Privacy Policy

This policy explains what TestTale (“we”) collects when you use the TestTale website and application, why, and the choices you have. For the content your workspace connects (tickets, code, logs and similar “Customer Content”), we act on your behalf and only as you instruct by using the Service.

What we collect

• Account details: your name, email address and password (stored as a secure hash), or the profile your sign-in provider shares, plus the workspaces you belong to and your role.
• Customer Content: what you add or connect, such as Jira issues, pull requests, repository files the agent reads, generated tests, test results and logs, test cases and plans, story reviews and assistant conversations.
• Keys and tokens: AI provider API keys, integration tokens and test secrets. These are encrypted with AES-256-GCM before storage and never shown again in full.
• Billing information: payments are handled by Paddle. We receive your subscription status, plan, seat count and Paddle customer reference. We never receive or store card details.
• Usage and technical data: AI usage counts (for example tokens used per run), an audit log of significant actions, and server logs such as IP address and browser type, kept for security and troubleshooting.
• Contact details: if you email us or joined our waitlist, your email address and what you send.

How we use it

• To provide the Service: run the tasks you request, show results, and send account emails (verification, invitations, billing and trial notices).
• To keep the Service secure, prevent abuse and fix problems.
• To manage subscriptions and meet legal, tax and accounting duties.
• To tell you about important product changes. You can unsubscribe from non-essential emails at any time.

We do not sell personal data, and we do not use Customer Content to train AI models.

AI processing

When you run a task, the relevant Customer Content is sent to the AI model provider your workspace configured (for example OpenAI, Anthropic, Google, or another compatible service), using your own API key and account with that provider. That provider processes it under its own terms and privacy policy, which you accept with them.

Service providers

We use these providers to run the Service. Each processes data only to provide its service to us:

• Google Cloud (Cloud Run, Cloud Scheduler, Secret Manager): application hosting.
• Google Firebase (Hosting and Firestore): this website and the waitlist.
• Supabase: the application database.
• Paddle.com: checkout, payments, taxes and invoicing, as Merchant of Record.
• Google (Gmail): sending account emails.
• PostHog: product analytics in the application, such as “workspace created” or “first test run”, tied to workspace and user ids only. No names, emails or Customer Content are sent, and no cookies are used.
• Cloudflare Web Analytics: cookie-free visit counts for this website.
• Sentry: reports of errors on our servers (the error type, a short message and where in our code it happened), without request contents.
• GitHub, Atlassian and other tools you connect: only for the integrations you choose.

If we add other providers, we will list them here before we start using them.

Where data is stored

Our providers may store and process data in the United States, India or other countries where they operate. Where the law requires it, we rely on appropriate safeguards for these transfers.

How long we keep it

• Customer Content and account data: while your workspace is active.
• After you delete a workspace or ask us to: removed within 30 days, and from backups within 90 days.
• Audit log: 30 days on the Team plan and 1 year on the Business plan.
• Billing records: as long as tax and accounting law requires (held mainly by Paddle).

Security

We use encryption in transit and at rest, per-workspace isolation, role-based access and audit logging. See our Security page for details.

Your rights

Depending on where you live (for example under the EU/UK GDPR or India's Digital Personal Data Protection Act, 2023), you can ask to access, correct, export or delete your personal data, object to or restrict some processing, and withdraw consent. Email steadyqateam@gmail.com and we will reply within 30 days. If you are unhappy with our answer, you can complain to your local data protection authority.

If your organisation's workspace holds your data (for example as an invited member), we may refer your request to the workspace owner, who controls that content.

Cookies

The application uses strictly necessary cookies to keep you signed in and to protect against cross-site attacks. Neither the application nor this website uses advertising or analytics cookies.

Children

The Service is for business use and not directed to anyone under 18.

Changes

We will update this page when our practices change and tell workspace owners about material changes.

Contact

Privacy questions and requests: steadyqateam@gmail.com