Privacy Policy

1. Information We Collect

Information you provide to us

When you contact us through our website, we may collect your name, email address, project type, company or organization information, and any information you include in your message. If an inquiry becomes a business relationship, we may retain related communications and information as reasonably necessary to provide services, manage the relationship, maintain business records, resolve disputes, and comply with legal obligations.

QAandAI Verify account information

When you create or are provisioned a QAandAI Verify account, we may collect your email address and authentication information. Passwords are not stored in plain text — passwords are processed using a one-way cryptographic hashing function with a unique random salt. If you enable two-factor authentication, we maintain the authentication information necessary to verify time-based one-time passwords ("TOTP"). QAandAI Verify is generally provisioned for authorized users associated with a particular organization. Within an organization's deployment, authorized users may share access to workspace information, including requirements, tests, results, and defects, depending on the configuration established for that organization.

QAandAI Verify usage information

When you use QAandAI Verify, we may process information including:

• requirements and instructions you submit;
• target websites, applications, APIs, or environments configured for testing;
• AI-generated test steps;
• test execution information;
• pass/fail results;
• screenshots and videos generated during testing;
• failure information and diagnostic data;
• defects generated from test results; and
• information necessary to integrate with services configured by your organization.

You and your organization are responsible for ensuring that you have the authority to provide information submitted to QAandAI Verify and to authorize testing of the applicable systems.

QA Analyzer

When you use QA Analyzer, we process the URL you provide and information obtained during the authorized scan to generate findings concerning areas such as user interface behavior, accessibility, APIs, and security-related observations. QA Analyzer is designed to perform read-only analysis and safe requests. It is not intended to modify the target system or perform destructive security testing. You must only scan websites, applications, APIs, or systems that you own or have authorization to test.

AI voice assistant

When you use our AI voice assistant, your call may be processed and recorded by our voice technology provider, Retell AI. We disclose that you are interacting with an AI system and that the call may be recorded before the interaction begins. If you do not wish to interact with the AI voice assistant, you may contact us through another available method.

Technical and security information

When you use our Services, our systems and hosting providers may automatically process technical information reasonably necessary to operate and secure the Services, such as IP address, browser or device information, timestamps, authentication events, error information, and server or security logs. The precise information collected may depend on the Service and the technologies used to provide it.

2. How We Use Information

We may use information to:

• provide, operate, maintain, and secure the Services;
• authenticate users and administer accounts;
• respond to inquiries and requests;
• provide customer support;
• generate and execute authorized tests;
• generate QA Analyzer reports;
• generate AI-assisted test steps;
• maintain test history, screenshots, videos, defects, and results;
• troubleshoot technical problems;
• detect unauthorized or abusive use;
• communicate about the Services;
• provide custom development or QA services requested by customers;
• operate customer-configured integrations;
• improve the reliability, functionality, and accuracy of our Services; and
• comply with applicable legal obligations and protect our legal rights.

We do not sell personal information to advertisers.

3. AI Processing

QAandAI Verify uses artificial intelligence to assist with generating test steps and related functionality. When an authorized user requests AI-generated test content, information necessary to fulfill that request may be transmitted to Anthropic's Claude API, including requirement text and, where applicable, information obtained from an authorized target website or application. AI-generated content may contain errors and should be reviewed before being relied upon. Customers and users should not submit confidential, regulated, proprietary, personal, or third-party information unless they are authorized to provide that information for processing through the Services.

4. Integrations and Service Providers

We may use third-party providers to operate the Services. Depending on the features you use or your organization's configuration, these may include:

• Anthropic — AI processing used to assist with test generation.
• Retell AI — technology supporting our AI voice assistant, including call processing and potentially recording.
• Slack — notifications relating to testing activity when configured by an authorized workspace administrator.
• Atlassian Jira — defect and issue management when configured by an authorized workspace administrator.
• GitHub — source-code repository integration when configured by an authorized workspace administrator.
• Render — hosting and infrastructure for certain QA and AI services.
• Netlify — hosting and infrastructure for the QA and AI website and related services.

These providers may process information as necessary to perform services on our behalf or as configured by the applicable customer. We may also disclose information when required by law, legal process, or governmental request, or when reasonably necessary to protect the security, rights, or safety of QA and AI, our users, or others.

5. Customer-Configured Integrations

An organization's administrator may connect QAandAI Verify with third-party services such as Slack, Jira, or GitHub. When an administrator enables an integration, relevant information may be transmitted to the organization's configured third-party account. For example, a failed test may result in a notification being sent to the organization's Slack workspace or an issue being created or updated in its Jira project. QA and AI does not control the privacy practices of third-party services used independently by customers. Customers should review the privacy policies and settings applicable to their third-party accounts.

6. Data Retention

We retain information for as long as reasonably necessary for the purposes for which it was collected, including providing the Services, maintaining customer accounts, supporting customers, maintaining appropriate business and security records, resolving disputes, enforcing agreements, and complying with legal obligations. Retention periods may vary depending on the type of information, the applicable Service, customer configuration, contractual requirements, security considerations, and legal obligations. Customers or authorized workspace administrators may contact us regarding deletion of applicable account or workspace information. We may retain limited information where reasonably necessary for security, fraud prevention, dispute resolution, backup integrity, recordkeeping, or legal compliance.

7. Security

We use administrative, technical, and organizational safeguards intended to protect information processed through the Services. Depending on the Service, these safeguards include measures such as:

• encrypted communications using TLS;
• password hashing using scrypt with per-account random salts;
• signed and HttpOnly session cookies;
• time-limited authentication sessions;
• optional TOTP-based two-factor authentication; and
• access controls intended to restrict access to authorized users.

No internet-connected service or security measure can guarantee absolute security. Users are responsible for protecting their credentials and authentication devices and for notifying us if they believe their account has been compromised.

8. Your Choices and Privacy Rights

Depending on where you live and applicable law, you may have rights relating to your personal information, which may include requesting access, correction, deletion, or other actions concerning certain personal information. To submit a privacy request, contact us using the information below. We may need to verify your identity before processing a request. Certain information may be retained where permitted or required by law. If your account is provided through an organization, some requests concerning organization-controlled workspace information may need to be handled through that organization's administrator.

9. Children's Privacy

The Services are intended for business and professional use and are not directed to children. You must be at least 18 years old to create an account unless otherwise expressly authorized by us. We do not knowingly collect personal information directly from children under 18 through our Services.

10. International Processing

Our Services and service providers may process information in the United States and other jurisdictions. Where required by applicable law, appropriate mechanisms may be used for international transfers of personal information.

11. Changes to This Privacy Policy

We may update this Privacy Policy as our Services, technology, or legal obligations change. When we make material changes, we will update the "Last updated" date above and may provide additional notice when appropriate.

12. Contact Us

For questions about this Privacy Policy or requests concerning your information, contact:
QA and AI
Operated by THEOLUME TECHNOLOGIES LLC
Miami, Florida, USA
Email: hello@qaandai.com
Website: qaandai.com