privacy policy.
Effective: May 26, 2026
the cli runs on your machine. we never see your data.
satus is a command-line tool. It reads your Postgres schema, talks to the LLM provider whose API key you supply, and writes rows back to your database—all on your machine. PasskeyBridge LLC, the operator of satus.sh, never sees your schemas, the rows generated, the prompts sent to your LLM, or the contents of your database.
The only personal data we collect is what passes through the satus.sh website: the email address you give us to receive a license key, the billing data Stripe needs to charge your card, and a small amount of aggregate web analytics. That’s it.
passkeybridge llc, a wyoming company.
satus.sh is operated by PasskeyBridge LLC, a Wyoming limited liability company located at 5830 E 2nd St., Ste 7000 #33652, Casper, WY 82609. For the purposes of GDPR, we are the data controller for the data described in this policy.
three buckets. nothing about your database.
Account & billing. When you purchase a license we collect your email address and the billing data Stripe requires (name, country, last four digits of card, billing address). Full card numbers are processed by Stripe and never reach our servers.
License telemetry. The CLI sends your license key to /api/public/license/verify to confirm it is valid. The verification request includes only the license key and a generic User-Agent string. To rate-limit abuse, the request IP is hashed in memory (SHA-256, truncated) for the lifetime of the Worker isolate and discarded; we do not persist your IP, your machine ID, or any project metadata against your key.
Web analytics. The marketing site uses Ahrefs Web Analytics, a cookieless analytics product that records aggregate pageviews and referrer domains. It does not set tracking cookies, does not build a profile of you, and does not identify you across sites.
What we do not collect. We never receive your database schema, connection string, generated rows, LLM prompts, LLM responses, or LLM API key. None of those ever leave your machine.
contract performance and legitimate interest.
We process the data above under the following GDPR lawful bases:
- Contract performance (Art. 6(1)(b)): account email and billing data, to deliver your license and process payment.
- Legitimate interests (Art. 6(1)(f)): license verification and aggregate analytics, to operate the Service and prevent license abuse.
- Consent (Art. 6(1)(a)): any future marketing emails (opt-in only).
a short, named list.
We use the following sub-processors to operate the Service:
- Stripe, Inc.—payment processing. Privacy policy.
- Cloudflare, Inc.—hosting, edge runtime, and DDoS protection for satus.sh.
- Supabase, Inc.—database hosting for license records and transactional email infrastructure.
- Ahrefs Pte. Ltd.—cookieless web analytics.
We will notify customers by email at least 30 days before engaging a new sub-processor that has access to personal data.
only as long as needed.
License records (email, license key, purchase date) are retained for the duration of your active subscription plus seven (7) years thereafter to satisfy U.S. tax-record obligations. Aggregate analytics data is retained for 14 months. Transactional emails are retained for 90 days for delivery-troubleshooting purposes, then purged.
international, governed by sccs.
We are based in the United States and our sub-processors operate globally. Transfers of personal data from the EEA, UK, or Switzerland to the United States rely on the European Commission’s Standard Contractual Clauses (SCCs) and, where applicable, on Stripe’s and Cloudflare’s certification under the EU–U.S. Data Privacy Framework.
access, erase, port, object.
Depending on your jurisdiction you have the right to:
- Access the personal data we hold about you (GDPR Art. 15, CCPA §1798.100, PIPEDA Principle 9).
- Rectify inaccurate data (GDPR Art. 16).
- Erase your data, subject to legal retention obligations (GDPR Art. 17, CCPA §1798.105).
- Port your data to another service (GDPR Art. 20).
- Object to processing based on legitimate interests (GDPR Art. 21).
- Withdraw consent at any time (GDPR Art. 7(3)).
- Non-discrimination for exercising your rights (CCPA §1798.125).
To exercise any of these rights, email support@satus.sh. We respond within 30 days (45 days for CCPA requests). California residents may designate an authorized agent in writing. EU residents may also file a complaint with their local supervisory authority; Canadian residents may file a complaint with the Office of the Privacy Commissioner of Canada.
not directed at anyone under 16.
satus is a developer tool intended for use by adults in a professional context. We do not knowingly collect personal data from anyone under 16. If you believe a minor has provided us with personal data, contact us and we will delete it.
encrypted in transit and at rest.
All traffic to satus.sh and to /api/public/license/verify is served over TLS. License records are stored in an encrypted Postgres database; payment data is held by Stripe (PCI-DSS Level 1). For coordinated vulnerability disclosure, scope, and the embargo timeline, see our security policy.
we’ll notify you of material changes.
We may update this policy from time to time. Material changes will be announced by email to the address associated with your license at least 30 days before they take effect. The current version is always available at this URL with an updated effective date.
one address. a human reads it.
PasskeyBridge LLC
5830 E 2nd St., Ste 7000 #33652
Casper, WY 82609
United States
Email: support@satus.sh
Web: satus.sh