Privacy Policy

01Scope and Roles

This Privacy Policy explains how Autonomy QA collects, uses, discloses, and protects information when you visit our websites, use our application, APIs, agents, documentation, support, or related services.

For account, billing, marketing, and website information, Autonomy QA acts as the controller or business responsible for that information. For personal information contained in customer applications, Test Plans, Runs, screenshots, DOM snapshots, network logs, recordings, prompts, responses, or other customer test artifacts, Autonomy QA generally acts as a processor or service provider on behalf of the customer, unless an applicable agreement says otherwise.

Customers who require a Data Processing Agreement (DPA) covering personal information we process on their behalf can request one from us.

02Information We Collect

We collect information needed to provide, secure, support, and improve the Autonomy QA platform.

• Account and organization information: names, work emails, authentication details, organization names, roles, user preferences, support messages, Saved Sign-in account labels and encrypted test-account credentials or session data you choose to store, and similar information.
• Billing information: plan, subscription, invoice, tax, and payment status information. Payment card data is processed by our payment providers and is not stored by Autonomy QA in full.
• Customer content and test artifacts: Test Plans, Run steps, target URLs, application screenshots, page text, visual recordings, DOM snapshots, network metadata, logs, error output, email/SMS test evidence, files added to workspace file libraries, model prompts and responses, and debugging notes generated while providing the Service.
• Technical and usage data: IP address, device and browser metadata, API usage, feature events, agent performance, latency, token usage, cost metadata, diagnostic logs, and security events.
• Cookies and similar technologies: session, security, preference, analytics, and attribution identifiers as described below.

03How We Use Information

We use information to operate Autonomy QA, including to create and manage accounts, execute Runs, generate reports, maintain Product Graph evidence, provide support, process payments, detect abuse, secure the platform, and comply with legal obligations.

We may use aggregated or de-identified telemetry to improve reliability, agent routing, product quality, and cost controls.

04AI Model Providers and Training

Autonomy QA is an AI-native platform. To execute Runs, reason about failures, generate Test Plans and suggestions, classify evidence, and produce reports, we send relevant test context to third-party AI model providers and routing gateways acting as our subprocessors. This context may include screenshots, page text, target URLs, prompts, responses, and other evidence from the application you test. Google Gemini is the default AI provider, and the runner may also use OpenRouter, OpenAI, Anthropic, or other providers you configure or that your plan permits. The specific providers used depend on your plan, workspace configuration, and any model routing you select.

Files you add to your workspace’s file library (Settings → Files) are made searchable for your tests. We send file names, descriptions, type and size facts, and, while the admin-controlled “Search inside files” setting is on, supported file contents to Google’s Gemini API paid tier to create search embeddings. Supported contents currently include PNG, JPEG, WebP and first-frame GIF images, PDFs up to the model input limit, and text files such as CSV, TXT, JSON and Markdown. Google processes this information as our AI subprocessor and, under its paid API terms, does not use it to train Google models. The files themselves are stored with Cloudflare (R2), and the resulting embeddings are stored in our backend hosted by Convex; embeddings are used only to search within your workspace. Turning the setting off stops sending file contents and deletes content-derived embeddings; removing a file deletes its embeddings.

When you ask a question in the help on our website, documentation, or dashboard, we send your question, up to four earlier questions and answers from the same conversation, and our own help and documentation text to Cloudflare Workers AI, which writes the answer. The model (currently an open model published by DeepSeek) runs on Cloudflare’s network, so your question is not sent to DeepSeek. Cloudflare does not use these questions to train models. Cloudflare’s AI Gateway keeps a log of each question and answer for up to 7 days, which we use to control cost and prevent abuse. We use your IP address for about a minute to limit how many questions can be asked. Keep personal and confidential information out of help questions.

We do not use your customer content, test artifacts, or personal information to train foundation models, and we rely on the commercial API terms of our AI model providers, which prohibit them from using data submitted through those APIs to train or improve their models. We will not enable training on your data without your explicit opt-in or a separate written agreement.

You are responsible for limiting the secrets, credentials, and production-sensitive data exposed to Runs. Where feasible, design your Test Plans and test accounts so that highly sensitive values are not transmitted to model providers.

05Data Sharing

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We disclose information only where needed for the Service or where legally permitted.

• Subprocessors: we engage subprocessors to help provide the Service, including AI model providers, email and communications providers, payment processors, analytics and product-telemetry providers, and customer support tools, together with other providers that help us securely host and operate the platform. All subprocessors process information under confidentiality and data-processing terms. A current list of subprocessors is available to customers on request. Customers under a data processing agreement may receive advance notice of material subprocessor changes and may object to a new subprocessor on reasonable data-protection grounds.
• Customer-directed integrations: services you connect, such as CI/CD, repositories, issue trackers, communications tools, identity providers, or test environments.
• Legal and safety disclosures: where required by law, court order, valid legal process, or to protect rights, safety, security, or the integrity of the Service.
• Business transfers: in connection with a merger, financing, acquisition, reorganization, or sale of assets, subject to appropriate confidentiality protections.

06Data Security

We use administrative, technical, and organizational safeguards designed to protect information, including access controls, encryption in transit, encryption at rest where supported by the underlying service, monitoring, logging, and least-privilege operational practices.

No internet service can guarantee absolute security. Customers are responsible for configuring test environments safely, limiting credentials and secrets exposed to Runs, masking or avoiding production-sensitive data where possible, and using appropriate access controls for their own users.

If we become aware of a personal data breach affecting your information, we will notify affected account owners or administrators without undue delay and provide reasonable assistance to help you meet your own notification obligations.

07Restricted Data

Unless we agree in writing, you must not submit protected health information, payment cardholder data, government identifiers, biometric identifiers, children’s data, export-controlled data, or other highly regulated sensitive data to the Service.

If your use case requires regulated or sensitive data, contact us before using Autonomy QA so we can evaluate whether additional terms, technical controls, or a separate data processing agreement are required.

08Retention and Deletion

We retain information for as long as reasonably necessary to provide the Service, comply with legal obligations, resolve disputes, enforce agreements, maintain security, and support backups and audit logs.

Customer test artifacts are retained according to your plan, workspace settings, order form, or applicable agreement. Where no specific retention setting applies, we retain artifacts only for as long as needed for the product purpose for which they were collected and then delete or de-identify them in the ordinary course of business.

When an account is closed or a deletion request is completed, we delete or de-identify the associated customer content within a commercially reasonable period, typically within 90 days, except where longer retention is required by law. Removing a Saved Sign-in deletes its saved login state and associated stored values, and removing a workspace file deletes its search embeddings. Emails that a role inbox receives for a sign-in during a Run are deleted when the Run ends. Residual copies in encrypted backups are purged on our ordinary backup rotation cycle.

09International Transfers

We may process information in countries other than where you are located. Some subprocessors, including certain AI model providers, may process data in the United States or other countries.

Where required for transfers out of the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK Addendum where applicable), supplemented by data-processing terms and vendor security reviews.

10Your Rights

Depending on your location, you may have rights to request access, correction, deletion, portability, restriction, objection, withdrawal of consent, or information about how your personal information is used. California residents may also have rights to know, delete, correct, opt out of sale or sharing, and limit certain uses of sensitive personal information.

We will not discriminate against you for exercising privacy rights. If your information is controlled by an Autonomy QA customer, we may direct your request to that customer or assist them in responding.

11Cookies and Tracking

We use essential cookies for authentication, session management, security, fraud prevention, and preferences. The Autonomy Chrome extension reads cookies only as described in section 12. We may use analytics and attribution technologies to understand product usage and improve the website and Service. You can control cookies through your browser settings, but disabling essential cookies may prevent parts of the Service from working.

12The Autonomy Chrome Extension

The Autonomy Chrome extension is optional. It does two things, and each one starts only when you start it:

• Save or renew a login. When you click Save or Renew and allow a site, the extension reads that site’s cookies and browser storage (localStorage and sessionStorage) and sends the login data you selected to your Autonomy workspace, where it is stored encrypted as a Saved Sign-in.
• Record a test. While you record on a site you allowed, the extension records the addresses of the pages you visit on that site, the elements you click, and the values you type, and sends them to your workspace as test steps. Passwords you type are never added to the steps. The extension holds them in memory until you finish, and saves one to your workspace only if you choose to keep it as a Saved Sign-in or an Environment secret. Recording stops when you finish or discard it.

The extension reads only the sites you allow, and only after you click Save, Renew, or Start recording. It sends what it reads only to your Autonomy workspace and keeps no copy in your browser. We do not sell this data, use it for advertising, use it to determine creditworthiness or for lending, or use it for any purpose other than building and running your tests. Our use of this data complies with the Chrome Web Store User Data Policy, including its Limited Use requirements.

13Children

Autonomy QA is intended for business users and is not directed to children. We do not knowingly collect personal information from children under 16. If you believe a child has provided us personal information, contact us so we can take appropriate action.

14Changes to This Policy

We may update this Privacy Policy from time to time. If changes are material, we will provide notice by updating this page, changing the date above, and, where appropriate, notifying account owners or administrators.

15Contact Us

If you have questions about this Privacy Policy, your data rights, or our security practices, contact us at:

Company

Autonomy QA

Attention

Privacy Team

Email

hello@autonomyqa.com