Your data.
A clear explanation.

A reporting copy of your billing data

When you connect Stripe or Paddle, PayQuery imports supported billing records into your workspace. These can include customer names and email addresses, payments, subscriptions, invoices, refunds and provider metadata. We retain source records alongside the reporting tables to support imports and calculations.

Queries run against this imported copy. Running a report does not charge a customer, issue a refund or change a subscription in Stripe or Paddle.

Read-only queries, scoped to your workspace

Each workspace has its own database query role, restricted to its reporting tables. The query service checks that role before execution and runs SQL in a read-only transaction.

SQL validation, execution time limits and result-size limits provide additional controls. Workspace membership is checked on the server; a workspace ID or a link alone does not grant access to private reports.

Provider keys stay on the server

Saved Stripe and Paddle API keys and webhook signing secrets are encrypted with AES-256-GCM before being stored. PayQuery's AI credentials are used by the server, not embedded in the browser app.

Use a dedicated provider key with the read permissions required for your import. You can revoke that key in your provider account to stop future API access. Disable the connection's webhook in the provider separately to stop event deliveries. Neither action deletes data already imported into PayQuery.

What Ask AI receives

Ask AI sends your question, PayQuery's table and column descriptions, and instructions for writing SQL to Anthropic. If a draft needs an automatic correction, the request can also include that draft and its validation feedback.

The drafting step does not automatically read or send your imported customer rows or query results. Anything you type into your question is part of the request, so leave out API keys, passwords and unnecessary personal information.

AI produces a draft for you to review. Read-only protections do not guarantee that a metric, date range or financial calculation is correct.

You choose who can open a report

Reports default to workspace access. Owners and editors can choose a public link or restrict a shared link to selected email addresses. Email-restricted recipients must sign in and verify an allowed address.

A shared report includes the query's returned data, including columns hidden in its visualisation. Remove sensitive columns from the SQL before sharing. Public links can be forwarded to anyone.

Switching back to workspace access disables the shared link. It cannot recall files or information that someone has already copied.

The services behind PayQuery

PayQuery uses Vercel for hosting and web analytics, Supabase for accounts and database storage, Inngest for background processing, Anthropic for AI drafting, Resend for email delivery, and Stripe for PayQuery subscriptions. Stripe and Paddle also supply the billing records you choose to connect.

Our web analytics integration removes query parameters and fragments from page URLs and excludes shared-report pages. Operational alert emails contain failure categories, counts, timestamps and internal workspace or connection IDs, rather than SQL or customer records.

Cancellation and data removal are separate

Canceling your subscription stops its renewal; it does not automatically delete your workspace, imports, saved reports or dashboards. Email help@payquery.app if you want to request removal of account or workspace data.

Questions about data handling or a suspected security issue can be raised through our support page. Please describe the issue without including provider keys or customer records.