Sign In Start for Free
Start for Free

Last Updated on September 1, 2026

To see update history, click here.

PingCAP (US), Inc. and its affiliates (hereinafter referred to as “PingCAP”, “we”, “our” or “us”) understand that privacy is important to visitors to our websites (our “Sites”) and users of our products and services (including without limitation TiDB and TiDB Cloud; hereinafter referred as our “Products”). Unless otherwise agreed between our customers and us, this Privacy Policy explains how we collect, use, and share your personal information as we provide our Products and Services to our customers.

Click on the links below to jump to each section:

  1. PERSONAL INFORMATION WE COLLECT
  2. INTERNATIONAL DATA TRANSFER
  3. YOUR RIGHTS
    1. HOW TO CONTROL COLLECTION OF TIDB TELEMETRY DATA
    2. EUROPEAN DATA PROTECTION RIGHTS
    3. CALIFORNIA PRIVACY RIGHTS
  4. CHANGES TO OUR PRIVACY POLICY
  5. HOW TO CONTACT US

PERSONAL INFORMATION WE COLLECT

Unless otherwise agreed between parties, we collect, use, and store personal information that you directly provide to us (1) when visiting our website, as detailed below (2) when using our Cloud Services, as per our Data Processing Agreement, and (3) when using our TiDB (Self-Managed), as per our Schedule A.

We process personal data that you voluntarily provide to us, including:

  • Contact Form: (legal basis – performance of (pre-)contractual duties);
  • Job Applications: (legal basis – performance of (pre-)contractual duties);
  • Periodic Updates and Feature Releases: (legal basis – consent);
  • Demo-Request: (legal basis – performance of (pre-)contractual duties);
  • Downloading Resources: (legal basis – performance of (pre-)contractual duties), and/or legitimate interest for the purpose of direct advertising or other forms of marketing or advertising).
  • Social Media: (legal basis – consent);
    Participation in a Survey or Promotion: (legal basis – consent);
  • Event Registration: (legal basis – consent).

Information we collect includes, for example,

  • Contact information: your name, email address, phone number, mailing address, billing address, and usernames.
  • Demographic data: your job title, company name, city, state, and country.
  • Content and communications: any data you enter into any “free text” boxes on our forms, comments in our chat forms, and communications with us on social media and other platforms (like GitHub and Twitter), through phone, or messaging services (like Slack) (“User Contributions”). Your User Contributions are posted on and transmitted to others at your own risk. We cannot control the actions of other users of the Site with whom you may choose to share your User Contributions. Therefore, we cannot and do not guarantee that your User Contributions will not be viewed by unauthorized persons.

We also collect certain data that your browser transmits to our website server (i.e. log files) as well as data that we collect via the use of cookies or similar technologies, including:

  • Geolocation data: Depending on your device settings, we may collect geolocation data when you visit our Sites and use our Products. For example, we may derive your general location using your IP address.
  • Identifiers and device information: When you visit our Site, your device’s operating system, device identifier, customer ID and other device information, user agent string, Internet Protocol (IP) address, access times, browser type, and log data detailing your interactions with our Sites (e.g., number of clicks, pages viewed, information searched for), and the website you visited before and after coming to our Site (i.e., referrer header) are logged automatically. When you submit a support ticket, we receive data from the user agent string of your browser, which includes device information, browser information, OS information, city, state, country, and IP address.

(legal basis: legitimate interest in maintaining functionality, stability and security of our Sites).

With their account login information, authorized users of our Cloud Services may access TiDB Labs, a hands-on learning platform, which provides built-in resources, including virtual machines containing TiDB nodes, TiKV nodes, PD nodes, monitor, TiFlash nodes, etc., and step-by-step guidance to help them learn about TiDB in a more interactive setting. Once logged on, authorized users may provide additional personal information such as their name, region, organization and functional role in their user profile at their sole discretion so as to allow PingCAP to provide more customized support. Should the authorized user decide to buy additional credit in TiDB Labs, we use Stripe as our sub-processor to process payment information.

Additionally, when you use TiDB Products, we may also collect certain TiDB telemetry data and other data about your usage, including your pseudonymized IP address and other unique identifiers in combination with information about the version of our software you are running and how it is configured, to collect and aggregate certain diagnostic and analytics information, provided that you turn this feature on for versions of TiDB released after February 20, 2023 (for clarity, the default setting is off). We may combine this information with information you provide when you download our TiDB Products or make a request to PingCAP’s customer support, including the name of your organization or company.

We employ technical and organizational measures to prevent the reconstitution of IP addresses or reversal of pseudonymization that would allow attribution of the data to a specific individual, including segregating or not collecting any additional information that may be used for attribution. We store the pseudonymized data for 2 years.

The resulting pseudonymized data is used by us on behalf of our customers to (i) maintain and improve TiDB Products, and (ii) inform users whether they are running the latest version of TiDB Products.

For clarity, we collect the following TiDB telemetry data:

  • TiDB Products cluster related hardware information
  • TiDB Products cluster topology information
  • TiDB Products cluster software version information
  • TiDB Products cluster configuration information (only the config items, config values are excluded)
  • TiDB Products cluster components information
  • TiDB Products cluster maintenance operation consumed time
  • TiDB Products cluster usage and runtime metrics

PingCAP Clinic. When you use PingCAP Clinic, PingCAP Clinic may generate clinic data as below and store such clinic data in your device.

  • TiDB Products cluster related operation system and hardware information
  • TiDB Products cluster topology information (including node IP and type)
  • TiDB Products cluster software version information (including UUID and version)
  • TiDB Products cluster configuration information (both config items and values)
  • TiDB Products cluster logs (including logs, error logs and slow query logs)
  • TiDB Products cluster monitoring metrics and alerts information
  • TiDB Products cluster database system variables

Once you agree to upload the clinic data to PingCAP, you acknowledge and agree that PingCAP and its employee(s) and vendor(s) may transmit, store, copy and process the clinic data uploaded by you for the purpose of diagnosis and improvement of TiDB.

TiDB Cloud operational data (for TiDB Cloud only). When you use TiDB Cloud, we may automatically collect and store non-anonymized information and data about your operation of TiDB Cloud, including logs, metrics, and the service tickets submitted to TiDB Cloud. Although the operational data usually does not involve personal information, it may be linked to your account and include the following information, data and metadata:

  • Technical information obtained from APIs, software or system hosting TiDB Cloud and your computer or device, and log files generated during your operation of TiDB Cloud;
  • Data and metadata about you, such as your account, email, IP address, computer or other device, browser, and software; and
  • Data and metadata about your activities and behavior within TiDB Cloud.

Inferences. We infer new information about you and your company from data we collect, including using automated means to generate information about your likely preferences, your service and product needs or other characteristics. For example, we infer your city, state, and country location based on your IP address.

We may share aggregated or deidentified data with third parties (subject to applicable laws).

TO WHOM WE MAY DISCLOSE YOUR PERSONAL DATA

For the above mentioned purposes we may share your personal data with the following recipients:

  • Our employees and Affiliate companies, where necessary in order to perform our services (for example, customer support);
  • IT service providers who provide hosting, maintenance and security services for our Site;
  • Advertising and web-analysis partners (e.g. Google LLC) who provide certain services to us in connection to our Site;
  • With our business partners and other third parties, such as our sponsors and cosponsors of events, whose information we believe may be relevant to you or research and advisory firms whose reports are offered through our Sites
    Any other person/company upon your consent if necessary;
  • Where disclosure is required (i) by law or regulation or (ii) to establish, exercise or defend legal claims, we may also disclose personal data to a competent authority, such as supervisory, regulatory or criminal authorities, courts of law or other third parties who advise us in this context (e.g. lawyers or forensics experts).

INTERNATIONAL DATA TRANSFER

PingCAP complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. PingCAP has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. PingCAP has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

TRUSTe

In the context of onward transfers, PingCAP is accountable for the processing of personal data it receives, under the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and Swiss-U.S. DPF and subsequently transfers to a third party acting as an agent on its behalf. PingCAP remains liable under the EU-U.S. DPF Principles, and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF Principles if PingCAP’s agent processes personal information in a manner inconsistent with the EU-U.S. DPF Principles, and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF Principles, unless PingCAP proves that it is not responsible for the event giving rise to damage.

The Federal Trade Commission has jurisdiction over PingCAP’s compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF. In certain situations, PingCAP may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, PingCAP commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF to TRUSTe, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit https://feedback-form.truste.com/watchdog/request for more information or to file a complaint. These dispute resolution services are provided at no cost to you.

For complaints regarding EU-U.S. DPF, the UK Extension to the EU-U.S DPF, and Swiss-U.S. DPF compliance not resolved by any of the other DPF mechanisms, you have the possibility, under certain conditions, to invoke binding arbitration. Further information can be found on the official DPF website: https://www.dataprivacyframework.gov/framework-article/ANNEX-I-introduction.

When we transfer personal information from the European Economic Area (including the United Kingdom) and Switzerland to other countries that have not been determined by the European Commission to have laws that provide an adequate level of data protection, we use legal mechanisms, including contracts, designed to help ensure your rights and protections. Specifically, our website servers are located in the United States and our affiliates, partners, third parties and service providers operate in the United States, European Economic Area, Canada, China, and Australia. This means when we collect your personal information, we may process it in any of these countries. However, we have taken appropriate safeguards to require that your personal information will remain protected in accordance with this Privacy Policy. Additionally, PingCAP will agree to adopt and incorporate the European Commission-approved standard contractual data protection clauses. For more information about these mechanisms, please contact us using the contact details provided in the “How to contact us” section below.

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, PingCAP commits to resolve DPF Principles-related complaints about our collection and use of your personal information. EU and UK and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF should first contact PingCAP at legal@pingcap.com.

DATA SUBJECT RIGHTS

In accordance with applicable laws, you have the right to access your personal data, to request deletion or correction of your personal data, to object to the processing of your personal data, to request restriction of your personal data as well as the right to data portability. To exercise these rights, please email your request to legal@pingcap.com.

You can stop receiving promotional emails from us by clicking on the “unsubscribe link” provided in such emails or by contacting us at the contact details set forth below. In addition, you can make changes to your preferences in our Preference Center. We make every effort to promptly process all unsubscribe requests. If you opt out, we may still send you transactional communications (e.g., non-promotional emails such as emails about training and events you registered to attend and technical or security notices).

How to Control Collection of TiDB Telemetry Data

If you prefer that we do not collect certain TiDB telemetry data, including IP address, through TiDB tools – TiUP, you can manage the collection of this data as follows:

  • By using tiup telemetry disable to turn off and disable collecting telemetry data.
  • By using tiup telemetry enable to turn on and enable collecting telemetry data.
  • By using tiup telemetry reset to reset the collecting function and generate a new unique tracing identifier.
  • By using tiup telemetry status to verify the status (on/off) of the collecting function.

EUROPEAN DATA PROTECTION RIGHTS

If the processing of personal data about you is subject to European Union data protection law, you have certain rights with respect to that data:

  • You may request access to, and correction or erasure of, personal information. We are not obliged to delete your data if we need to retain such data in order to comply with a legal obligation or to establish, exercise or defend legal claims.
  • You have the right to restrict our processing where you believe your personal data is inaccurate, our processing is unlawful, or that we no longer need to process such data for a particular purpose (unless we are unable to delete the data due to a legal or other obligation or because you do not wish for us to delete it).
  • Where the legal justification for our processing of personal data is our legitimate interest, you have the right to object to processing on grounds relating to your particular situation. If we are processing your personal data on the basis of your consent or to perform a contract with you, you have the right to data portability.
  • If the processing of personal information is based on your consent, you have a right to withdraw consent at any time for future processing, without affecting the lawfulness of processing based on consent before its withdrawal. This includes cases where you wish to opt out of marketing messages sent by us.

To make a request to exercise these rights, contact us by email at the address below. You also have the right to lodge a complaint with a supervisory authority, but we encourage you to first contact us with any questions or concerns. Contact details for data protection authorities in the EEA are available here, United Kingdom here and Switzerland here.

CALIFORNIA PRIVACY RIGHTS

The California Consumer Privacy Act (“CCPA”) requires businesses that collect personal information of California residents to make certain additional disclosures. This section applies solely to you if you reside in the State of California.

The categories of personal information we have collected within the last twelve (12) months and the third parties with whom we have shared that personal information for a business purpose are as follows:

Categories of Personal Information Examples Third Parties
Identifiers. Name, address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, or other similar identifiers. Corporate affiliates, vendors, service providers and third-party business partners (as identified above)
Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)). Name, address, telephone number, or financial information. Corporate affiliates, vendors, and service providers and third-party business partners (as identified above)
Protected classification characteristics under California or federal law. Age, race, or sex (including gender). Corporate affiliates, vendors and service providers
Commercial information. Products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. Corporate affiliates, vendors, service providers and third-party business partners (as identified above)
Internet or other similar network activity. Browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement. Corporate affiliates, vendors and service providers
Geolocation data. Physical location or movements. Corporate affiliates, vendors and service providers
Professional or employment-related information. Current or past job history. Corporate affiliates, vendors, service providers and third-party business partners (as identified above)
Non-public education information Degrees and certifications. Corporate affiliates, vendors and service providers
Inferences drawn from other personal information. Profile reflecting a person’s preferences or characteristics. N/A

Right to know. You may request a copy of the personal information we have collected, used, disclosed, and sold about you over the past twelve (12) months. Once we have received your request and confirmed your identity, we will disclose to you:

  • The categories of personal information we collected about you,
  • The purposes for collection,
  • The categories of sources for the personal information we collected about you,
  • The categories of third parties with whom we share that personal information,
  • If we sold or disclosed your personal information for a business purpose, two separate lists disclosing:
    • sales, identifying the personal information categories that each category of recipient purchased; and
    • disclosures for a business purpose, identifying the personal information categories that each category of recipient obtained, and
  • The specific pieces of personal information we collected about you.

Right to delete. You may also request that we delete certain personal information we have collected and retained, subject to certain exceptions (for example, where the information is used by us to detect security incidents, debugging or to comply with a legal obligation). Once we receive your request and confirm your identity, we will review your request to see if an exception allowing us to retain the information applies.

You may “request to know” or “request to delete” your personal information up to two times in any twelve (12)-month period by filling out the Privacy Web Form or contacting us at legal@pingcap.com. Only you, or someone legally authorized to act on your behalf, may make a request to know or delete related to your personal information. Please know that any such request is subject to our ability to verify your identity and any exceptions provided under applicable laws.

Right to opt out. As discussed in this Privacy Policy, our advertising and analytics providers may collect your IP address, cookie ID, and mobile ID when you use our websites, and such vendors may further share your information to provide similar advertising or analytics services to their other customers. However, PingCAP does not sell personal information as the terms “sale” or “sell” are defined under the CCPA.

We will not discriminate against you for exercising any of your rights under the CCPA.

LINKS TO THIRD-PARTY WEBSITES

The Sites contain links to third-party websites. We have no control over the content or privacy practices of these other websites. Please read the respective data protection provisions of other websites that you visit.

CHANGES TO OUR PRIVACY POLICY

PingCAP may modify or update this Privacy Policy from time to time to reflect the changes in our business and practices, and so you should review this page periodically. If we make any changes to this Privacy Policy, we will notify you by changing the “Last Updated” date above. If we make any material changes, we will provide you with additional notice or obtain consent as may be required by applicable law.

HOW TO CONTACT US

If you have any questions, complaints, or concerns about how your information is handled, please email us at legal@pingcap.com. Our main address is PingCAP (US), Inc., 440 N Wolfe Rd, Sunnyvale, CA 94085, USA.

If you are located in the EEA or the United Kingdom and have questions about your personal data or would like to request to access, update or delete it, you may contact our representative at:

We will make best efforts to:

  • provide an initial response to your query or complaint within 15 Business Days, and
  • investigate and attempt to resolve your query or complaint within 45 Business Days.