Privacy Policy

Account data: Your name, email address, and organization name, provided during signup via Clerk (our authentication provider).

Content data: Requirements, test cases, test runs, bugs, and documents you create or import into the Service. This may include content from Jira, Confluence, Notion or GitHub that you import or connect, and bug reports (including console logs, network logs, screenshots and screen recordings) captured by the embeddable widget or browser extension on sites where you install them.

Integration credentials: API tokens and webhook URLs for the Jira, Confluence, Slack and Notion integrations you configure. These are encrypted at rest using AES-256-GCM.

Usage data: Pages visited, features used, and actions taken on our website and within the Service, collected with PostHog to improve the product (see section 8). When you are signed in, these events are linked to your user ID, name, email address and organization.

Payment data: Paid plans are sold through LemonSqueezy, which acts as our merchant of record and handles checkout, payment details, invoicing and sales tax. We never receive or store card numbers; we store only subscription identifiers and status.

• To provide and operate the Service
• To process AI requests (the relevant content, such as requirements, is sent to Anthropic's API)
• To send transactional emails (for example invitations and notifications)
• To improve and debug the Service
• To comply with legal obligations

We do not sell your data. We do not use your content to train AI models.

We share data with the following processors only as needed to operate the Service:

• Clerk: Authentication and user/organization management. Account data (name, email), credentials and session data.
• Neon: PostgreSQL database hosting. All application data (account, content and integration data). Region: [PLACEHOLDER: database region].
• Vercel: Web application hosting, scheduled jobs and edge network. All request data in transit.
• Railway: Hosting for our background worker (CI result processing, AI agent runs, scheduled jobs). Content data needed for those jobs.
• Redis ([PLACEHOLDER: Upstash or Railway]): Background job queue. Job payloads (content data), held temporarily.
• Cloudflare R2: File storage for bug attachments, widget screenshots and screen recordings, and CI artifacts.
• Anthropic: AI model provider. Content you submit to AI features (such as requirements, test cases and bug details) is sent to Anthropic’s API. Anthropic does not train models on API inputs by default.
• Resend: Transactional email delivery. Recipient email addresses and email content.
• PostHog: Product analytics. Usage events, browser/device data, IP address and, for signed-in users, user ID, name, email and organization. Region: [PLACEHOLDER: PostHog US or EU cloud].
• Sentry: Error monitoring. Error reports and stack traces with request metadata, which may include IP address and user ID.
• LemonSqueezy: Billing; merchant of record for paid plans. Billing contact, payment and tax details.
• Browserless: Hosted browser used when the AI agent tests web pages you point it at. Page content and screenshots of those sites. [PLACEHOLDER: remove this entry if Browserless is not used in production]

When you connect GitHub, Atlassian (Jira / Confluence), Slack or Notion, we exchange data with that service on your behalf, for example importing issues or pages, pushing bugs, or posting notifications. These integrations are used only if you enable them, and the provider's own terms apply to data held in their systems.

A Data Processing Addendum is available on request at legal@sqalehq.ai.

• Active account data is retained for the lifetime of your account
• Archived projects, including their uploaded files, are permanently deleted 30 days after archiving
• We delete your workspace data within 30 days of a verified deletion request sent to privacy@sqalehq.ai. Database backups containing deleted data roll off within [PLACEHOLDER: N] days.
• Billing records may be retained longer as required by law

• AES-256-GCM encryption for sensitive credentials at rest
• HTTPS enforced for all connections
• Authentication via Clerk with industry-standard session management
• Data isolation: each organization can only access its own data

No system is 100% secure. If you discover a vulnerability, please report it to security@sqalehq.ai.

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data (“right to be forgotten”)
• Export your data in a machine-readable format
• Object to or restrict certain processing

To exercise any of these rights, contact us at privacy@sqalehq.ai. We will respond within 30 days.

Essential: Clerk sets cookies required for sign-in and session management. The Service cannot work without them.

Analytics: We use PostHog product analytics on our website and in the app. PostHog stores a first-party cookie and a browser local-storage entry (named ph_…_posthog) holding a random identifier, and records page views, page leaves and interactions such as clicks. When you sign in, this identifier is linked to your account. We do not use advertising cookies.

Your choice: Analytics only runs if you click “Accept” on the cookie banner. Until then, or if you click “Reject”, PostHog is not loaded and sets no cookies. If your browser sends a Global Privacy Control signal, we treat it as a rejection. We store your choice in local storage (sqale_cookie_consent) so we don't ask again.

You can change your mind at any time with Cookie settings (also linked in the website footer). Rejecting after accepting stops analytics and clears its identifier. The Service works the same either way. You can also ask us to delete analytics data linked to your account at privacy@sqalehq.ai.

• Email: privacy@sqalehq.ai
• Post: [PLACEHOLDER: legal entity name], [PLACEHOLDER: registered address]