Privacy Policy
Last updated: 25 July 2026
This Privacy Policy explains how Mortar, provided under the name MortarSec by an individual operating as a sole proprietorship established in Poland ("Mortar", "MortarSec", "we", "us", "our"), collects and uses personal data when you visit mortarsec.com, request access, or use the Mortar product at app.mortarsec.com.
Mortar is an access-governance product for Databricks Unity Catalog. A short summary before the detail:
- We are a data processor for the access metadata inside your Databricks estate - we process it on your instructions, and you remain the controller. See the Data Processing Addendum.
- We are a data controller for the limited personal data of website visitors and the people on your Mortar account (name, email, role).
- We do not read the contents of your tables. Mortar reads access metadata (group names, memberships, grants, ACLs) - not the data those grants protect.
- Our infrastructure is hosted in the European Union (Frankfurt, Germany).
- We do not sell personal data. We do not use it for advertising.
If you have questions, contact privacy@mortarsec.com.
1. Who we are
Mortar operates under the name MortarSec, run by an individual as a sole proprietorship established in Poland. (MortarSec is not yet incorporated as a company; a registered entity and address will be added here on incorporation.) For data-protection questions, contact privacy@mortarsec.com. For security matters, security@mortarsec.com.
We are the controller for the personal data described in Section 2. Where we process personal data contained in your Databricks estate on your behalf, we act as a processor and that processing is governed by our Data Processing Addendum, not this policy.
2. What we collect and why
2.1 When you visit the website or request access
| Data | Purpose | Lawful basis (GDPR Art. 6) |
|---|---|---|
| Name, work email, company, role, and any message you type into the access/demo/security-pack form | To respond to you, arrange a demo, send the security pack, and evaluate fit | Legitimate interest (Art. 6(1)(f)) and steps prior to entering a contract (Art. 6(1)(b)) |
| Server logs (IP address, user agent, timestamp) | Security, abuse prevention, rate limiting | Legitimate interest (Art. 6(1)(f)) |
We do not run third-party advertising or analytics trackers on the marketing site. See Cookies below.
2.2 When you use the Mortar product
| Data | Purpose | Lawful basis |
|---|---|---|
| Your Mortar account: name, email, role, last-login time (managed through our identity provider, Clerk) | Authentication, access control, account administration | Performance of a contract (Art. 6(1)(b)) |
| Billing details (handled by Stripe; we store only a customer reference and plan state, never card numbers) | Billing and payment | Performance of a contract (Art. 6(1)(b)) |
| Product telemetry: audit log of actions taken in Mortar, error reports | Security, audit, reliability, support | Legitimate interest and legal obligation |
2.3 Access metadata from your Databricks estate (processor role)
When you connect a Databricks account, Mortar reads access metadata to build the governance picture: group names and memberships, catalog / schema / table / volume names and their grants, service principals, workspace object ACLs, secret-scope ACLs, and account/metastore admin assignments. This metadata can contain personal data - principally the names and email addresses of the people in your Databricks directory (group members, stewards, admins).
We process this metadata only to provide the product to you (resolve effective access, detect drift, surface risk, run reviews and certifications, and - only when you initiate it - execute an access change). We act as your processor; you are the controller. The terms are in the DPA.
We do not read the contents of your data. Mortar reads who can access what, not the rows themselves.
3. What we never do
- We do not sell or rent personal data.
- We do not use your estate metadata to train models, or for any purpose other than providing the product to you.
- We do not use your data to benefit another customer. Tenants are isolated at the database level (row-level security) and in the application.
4. Credentials and secrets
To read your estate, Mortar stores connection credentials (a read-only service-principal secret, or - preferably - a per-user OAuth token where you act as yourself). These are encrypted at rest (Fernet / AES) with a key held outside the database, and are never returned by the API or shown in logs. Mortar's scanner is read-only by construction; any change to your estate is executed under a human's own identity, never a god-mode service principal. See Security & trust.
5. Who we share data with (subprocessors)
We use a small set of infrastructure providers to run Mortar. Each is bound by a data-processing agreement and processes data only to provide its service to us. The current list, with location and purpose, is maintained at /legal/subprocessors. In summary they cover: cloud hosting (EU), database (EU), authentication, payments, transactional email, DNS/CDN, and error monitoring. Some are established in the United States; transfers to them are covered by Standard Contractual Clauses (see Section 7).
6. How long we keep it
- Website leads / enquiries: kept while we are in contact and for a reasonable follow-up period, then deleted.
- Account data: for the life of your account.
- Estate scan snapshots: rolling 90 days by default (older snapshots are pruned; the latest per workspace is retained so the current picture survives).
- Audit log: retained per your account's configured retention (or indefinitely if you choose), because it is an integrity record.
- On termination or on request: we delete your tenant's data. See Section 9.
7. International transfers
Mortar's primary infrastructure (compute and database) is in the European Union (Frankfurt). Some subprocessors are established in the United States. Where personal data is transferred outside the EEA, we rely on the European Commission's Standard Contractual Clauses and appropriate supplementary measures. The subprocessor list notes each provider's location.
8. Cookies
Mortar uses only strictly-necessary cookies - the ones required to sign you in and keep you signed in, and to honour a read-only share link if you follow one:
| Cookie | Set by | Purpose | Type |
|---|---|---|---|
__session, __client_uat | Clerk (our identity provider) | Keep you authenticated | Strictly necessary |
mortar_share_token | Mortar | Carry a read-only auditor share link across pages | Functional / necessary |
We do not use analytics, advertising, or tracking cookies. Because we set only strictly-necessary cookies, no cookie-consent banner is required under the ePrivacy Directive / GDPR. If we ever add analytics, we will update this policy and put appropriate consent controls in place first.
9. Your rights
If you are in the EEA/UK you have the right to access, correct, delete, restrict, or object to the processing of your personal data, and to data portability. To exercise any of these, email privacy@mortarsec.com.
Where the personal data sits inside a customer's Databricks estate (the processor case), we will refer a request to the relevant customer (the controller) and assist them in responding, as required by the DPA.
Deletion / erasure: we operate a documented tenant-deletion process. On termination, or on a verified erasure request, we remove the tenant's data - scans, snapshots, findings, reviews, certifications, credentials, users, and the account itself - leaving no orphaned records. Backups age out on our provider's retention window; we can note that window on request.
You also have the right to lodge a complaint with your data-protection authority.
10. Security
We take security seriously - it is the product. Controls include tenant isolation via PostgreSQL row-level security, encryption of credentials at rest and TLS in transit, a tamper-evident audit log, hashed API tokens, and a read-only-by-construction scanner. Our public disclosure policy is at /.well-known/security.txt and more detail is on the Security & trust page.
11. Changes to this policy
We may update this policy. Material changes will be reflected in the "Last updated" date, and - for account holders - communicated by email or in-product.
12. Contact
privacy@mortarsec.com - privacy and data-protection questions. security@mortarsec.com - security reports. hello@mortarsec.com - everything else.