Privacy Policy

1. Information We Collect

• Account & Identity Data: Name, work email, organization name, role, and authentication identifiers via SAML SSO (WorkOS, Okta) or supported OAuth providers.
• Early-Access Requests: The name, work email, company and optional note you submit on the early-access form, used only to contact you when your spot opens. We keep the list with Brevo, the service that also emails you when your spot is ready, and later in our own service. The form runs a Cloudflare Turnstile bot check. To have a request removed, email [email protected].
• Service and device information: IP address, request and event timestamps, browser and device details, referring page, authentication and security events, and diagnostic records needed to operate, secure, troubleshoot and prevent abuse of the websites and Service. Cloudflare Turnstile processes information needed to assess automated abuse.
• Cookies and similar technologies: This website does not run analytics, advertising or tracking code and does not set cookies of its own. Our hosting and security provider, Cloudflare, may use strictly necessary security cookies or similar technologies to deliver the site and protect it from abuse. The site serves its own fonts. The early-access page loads Cloudflare's Turnstile script to block bots; nothing else on the site loads third-party scripts or trackers.
• Support and communications: contact details and the contents of support requests, security reports, questionnaires and other messages you send us.
• Billing Data: Payment details are processed and tokenized directly by Stripe. CertiQA never stores complete credit card numbers.
• Product & Test Content Data: Projects, test suites, scenarios, steps, datasets, and execution traces ("Customer Data").
• Vault Secrets & LLM Keys: Third-party credentials encrypted at rest using AES-256-GCM envelope vault encryption.

2. How We Use Information

We use information to respond to early-access requests; provide and administer accounts; run tests and generate reports at the customer's direction; process payments; provide support; maintain security, reliability and audit records; prevent fraud and abuse; comply with law; and enforce our agreements. We disclose information to service providers that help us perform these tasks, to customer-authorized integrations, when required by law, and in connection with a corporate transaction subject to appropriate protections.

Our infrastructure providers include Amazon Web Services and Cloudflare; WorkOS provides identity services; Stripe processes payments; Brevo sends our transactional email and keeps the early-access list (with Mailtrap as a backup email provider); and the current list of subprocessors is on our Security page. Support tickets are stored in the Service and may be emailed to our support inbox. We do not sell personal information or use it for cross-context behavioral advertising.

3. AI Features & Model Privacy

When AI features are used, the Service may send prompts, test cases, page markup, tool-call arguments, diagnostics, or other content needed for that feature to the model provider selected for the workspace. The platform default is Google Gemini unless an administrator configures another provider; customers may also connect their own provider keys, including supported OpenAI, Anthropic, Gemini, or self-hosted Ollama endpoints. Do not submit personal, confidential, regulated, or sensitive information unless you are authorized to do so and have configured the required safeguards.

CertiQA does not use customer content to train foundation models. A third-party model provider processes information under its own terms and settings. Customers should review the applicable provider's privacy, retention, and training terms before enabling it. A self-hosted provider is controlled by the customer.

4. Data Retention & Deletion

• While your account exists: projects, tests and configuration are kept while the workspace is active. Detailed run results are kept in the product for 30 days; screenshots and traces are kept for up to 3 days. Older run details are moved to the workspace run archive. Archived run files remain in the active storage tier for 90 days, then move to archival storage and are deleted 24 months after the run. Archive availability and deletion depend on the archive feature being enabled for the workspace.
• After you cancel: 30 days after a paid subscription ends, we permanently delete the workspace and all Customer Data in it.
• After a free trial ends without a plan: we keep the workspace for 90 days, then permanently delete it.
• If you never choose a plan: a workspace that was created but never had a plan or trial is deleted 30 days after it was created.
• Warning first: we email the workspace administrators 7 days and again 1 day before a scheduled deletion. Choosing a plan stops it.
• Any time: a workspace administrator can export the data and delete the workspace from Settings. Deletion cannot be undone.
• Backups and records: deleted data remains in encrypted database backups until they expire, up to 7 days, and deleted screenshots and traces can remain in storage version history for up to 7 more days. Payment records held by Stripe are retained as the law requires. We keep a minimal record that a company domain has used a free trial, and a log of the deletion itself, neither of which contains Customer Data.
• Early-access requests: a request that has not been approved is deleted within 180 days of submission. If we approve it, we keep the approval (your email address or company domain, and the name, company and note you gave) for as long as it is needed to let you create a workspace, and delete it when you ask or when early access ends. You can ask us to delete a request at any time, subject to records we must retain by law.

5. Privacy Rights

Depending on where you live and the capacity in which we process your information, you may have rights to request access, correction, deletion, or a copy of personal information, or to object to or restrict certain processing. Use the privacy request form or email [email protected]. We keep a record of each request and aim to respond within 30 days. We may need to verify your identity and authority before responding, and we do not release information until we have.

If your information is in a customer's workspace, the customer decides how to respond to requests about customer content, and we act as its processor. When you name the customer's company in the form, or your email address belongs to a company that is our customer, we pass your request to that workspace's administrators and help them respond. Workspace administrators can export and delete workspace data in the product, and can forward a request they received to us for help.

We may process information in the United States and other locations where our service providers operate. We do not currently accept customer personal data that is subject to the restricted-transfer rules of the EEA, the UK or Switzerland (see our Data Processing Addendum). Contact us for questions about international transfers.

This policy may be updated as our practices change. We will post the revised policy and update its effective date; where law requires notice or consent for a material change, we will provide it.

6. Contact Us

If you have questions about our privacy practices, please contact [email protected].