share your information with third parties for their own marketing purposes, subject to their data protection policies).

Opt out of marketing communications. You may opt out of marketing-related communications by following instructions contained in the marketing communications we send you. If you opt out, we may still send you emails that are not marketing related, such as emails about your accounts or our ongoing business relations.

Online tracking opt-out. For a description of how you may opt-out of online tracking (e.g., cookies), see our Cookie Policy.

We have personnel and use service providers located in the United States. To provide our Services and operate our Sites, it is necessary for us to process personal information in the United States.

Our Sites and Services may contain links to websites and other online services operated by third parties, including (without limitation) video sharing sites such as YouTube, messaging services such as Slack and social media sites such as LinkedIn. We may also make available certain features that allow you to sign into our Sites or Services using third party login credentials or authentication services (such as AuthO) or access third party services from our Services (such as Github). In addition, our content may be integrated into web pages or other online services that are not associated with us. These links and integrations are not an endorsement of, or representation that we are affiliated with, any third party. We do not control websites or online services operated by third parties, and we are not responsible for their actions. Your use of the third-party websites, applications and any information you authorize us to send to the third-party will be subject solely to the third-party’s terms and conditions and privacy notice, and will not be subject to any agreements you have with us or this Privacy Policy.

We employ a number of technical, organizational and physical safeguards designed to protect the personal information we collect. However, no security measures are failsafe and we cannot guarantee the security of your personal information.

The Site and the Services are not intended for use by children under 18 years of age. If we learn that we have collected personal information through our Site or Services from a child under 18 without the consent of the child’s parent or guardian as required by law, we will delete it.

We reserve the right to modify this Privacy Policy at any time. If we make material changes to this Privacy Policy, we will notify you by updating the date of this Privacy Policy and posting it on the website.

You can reach us by email at [email protected] or at the following mailing address:

ClickHouse, Inc.
c/o Goodwin Proctor LLP
601 Marshall St
Redwood City, CA 94063
Attn: Privacy Practice Group

Where our Services are made available to you through an organization (e.g., your employer), that organization is the administrator of Services and responsible for the accounts and/or services over which it has control. For example, administrators can access and change information in your account or restrict and terminate your access to the Services. We are not responsible for the privacy or security practices of an administrator's organization. Please contact your organization or refer to your organization's policies for more information.

Controller. ClickHouse is the controller of your personal information covered by this Privacy Policy for purposes of applicable data protection law.

Legal basis for processing. We use your personal information only as permitted by law. Our legal bases for processing the personal information described in this Privacy Policy are described in the table below.

Processing purpose	Relevant third parties	GDPR legal basis
Site operation and services delivery	ClickHouse affiliates Service providers Business partners Professional advisors	Processing is necessary to operate our Sites or to perform the contract governing our provision of our Services or to take steps that you request prior to signing up for the Services. If we have not entered into a contract with you, we process your personal information based on our legitimate interest in providing the information and/or services you access and request.
Research and development Marketing and advertising/customer experience Compliance and protection	Business partners Advertising partners	These activities constitute our legitimate interests. We do not use your personal information for these activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).
Comply with law	Authorities and others	Processing is necessary to comply with our legal obligations

Use for new purposes. We may use your personal information for reasons not described in this Privacy Policy where permitted by law and where the reason is compatible with the purpose for which we collected it. If we need to use your personal information for an unrelated purpose, we will notify you and explain the applicable legal basis.

Special categories of personal information. We ask you not to provide any personal information that would fall within the special categories of personal data under applicable data protection law because we do not have the ability to identify or offer enhanced protections for these special categories of personal information. If you choose to provide us with any personal information from a special category, we will process it as “personal information” in accordance with this Privacy Policy.

Your rights. Data protection laws give you certain rights regarding your personal information. If you are located in Europe, you may ask us to take the following actions in relation to your personal information that we hold:

• Access. Provide you with information about our processing of your personal information, including the categories of personal information we collect, the sources from which personal information is collected, the business purpose for collecting and sharing personal information, and the categories of third parties to whom we disclose personal information, and give you access to your personal information.

• Correct/rectification. Update or correct inaccuracies in your personal information.

• Delete/erasure. Delete your personal information.

• Transfer/portability. Transfer a machine-readable copy of your personal information to you or a third party of your choice.

• Restrict. Restrict the processing of your personal information.

• Object. Object to our reliance on our legitimate interests as the basis of our processing of your personal information that impacts your rights.

• Withdraw consent. If we collected and processed your personal information with your consent, where required by law, you may withdraw your consent. Refer to “Your Choices” above for how to opt out. Withdrawing your consent does not affect the lawfulness of any processing we conducted prior to your withdrawl, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent.

You may submit these requests by email to [email protected] or our postal address provided above. You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

We may request specific information from you to help us confirm your identity and process your request. Applicable law may require or permit us to decline your request. If we decline your request, we will tell you why, subject to legal restrictions. If you would like to submit a complaint about our use of your personal information or our response to your requests regarding your personal information, you may contact us or submit a complaint to the data protection regulator in your jurisdiction. You can find your data protection regulator here. You can find contact details for data protection authorities in the EEA available here, in the United Kingdom here, and in Switzerland here.

Processing of personal information in other countries. To provide our services we may store and process your personal information where ClickHouse and its affiliates and its third-party service providers conduct business. Our affiliates and third parties may be found here: https://clickhouse.com/legal/agreements/subprocessors. These locations may be outside of your country of residence, including, in the United States, where different data protection laws apply. Any such the transfer will be performed pursuant to the applicable requirements of the law, such as standard contractual clauses, the individual’s consent, or in other circumstances permitted by applicable data protection law. We have implemented safeguards for the protection of any personal information that is transferred and put in place appropriate terms to protect your personal information in our agreements with our service providers.

EU-U.S. Data Privacy Framework. ClickHouse has self-certified to the Department of Commerce that we adhere to the Data Privacy Framework Principles (“Principles”) of the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework, as further described in the ClickHouse Data Privacy Framework Notice, and ClickHouse complies with all its obligations under the Principles. Note that ClickHouse currently relies on the framework only for transfers of personal data from the EU/EEA/Switzerland and the UK to the United States in its role as a processor of such personal data for our customers. ClickHouse does not currently rely on the frameworks for transfers of Personal Data from the EU/EEA/Switzerland and the UK to the United States in its role as a controller. Instead, we continue to rely on standard contractual clauses. To learn more about the Data Privacy Framework program, please visit https://www.dataprivacyframework.gov/, where you can view ClickHouse’s certifications.

Data retention. We retain personal information for as long as necessary to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements, to establish or defend legal claims, or for fraud prevention purposes. When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize it or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

We are providing this supplemental privacy notice to residents of various states of the United States as required by such state privacy laws including, to the extent applicable, the California Consumer Privacy Act of 2018, as amended (“CCPA”) the Colorado Privacy Act (CPA), the Connecticut Data Privacy Act (CTDPA), and the Virginia Consumer Data Protection Act (VCDPA).

Below, we describe the categories of personal information (as specifically described in the CCPA), that we have collected within the preceding 12 months and may collect on a going-forward basis:

• Identifiers, such as a real name, postal address, unique personal identifier, online identifier, internet protocol address, and email address
• Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)). such as name, postal address, email address
• Commercial information, such as transaction data and information related to the Services you’ve purchased
• Internet or other similar network activity information, such information regarding your interaction with our Sites or Services
• Geolocation data, such as your general location derived from an IP address
• Audio, electronic, visual, or similar information, such as audio or video recordings of you and/or recordings and transcripts of your interaction with chat services
• Professional or employment-related information
• Education information, for example if you apply for employment
• Inferences drawn from the preceding categories of personal Information, such as aggregated metrics
• The following categories of sensitive personal information (as described in CCPA): you account log-in, credit or debit card number, in combination with your credentials required for you to access your account

For more information about the categories of personal information (such as the sources and uses of such categories) we collect, see the “Personal Information We Collect” and the “How We Use Personal Information” sections above.

Below, we describe the categories of personal information (as specifically described in the CCPA), that we have disclosed for a business purpose (as defined in the CCPA) within the preceding 12 months and may disclose on a going-forward basis:

• Identifiers, such as a real name, postal address, unique personal identifier, online identifier, internet protocol address, and email address
• Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)), such as name, postal address, email address
• Commercial information, such as transaction data and information related to the Services you’ve purchased
• Internet or other similar network activity information, such information regarding your interaction with our Sites or Services
• Geolocation data, such as your general location derived from an IP address Audio, electronic, visual, or similar information, such as audio or video recordings of you and/or recordings and transcripts of your interaction with chat services
• Professional or employment-related information
• Education information, for example if you apply for employment
• Inferences drawn from the preceding categories of personal Information, such as aggregated metrics
• The following categories of sensitive personal information (as described in CCPA); you account log-in, credit or debit card number, in combination with your credentials required for you to access your account

We do not sell or share (for the purpose of cross-context behavioral advertising) your personal information, as we understand those terms to be defined under applicable state privacy law and the relevant implementing regulations.

Under applicable state privacy law, you have the following rights regarding personal information that we have collected and process about you:

• Right to know. You have a right to know categories of personal information that we process and the purpose of such processing. In this Privacy Policy we describe how we collect, use and share your personal information, including during the past 12 months. We describe the sources through which we collect personal information and the types of personal information collected in the Personal Information We Collect and the Categories of Personal Information Collected sections above. We describe the purposes for which we use and share this information in the How We Use Personal Information, How We Share Personal Information and Categories of Personal Information Disclosed for a Business Purpose sections above. As noted above, we do not “sell” or “share” personal information, as we understand sale to be defined under state privacy law.
• Access. You have the right to obtain a copy, in a portable format, of personal information that we collect, use, disclose, share, and sell about you.
• Correct. You have a right to make us update or correct inaccuracies in your personal information.
• Deletion. You can ask us to delete the personal information that you have provided to us or that we maintain about you.
• Transfer. You have a right to make us transfer a machine-readable copy of your personal information to you or a third party of your choice.
• Opt-out. You have the right to opt-out of the sale of your personal information. If you are a California resident, you also have the right to opt-out of the sharing of your personal information for cross-context behavioral advertising, as well as the right to limit the use or disclosure of sensitive personal information for purposes other than those permitted by the CCPA. As noted above, we do not “sell” or “share” personal information, as we understand those terms to be defined under state privacy law and the relevant implementing regulations; nor do we use or disclose sensitive personal information for purposes other than those permitted by the CCPA. You may opt-out of certain third party cookies in the Cookie Settings and as otherwise described in our Cookie Policy.

You are entitled to exercise the rights described above free from discrimination.

Here is how you can submit requests:

• To request access to or deletion of personal information collected via our Services, please email us at [email protected].
• To learn how to limit tracking, please see our Cookie Policy.
• To verify your identity prior to responding to your requests, we may ask you to confirm information that we have on file about you or your interactions with us. Where we ask for additional personal information to verify your identity, we will only use it to verify your identity or your authority to make the request on behalf of another consumer.
• Authorized agents. California residents can empower an “authorized agent” to submit requests on their behalf.