You are about to point something at the database that runs your business. Before anything else, you want to know where that data goes.
Here is the whole picture, including the parts that are less flattering.
What never leaves
Limerence is an app you install. It runs on your computer, and it connects to your database the same way any other program on your machine would — directly, from where you are sitting.
Your data goes with it. When you ask how many accounts renewed last quarter, the app asks your database, your database answers, and that answer is drawn on your screen. The rows themselves never travel anywhere else. There is no account of ours holding a copy of your numbers, because there is nowhere for them to be held.
The same is true of what you teach it. The notes you write about which orders count as revenue, which accounts are tests, what your team means by active — those live on your machine with everything else.
What leaves, and who receives it
Two things go out.
Your question goes to the AI service you chose. You bring your own account. The app sends your question, along with the names of your tables and columns, so the service can work out how to answer it. It goes from your computer straight to that service — not through us. What that service does with what it receives is governed by your agreement with them, not by us, and it is worth reading.
Diagnostics come to us. When something breaks, we want to know. The app sends us a stream of what it is doing, and we should be precise about what that contains: the queries it wrote, the names of your databases and tables, file paths on your machine, and the identifiers we use to tell one conversation from another.
Passwords, keys and connection details are stripped out before any of it leaves. Your questions are not. A query carries the shape of what you asked, and if you filtered on a customer's name, that name is in the query.
There is no off switch today. If that is a problem for your data, tell us — it is the kind of thing we would rather hear before you install than after.
Why it cannot change your data
Every question becomes a query, and every query is read before it runs. Anything that would add, change or remove data is refused on the spot. Not warned about — refused, before your database is ever asked.
This is checked in the app, on every database it connects to, on every path: a question you type, a dashboard that refreshes, a report that runs overnight. On most databases we go further and ask the database itself to refuse changes too, so the promise does not rest on one check alone.
There is a limit worth stating. The app can only refuse what it is asked to run. If the account you give it is allowed to change data, and something outside Limerence uses that account, that is beyond what we can see. Which brings us to the one thing we would ask of you.
Give it a read-only account
Connect Limerence with an account that can read your data and nothing else. Most databases can create one in a few minutes, and your database administrator will know how.
You do not have to. The app refuses to write either way. But two locks are better than one, and it means the strongest promise about your data is one you control rather than one you take from us.
What we would ask before you decide
If your data is regulated, or you are the person who signs off on where it goes, the two paragraphs worth taking to that conversation are the ones above about the AI service and about diagnostics. Everything else stays on your machine, and the read-only guarantee holds. Those two are where your data crosses a line onto someone else's computer, and you should decide that deliberately rather than find out later.