1. Who we are
Qualio AI (“Qualio”, “we”, “us”) is operated by [Qualio AI legal entity name], [Registered address, country], registration number [Company registration number]. This policy covers this website and the Qualio application at app.qualio-ai.com.
For anything about privacy, write to privacy@qualio-ai.com.
EU representative: [EU representative, if the company is outside the EU — or remove]. UK representative: [UK representative, if the company is outside the UK — or remove].
2. Controller or processor
We are the controller for the data we decide to collect: waitlist sign-ups, website request data, accounts, the audit log, AI usage records and the emails we send you.
We are a processor for what your organisation’s CI job and integrations send us so that we can test your app: your tests, your tickets, and what we capture from the app under test. That can include personal data shown in your test environment (for example in a screenshot). Your organisation is the controller of that data, and our Data Processing Agreement governs how we handle it. If you are a user of one of our customers’ apps, please contact that customer first.
We recommend testing against environments with synthetic data. Qualio generates synthetic test data itself.
3. What we collect and why
Waitlist sign-ups
- Data
- Your email address and which form you used.
- Purpose
- To contact you about early access.
- Legal basis
- Consent (Art. 6(1)(a)). You can withdraw it at any time.
Visiting this website
- Data
- Technical request data our host processes to serve the site: IP address, browser, pages requested and time.
- Purpose
- To deliver the site, keep it secure and investigate abuse. We run no analytics or advertising on it.
- Legal basis
- Legitimate interests (Art. 6(1)(f)): operating a secure website.
Your Qualio account
- Data
- Name, email address, a password stored only as a salted scrypt hash (if you use one), your GitHub login and profile image (if you sign in with GitHub or add your login), sign-in sessions, workspace memberships and roles, and notification preferences.
- Purpose
- To create your account, sign you in, and run your workspaces.
- Legal basis
- Performance of a contract (Art. 6(1)(b)).
Activity in Qualio
- Data
- What people do in a workspace: decisions on fixes (accept, reject, revert, report a bug), approvals, invites, API key and settings changes, recorded in an audit log with who did it and when.
- Purpose
- Accountability for changes to your tests and settings, security, and support.
- Legal basis
- Contract (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)): a trustworthy record of changes.
Integrations you connect
- Data
- GitHub: the repository name, pull requests (titles, descriptions, branches, authors’ logins), comments sent by your workflow, check and status results. Jira: issues in the board column you choose, their comments, reporters and status, and OAuth tokens (stored encrypted).
- Purpose
- To follow your pull requests and tickets, and post Qualio’s results back where your team works.
- Legal basis
- Contract (Art. 6(1)(b)); for your customer’s users, see “Controller or processor”.
What your CI job sends us
- Data
- Your tests folder and the overview documents your workflow names, test results and logs, and, from the app under test: page structure (accessibility trees, DOM), screenshots, videos and traces.
- Purpose
- To map your app, write and run tests, diagnose failures and propose or apply fixes.
- Legal basis
- Processed on your behalf as your processor (Art. 28).
AI usage records
- Data
- For every AI call: the workspace, project, agent, purpose, model, token counts, latency and estimated cost. Never the prompt or the response.
- Purpose
- Billing, budgets, cost control and abuse detection.
- Legal basis
- Legitimate interests (Art. 6(1)(f)) and contract (Art. 6(1)(b)).
Emails we send you
- Data
- Sign-in links, invitations, and notifications you opted into (for example possible bugs).
- Purpose
- Account access and the alerts you asked for.
- Legal basis
- Contract (Art. 6(1)(b)).
We don’t sell personal data, use it for advertising, or combine it with data from data brokers.
4. What we never collect
- Your source code. Our GitHub App has no permission to read code. Your CI job sends only the tests folder and the overview documents you name in your workflow.
- Your test accounts’ credentials. They live only in your CI secrets (such as
E2E_ADMIN_PASSWORD), and a browser in your job signs in with them. They never reach us. - AI prompts and responses. We record that a call happened and what it cost, never what was said.
- Access to your app. Qualio never connects to your application. Everything runs on your own CI runners.
5. How AI is used
Qualio’s agents use AI models to read tickets, write specs and tests, and diagnose failing tests. To do that we send the relevant context to our model providers: for example a ticket, a spec, a failing test with its error, or a page’s structure. Model providers process it under API terms that do not allow them to use it to train their models, and may keep it for a limited period for abuse monitoring, as their terms describe. We don’t keep the prompts or responses ourselves.
No decision that has legal or similarly significant effects on a person is made by automated means. AI output only concerns your tests, and a person in your team decides what to merge.
7. International transfers
Some providers above process data outside the European Economic Area or the UK, including in the United States. Where that happens, we rely on an adequacy decision (such as the EU-U.S. Data Privacy Framework, where the provider is certified) or on the European Commission’s Standard Contractual Clauses with the UK Addendum, together with additional safeguards where needed. You can ask us for a copy of the relevant safeguards.
8. How long we keep data
| Data | Kept for |
|---|---|
| Waitlist sign-ups | Until you ask us to remove them, or 12 months after launch at the latest, unless you become a customer. |
| Website request logs (at our host) | [Host log retention, e.g. 30 days]. |
| Account data | While your account exists. Deleted as soon as you delete your account (or within 30 days of a request by email), except what we must keep by law. |
| Copies of your tests folder | Only while the pull request it belongs to needs it, and never more than 14 days. |
| Specs, domain knowledge, app map, test results | While the workspace exists; deleted when an owner deletes the workspace (stored files within a day). |
| Run artifacts (screenshots, videos, traces, DOM and accessibility snapshots) | 90 days after the run. |
| AI usage records | 13 months, then kept only as daily totals without links to people. |
| Audit log | While the workspace exists. It cannot be edited, so it remains a reliable record. |
| Jira OAuth tokens | Until you disconnect Jira or delete the project. |
Backups follow the same rules and roll over within [Backup retention, e.g. 35 days].
9. Security
- Data is encrypted in transit (TLS) and at rest.
- The copies of your test files that we keep while a pull request needs them are stored encrypted.
- Project API keys are stored only as hashes. They can be rotated and revoked at any time.
- Jira tokens are stored encrypted, and refresh tokens rotate.
- Passwords are stored only as salted scrypt hashes.
- Qualio only pushes its own
qualio/*branches, never a developer’s branch. Every change it makes reaches your repository only when a person commits or merges it. - Access to production data is limited to staff who need it, and every change to a workspace is recorded in its audit log.
If a breach affects your personal data, we will notify you and the competent authorities as the law requires.
10. Your rights
Under the GDPR and the UK GDPR you have the right to:
- Access the personal data we hold about you and get a copy of it.
- Rectify data that is inaccurate. You can edit most of your profile yourself.
- Erase your data (“right to be forgotten”), for example by deleting your account.
- Restrict or object to processing based on our legitimate interests.
- Data portability: receive the data you gave us in a machine-readable format.
- Withdraw consent at any time, for example to leave the waitlist, without affecting earlier processing.
- Complain to your data protection authority, for example where you live or work. In the UK this is the Information Commissioner’s Office (ICO).
To exercise any of these rights, email privacy@qualio-ai.com. To delete your account, use Profile → Delete account in Qualio, or email us from the address on your account. Owners can delete a whole workspace in its settings. We answer within one month, and may ask you to confirm your identity. For data we process as a processor, we pass your request to the customer concerned and help them answer it.
12. Children
Qualio is a tool for businesses and is not meant for anyone under 16. We don’t knowingly collect data from children.
13. Changes to this policy
If we change this policy, we will update the date at the top. For significant changes, we will also email account owners at least 30 days before they take effect.
14. Contact
[Qualio AI legal entity name], [Registered address, country]. Email: privacy@qualio-ai.com.