Privacy policy clauses for MikroORM
MikroORM is a TypeScript data-mapper ORM that manages how applications interact with databases using the unit of work pattern. Websites use it to map application objects to database records, simplifying data persistence and retrieval while maintaining clean code architecture.
Free scan · No signup · Results in 60 seconds
What data MikroORM collects
Your privacy policy must disclose each of the following data types when you use MikroORM.
When does MikroORM trigger privacy obligations?
MikroORM itself does not collect, transmit, or process personal data—it is a self-hosted database abstraction layer. Compliance obligations are triggered when you define and persist entity classes that contain PII (names, emails, IP addresses, user IDs, etc.) in your connected database.
The moment you add MikroORM to handle customer or user records, you become a data controller under GDPR Article 4(7) (if you have EU residents) or a business under CCPA Section 1798.140(ag) (if you have California residents). No threshold exists; one EU user's email triggers GDPR. For payment or health data, heightened obligations apply immediately.
First concrete step: Audit your entity definitions. List every property in your MikroORM entities (User, Order, Profile, etc.) and flag which ones are personal data. Then:
1. Document your lawful basis (GDPR Article 6) or justify collection under CCPA—consent is the safest default.
2. Draft or update your privacy policy to disclose what entity types you store and why (e.g., "We use MikroORM to manage user accounts in our PostgreSQL database").
3. Implement access controls in your application layer—MikroORM has no built-in encryption or role-based query filtering; you must enforce data minimization in code.
