Privacy Policy for Exmergo
Last modified: September 23, 2026
1. Introduction and Scope
This Privacy Policy describes how Exmergo, Inc. ("Exmergo," "we," "us," or "our"), a company incorporated in Delaware, United States, collects, uses, shares, and protects information.
It applies to the Exmergo website at www.exmergo.com and to every Exmergo product. Our products have genuinely different architectures, so the details that matter to you depend on which one you use. Two product annexes carry those details:
- Privacy Policy for Exmergo Viz, our hosted analytics and dashboard service.
- Privacy Policy for Exmergo Dex, our open-source analytics engineering toolkit, which runs on your own machine.
Each annex forms part of this Privacy Policy and is incorporated into it by reference. Where an annex is more specific than this document, the annex governs for that product.
2. Which Policy Applies to You
- You visited our website. This document applies in full. Nothing on the marketing site requires an account.
- You use Exmergo Viz. This document applies, and the Viz annex describes how your uploaded files, connected semantic metadata, query results, prompts, and dashboards are handled.
- You use Exmergo Dex. This document applies only to what you send us directly, such as a support email or a GitHub issue. Dex runs entirely on your own machine and sends us nothing. The Dex annex sets out exactly where your data does and does not travel.
3. Our Role: Controller and Processor
Different data puts us in a different position, and the distinction matters for your rights and for our obligations.
- We are a controller for information whose purposes and means of processing we decide: your account and profile information, billing records, support correspondence, and the usage data we collect on our website and inside Exmergo Viz.
- We are a processor for the content you submit to Exmergo Viz. Files you upload, the prompts you write, metadata and query results received through your connected semantic layer, and your dashboard and session content are processed on your instructions and for your purposes. If that content includes personal data about other people, such as your own customers or employees, you are the controller of it and we act on your behalf.
- We are neither controller nor processor for the data Exmergo Dex reads. Dex connects to your warehouse with your own credentials and returns results to your own agent. We have no access to that data, no copy of it, and no means of obtaining it. See the Dex annex.
A Data Processing Agreement covering our role as processor is available on request at legal@exmergo.com.
4. Information We Collect Across All Services
- Account Information. Your name, email address, and profile picture, received from Google or Microsoft when you sign in through them, together with your account settings and pricing tier.
- Billing Information. Our payment processor, Stripe, Inc., collects your card number, expiration date, and billing address directly. We do not store full payment card details on our servers. We receive and store limited billing records from Stripe, such as the last four digits of your card, the card brand, and your billing country, for account management and support.
- Support and Business Correspondence. Messages you send to our support, sales, legal, or security addresses, and anything you choose to include in them.
Product-specific collection is described in the annexes.
5. The Exmergo Website
Our marketing website collects the following automatically. None of it requires you to sign in, and none of it is tied to a Viz account unless you create one.
- Analytics. We use Google Analytics, delivered through Google Firebase, to understand how the site is used. This records device and browser type, operating system, screen resolution, approximate geographic location such as country and city, how you arrived at the site, which pages you visited, how long you stayed, and which elements you interacted with. It includes a randomly generated client identifier stored in a first-party cookie so that repeat visits can be distinguished from new ones.
- Anonymous session identifier. When you load the site, our application signs you in to Firebase Authentication as an anonymous user. This creates a session identifier used to operate interactive parts of the site. It is not linked to your name or email address, and it does not create an Exmergo Viz account.
- Server logs. Our servers record technical information for security, abuse prevention, and debugging, which may include your IP address, request details, and timestamps.
We do not operate advertising trackers, and we do not run third-party visitor identification or de-anonymization services on this site.
Your choices. You can manage or clear cookies through your browser settings, and you can opt out of Google Analytics collection entirely by installing the Google Analytics Opt-out Browser Add-on.
6. Sub-processors
We share information with the following service providers, only to the extent needed to operate our services:
- Google Cloud Platform and Firebase. Hosting, file storage, our application database, website and product analytics, and the anonymous session identifier described above.
- Google (Gemini). The AI models behind Exmergo Viz. What is and is not sent to them is set out precisely in the Viz annex.
- Google and Microsoft (authentication). When you sign in through a provider, you authenticate directly with them. We receive only basic profile information on success.
- Stripe, Inc. Payment processing for paid plans. Stripe's handling of your payment data is governed by Stripe's Privacy Policy.
Exmergo Dex has no sub-processors, because no data from Dex reaches Exmergo at all.
We may also disclose information where required by law, to enforce our agreements, to protect the rights and safety of our users, or in connection with a merger, acquisition, or sale of assets. If a change of control would place your information under a different privacy policy, we will notify you first.
7. How We Use Information, and On What Basis
| Purpose | Information used | Legal basis (where GDPR applies) |
|---|---|---|
| Providing and operating the service | Account, uploaded files, semantic metadata, query results, prompts, dashboards | Performance of a contract |
| Billing and collecting payment | Account, billing records | Performance of a contract |
| Securing the service and preventing abuse | Server logs, usage data | Legitimate interests |
| Debugging and improving reliability | Server logs, aggregated usage data | Legitimate interests |
| Understanding product usage in aggregate | Analytics data | Consent, or legitimate interests where consent is not required |
| Sending service and account communications | Account information | Performance of a contract |
| Complying with legal obligations | As required | Legal obligation |
Exmergo does not use customer content, including uploaded data, prompts, schemas, semantic metadata, query results, and dashboard and session content, to train its AI models on any Viz plan, including during trials. This commitment concerns Exmergo’s own use of that content; AI-provider processing is described separately in the Viz annex. See section 6 of the Viz annex.
8. Sharing and Sale of Personal Data
We do not sell your personal data. We do not share it for cross-context behavioral advertising, and we do not disclose it to data brokers. We share it only with the sub-processors named in section 6, and only for the purposes described there.
9. Security
We encrypt data in transit using HTTPS and at rest, we rely on the security infrastructure of Google Cloud Platform, and we segregate customer data logically so that one account cannot reach another's. Access to production systems is limited to personnel who need it.
No system is perfectly secure. If you believe you have found a vulnerability in any Exmergo product, please write to security@exmergo.com. For Exmergo Dex, you may also file a private security advisory on the GitHub repository. Please do not include real credentials or raw customer data in a report.
10. Retention
We retain account, billing, and correspondence records for as long as your account is active, and afterwards only as long as needed to meet legal, accounting, or dispute-resolution obligations. Retention of content you submit to a specific product is described in that product's annex. Analytics and server log data are retained on a rolling basis and are not kept indefinitely in identifiable form.
11. Your Privacy Rights
Subject to your location and applicable law, you may have the right to:
- Access the personal information we hold about you, and receive a copy of it.
- Rectify information that is inaccurate or incomplete.
- Erase your personal information, subject to legal limitations.
- Port your information in a structured, commonly used, machine-readable format.
- Restrict how we process your information.
- Object to processing carried out on the basis of legitimate interests.
- Withdraw consent at any time, where processing is based on consent. Withdrawal does not affect processing already carried out.
- Be free from discrimination for exercising any of these rights.
You can manage much of this yourself inside Exmergo Viz, including deleting uploaded files, dashboards, and sessions or revoking semantic-layer connections. Revoking a connection stops future access but does not delete previously saved results. Deleting content in Viz does not delete data in your connected source systems. For anything else, write to support@exmergo.com. We will respond within the period required by applicable law, and we will not charge you for a reasonable request. You may authorize an agent to act for you, and you may lodge a complaint with your local supervisory authority.
If you are a customer's end user and your personal data reached us because someone else submitted it or made it available through a connected semantic layer, please contact that organization first. They are the controller, and we will refer your request to them.
12. International Data Transfers
Our services are hosted and operated in the United States. Using them means your information may be processed and stored in the United States and in other countries where our sub-processors operate.
Where we transfer personal data out of the European Economic Area, the United Kingdom, or Switzerland, we rely on the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum where applicable, as the transfer mechanism, supported by additional technical and organizational measures.
Storage location depends on your plan:
- Pro and Ultra plans. Information received and handled by Viz, including uploaded files, semantic metadata, query results, and account information, is processed and stored on servers in the United States.
- Enterprise plans. You may select a specific geography, for example within the European Union, for storage and processing. Your enterprise agreement governs the specifics.
These locations apply to information handled by Exmergo. Connecting a dbt Semantic Layer to Viz does not relocate or replicate your underlying warehouse or its raw dataset.
13. Children's Privacy
Our services are not directed to anyone under 16, and we do not knowingly collect personal information from children. If we learn that we have, we will delete it promptly. If you are a parent or guardian and believe your child has provided us with personal information, please contact us.
14. Governing Law
This Privacy Policy, and any dispute arising from it, is governed by the laws of the State of Delaware, United States, without regard to its conflict of law provisions. Nothing here limits rights you hold under the mandatory law of your own country of residence.
15. Changes to This Policy
We may update this Privacy Policy and its annexes from time to time. We will post the revised version here and update the date at the top. If a change materially affects how we handle your information, we will give you notice through the service or by email before it takes effect.
16. Contact Us
Exmergo, Inc. 1111B S Governors Ave # 58620, Dover, DE 19904, United States
- General and privacy requests: support@exmergo.com
- Legal, DPAs, and contracts: legal@exmergo.com
- Security reports: security@exmergo.com
Annex A: Exmergo Viz
Exmergo Viz is a hosted service at viz.exmergo.com. You upload files or connect your dbt Semantic Layer, ask questions in plain English, and publish dashboards. Uploaded files are stored privately and queried within our infrastructure. dbt Semantic Layer is our only data connector: Viz receives semantic metadata and query results on demand without importing or replicating the underlying raw dataset. Results may be retained in sessions, dashboards, and published snapshots.
Google’s Gemini models receive prompts and conversation history, together with uploaded-file schemas, samples and aggregated results, or connected semantic metadata and query results, to generate queries and visualizations. Uploaded files themselves and stored connection credentials are not sent to those models. Exmergo does not use customer content to train its AI models on any plan, including during trials. Viz has no free tier; file uploads remain available on all plans.
Read the full annex: Privacy Policy for Exmergo Viz.
Annex B: Exmergo Dex
Exmergo Dex is an open-source toolkit that runs on your own machine, inside your own coding agent, using your own warehouse credentials. It has no Exmergo account, no Exmergo server, and no telemetry. Nothing about your data, your queries, or your usage is transmitted to Exmergo. Your data travels only to your warehouse and to the AI model provider your own agent is configured with, under your agreement with them.
Read the full annex: Privacy Policy for Exmergo Dex.