Privacy Policy

Unified QA ("we", "us", "the Platform") provides a multi-tenant quality assurance SaaS. This Privacy Policy explains what data we process when you use the website, application, APIs, CLI, and SDKs.

Account data: name, email, tenant/organization membership, authentication identifiers (including OAuth subject ids), MFA device metadata, and session information.

Workspace data: projects, test cases, runs, logs, screenshots, videos, HAR files, security findings, and other artifacts you upload or generate.

Usage data: product analytics such as feature usage, API request metadata, queue metrics, and billing/metering events.

Technical data: IP address, user agent, approximate region, and diagnostic telemetry (traces, logs) with correlation ids.

We use data to provide and improve the Platform, authenticate users, enforce RBAC and tenant isolation, run tests and AI jobs you request, detect abuse, bill for usage, and comply with law.

AI features may send redacted context (code snippets, logs, failure metadata) to configured model providers. Secrets are redacted before transmission. Prompt hashes and safety decisions are retained for auditability.

Where GDPR/UK GDPR applies, we process data based on contract performance, legitimate interests (security, product improvement), consent where required (certain marketing or optional AI processing), and legal obligations.

We share data with subprocessors needed to operate the service (for example cloud hosting, object storage, email/Slack delivery, payment processors, and LLM providers you enable). We do not sell personal data.

We may disclose information if required by law or to protect the rights, safety, and security of users and the Platform.

Account and workspace data are retained for the life of the subscription plus a limited wind-down period unless you request deletion sooner. Audit logs and billing records may be kept longer where required for compliance. Artifacts follow tenant retention policies and signed URL expiry.

We apply encryption in transit, access controls, tenant isolation (including database RLS where enabled), secret management via Vault-compatible workflows, and monitoring. No method of transmission or storage is 100% secure.

Depending on your region, you may request access, correction, deletion, export, restriction, or objection to certain processing. Contact your tenant administrator first for workspace data; organization admins control most customer content.

Data may be processed in regions where we or our subprocessors operate. Where required, we use appropriate transfer mechanisms (such as SCCs) for cross-border transfers.

Privacy inquiries: privacy@unifiedqa.dev (placeholder contact for this deployment). For product security reports, use your configured security notification channel.