Customer data is defined as data stored within user tables, directly or indirectly. The data includes statistics or user literals within query texts that might be stored within user tables.

|Crash Dumps may contain customer data and be emitted to Microsoft. |- |Crash Dumps: Max 30 days. |

|Customers with their consent can send User Feedback that contains customer data to Microsoft. |Limit to Microsoft internal with no third-party access. Microsoft can expose the data to the original customer. |User Feedback: Max 1 year |

- Does not contain customer data.

|Crash dumps may contain personal data and be emitted to Microsoft. |- |Crash dumps: Max 30 days |

|Customers with their consent can send User Feedback that contains customer data to Microsoft.|Limit to Microsoft internal use with no third-party access. Microsoft can expose the data to the original customer. |User feedback: Max 1 year |

|Customers with their consent can send User Feedback that contains customer data to Microsoft. |Limit to Microsoft internal use with no third-party access. |Customers with their consent can send User Feedback that contains customer data to Microsoft. |

1. Data received from an organization, or generated from their use of the product. It is linkable to an organization and does not contain customer data.

- Organization name (example: Microsoft Corp.)

- Permitted usage scenarios

|Scenario |Access restrictions |Retention requirements|

|---------|---------|---------|

| Microsoft may collect generic usage data of SQL Server instances running in Azure Virtual Machines for the express purpose of giving customers optional benefits within Azure for using SQL Server within Azure Virtual Machines. | Microsoft can expose data to the customer, such as through the Azure portal, to help customers running SQL Server in Azure Virtual Machines to access benefits specific to running SQL Server in Azure. </br></br>Microsoft will not use this data for licensing audits without customer's advance consent. | Min 90 days - Max 3 years |

2. Data that describes or is used to configure servers, databases, tables, and other resources created or provided by customers. It includes database table and column names but not the contents of database rows or other customer data. Customers should not place any personal data in those fields or create applications designed to store personal data in these fields. For the permitted usage scenarios below, only hash form is used to determine usage patterns to improve the product.

- Example

- SQL Server database names

- Table names and column names

- Statistics names

- Permitted usage scenarios

> [!NOTE]

> All metadata values are hashed before collection.

>

|Scenario |Access restrictions |Retention requirements|

|---------|---------|---------|

|May be used by Microsoft to improve features and or fix bugs in current features. |Limited to Microsoft internal use with no third-party access. |Min 90 days - Max 3 years|

- Example

- Database GUID

- Hash of machine name

- Hash of instance name

- Application name

- Behavioral/usage data

- SQL Customer Experience improvement program data (SQLCEIP)

- Server configuration data, for example settings of sp_configure

- Feature configuration data

- Event names and error codes

- Hardware settings and identification such as OEM Manufacturer

Microsoft does examine application name values set by other programs that use SQL Server (example: SharePoint or third-party packaged programs and includes this information in metadata fields sent to Microsoft when Usage Data is enabled). Customers should not place personal data in those metadata fields or create applications designed to store personal data in these fields.

- Permitted usage scenarios

|Scenario |Access restrictions |Retention requirements|

|---------|---------|---------|

|May be used by Microsoft to improve features and or fix bugs in current features.|Limit to Microsoft internal use with no third-party access. |Min 90 days - Max 3 years |

|May be used to make suggestions to the customer. For example, "Based on your usage of the product, consider using feature *X* since it would perform better." |Microsoft can expose the data to the original customer, for example through dashboards. |Customer Data Security Logs: Min 3 years - Max 6 years |

|May be used by Microsoft for future product planning. |Microsoft may share this information with other hardware and software vendors to improve how their products run with Microsoft software. |Min 90 days - Max 3 years|

|May be used by Microsoft to provide cloud-based services based on emitted Usage and Diagnostics Data. For example, a customer dashboard showing feature usage across all SQL Server installations in an organization. |Microsoft can expose the data to the original customer, for example, through dashboards. |Min 90 days - Max 3 years |

|Customers with their consent can send User Feedback that contains customer data to Microsoft. |Limit to Microsoft internal with no third-party access. Microsoft can expose the data to the original customer. |User Feedback: Max 1 year |

|May use database name and application name to categorize databases and applications into known categories, for example, those that may be running software provided by Microsoft or other companies.|Limit to Microsoft internal with no third-party access.|Min 90 days - Max 3 years |

Instructions on how system generated logs can be turned on/off in product can be referenced here - [Configure usage and diagnostic data collection for SQL Server (CEIP)](usage-and-diagnostic-data-configuration-for-sql-server.md).