Qualflare Privacy Notice

• Who controls your data. Qualflare OÜ, a private limited company registered in Tallinn, Estonia, is the controller. Contact us at [email protected].
• What we collect. Account details (name, email, hashed credentials), workspace and project metadata, test artifacts you upload through the application or CLI (results, stack traces, logs, screenshots, attachments, Git branch and commit metadata), payment metadata, support communications, and product-usage telemetry including session recordings of your in-app activity.
• Sensitive data. We do not knowingly process special categories of personal data under GDPR Article 9. Test artifacts you upload may incidentally contain personal data — please scrub sensitive information before uploading.
• Why we use it. To deliver and operate the Services, secure your account, process payments, support you, comply with legal obligations, and improve the product. We use AI features powered by Google Gemini.
• Who we share it with. A short list of named sub-processors (payments, hosting, email, error monitoring, analytics, AI). See section 8.
• Where it goes. We host customer data inside the European Union. Some sub-processors are located in the United States and rely on the EU-US Data Privacy Framework and Standard Contractual Clauses.
• How long we keep it. Until you delete your account, plus short retention windows for legal, security, and backup purposes. See the table in section 10.
• Your rights. You can access, correct, export, restrict, or delete your personal data. EU/EEA, UK, and Swiss users may complain to a supervisory authority. US state residents have additional rights under CCPA, VCDPA, CPA, and similar laws.
• AI training. Our AI providers do not train their foundation models on your data. We do keep an anonymised record of AI requests — carrying no workspace or project identifier — to improve Qualflare's own features; it is on by default and any workspace admin can turn it off. See section 6.

Controller

Data Protection Officer. We have not appointed a Data Protection Officer. In our assessment, our current processing activities do not meet the threshold in Article 37(1) GDPR. You can reach our privacy team at [email protected].

EU Representative. Not applicable. The controller is established in Estonia (an EU member state).

UK and Swiss representatives. Qualflare is a globally available service and we do not specifically direct it at users in the United Kingdom or Switzerland. We have therefore not appointed a UK Article 27 representative or a Swiss FADP representative. If you are a UK or Swiss resident and use the Services, you can still exercise all of the rights described in section 13 by contacting us at [email protected].

We collect personal data in three ways: from you directly, automatically as you use the Services, and from a small number of third parties.

Data you give us

Data we collect automatically

Data from third parties

We do not purchase personal data from data brokers, marketing partners, or public databases. We do not collect data from social media platforms beyond what you choose to share with us through a support channel.

Sensitive personal data

We do not knowingly process special categories of personal data within the meaning of Article 9 GDPR (data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, health data, or data concerning a person's sex life or sexual orientation).

Authentication credentials, payment information, and precise geolocation are classified as “sensitive personal information” under some US state laws (notably the California Privacy Rights Act). We process the first two categories only as strictly necessary to deliver the Services and we do not use them for advertising, profiling, or inference.

Customer data may incidentally contain personal data

Test artifacts you upload to Qualflare — including stack traces, log files, screenshots, attachments, and defect descriptions — may incidentally contain personal data of you, your colleagues, or your end users (for example, an end user's email address that appears in an error message). You are the controller of that personal data; we process it as a processor on your behalf, governed by our Data Processing Addendum. Please scrub sensitive information from test data before uploading wherever possible.

We process personal data only for the specific purposes listed in the table below.

We do not sell your personal data, share it for cross-context behavioural advertising, or hand it to a third party to train their foundation models. The one use of your content for model improvement is our own, is anonymised before storage, and is described in full in section 6.

Under GDPR Article 6, every processing activity needs a legal basis. The table below maps each purpose to its basis.

If you withdraw consent for processing that relies on consent, we will stop that processing. Withdrawal does not affect the lawfulness of any processing we did before you withdrew.

Qualflare offers AI-assisted features inside the application — for example, AI-suggested test cases, defect clustering, and natural-language analysis of test results.

You are interacting with an artificial intelligence system. When you use these features, your input and the resulting output are processed by an AI model and may not be accurate, complete, or appropriate for every situation. Treat the output as a draft that needs human review.

Which model. We use Google's Gemini API as our underlying language model. Requests are routed through Cloudflare AI Gateway for caching, rate limiting, and observability before they reach Google.

Where the data goes. Prompts and outputs are processed by Google in accordance with the Google Generative AI terms and may be processed in the United States or other regions in which Google operates. Cloudflare may temporarily cache requests and responses on its global network. Both transfers rely on the safeguards described in section 9.

Our AI providers do not train on your data. We have contracted with our AI sub-processors so that your prompts, outputs, test artifacts and workspace content are not used to train, fine-tune, or evaluate their foundation models. Google Gemini's enterprise terms exclude API inputs and outputs from being used to improve Google's models.

We do use anonymised records to improve our own features. So that Qualflare's defect clustering and analysis get better over time, we keep a record of AI requests and their results — the prompt, the output, and the failure messages and test names involved. Before anything is stored we remove credentials, API keys and email addresses, and we store no workspace identifier and no project identifier. The records cannot be traced back to your workspace, your project, or you. We use them only to improve Qualflare's own models; we do not sell them, and we do not share them with our AI providers for their training.

Because these records carry no identifier linking them to you, they are anonymous rather than merely pseudonymised, and are outside the scope of data-protection law once stored.

Opt out. Contributing to that record is on by default, and any workspace admin can turn it off under workspace settings → privacy. Turning it off stops all future collection for that workspace, normally within five minutes. It cannot remove records already collected — because they carry no identifier, there is nothing to match them to your workspace, which is the same property that makes them anonymous. You can also disable AI features entirely at any time from your workspace settings.

Risk classification. Qualflare's AI features are not, in our assessment, “high-risk AI systems” under Annex III of the EU AI Act (Regulation (EU) 2024/1689). They do not make eligibility, employment, credit, biometric, or law-enforcement decisions. They assist QA engineers with test management and analysis. We will reassess this classification if we change the scope of our AI features.

Synthetic content. Where AI generates substantial new content (for example, suggested test cases or defect summaries), we label that content as AI-generated in the user interface in line with Article 50(2) of the EU AI Act.

This section describes how we observe activity inside the Qualflare application. It is the most invasive form of processing we do, and it deserves a dedicated explanation.

What we capture

When you use the Qualflare application (app.qualflare.com), our product analytics SDK — provided by Amplitude, Inc. and configured to use Amplitude's EU server zone (api.eu.amplitude.com) — captures the following:

• Session recordings — video-style replays of your interactions with the application. Sample rate is 100%, which means every session is recorded. Amplitude's session replay applies its default masking, which automatically obscures the contents of password fields and standard input elements but does not mask arbitrary on-screen text by default.
• Autocaptured events — clicks, form submissions, page changes, and scroll events on every interactive element in the application.
• Network capture — a subset of HTTP requests and responses observed by the SDK in your browser, including request URLs and timing.
• Web Vitals and engagement metrics — Core Web Vitals (LCP, CLS, INP) and engagement signals such as time on page and scroll depth.

The marketing site (qualflare.com) does not load Amplitude session replay. It runs a separate session-replay tool, Microsoft Clarity, described below; the two are not connected and Clarity is never loaded in the application.

Marketing-site session replay (Microsoft Clarity)

On qualflare.com only, we use Microsoft Clarity for heatmaps and session replay. Recordings capture page content, clicks, scrolling and mouse movement; form input is masked, so what you type into a field is not recorded. Clarity is loaded only after you accept analytics cookies and its script is not requested at all before then, so declining means no recording and no Clarity cookies. Because the marketing site holds no customer test data, these recordings do not carry the categories of content described above for the application.

Why this matters

Because session recordings of test management screens may incidentally capture customer test data — including stack traces, defect descriptions, log file excerpts, and any PII visible on screen — the protections we apply are stronger than for ordinary analytics:

• Data residency. Recordings are sent to Amplitude's EU servers, not to a US region.
• Legal basis. For EU, EEA, UK, and Swiss visitors we process this data only with your prior consent, captured through the cookie banner. We do not rely on legitimate interest. For US visitors we honour the Global Privacy Control (GPC) browser signal as a valid opt-out. See the Cookie Policy for the full regional model.
• Retention. Recordings are retained for 7 days and then deleted.
• Withdrawal. You can withdraw consent at any time from the “Cookie Preferences” link in the application footer. Future sessions will not be recorded.
• Access. Recordings are accessible only to a limited number of Qualflare engineers for debugging, product research, and incident investigation. We do not share application session recordings with any third party other than Amplitude as our processor. (Marketing-site recordings are a separate system processed by Microsoft Clarity — see above — and contain no customer test data.)

What you can do

If you would like a particular session recording deleted, send the approximate date, time, and your account email to [email protected] and we will locate and delete it.

We use a small number of carefully selected sub-processors to operate the Services. Each sub-processor is bound by a written data processing agreement that includes the obligations required by Article 28 GDPR and, where applicable, the European Commission's 2021 Standard Contractual Clauses.

We will update this list and notify customers of material changes through the sub-processor change record in DPA §8.7 at least 30 days before any new sub-processor begins processing personal data, so that customers have an opportunity to object.

We may also disclose personal data:

• To our professional advisors (lawyers, accountants, auditors), bound by confidentiality;
• In a corporate transaction, such as a merger, financing, or sale of all or part of our business — we will notify you in advance;
• To public authorities, where we are legally required to do so or where it is necessary to protect our rights, your safety, or the safety of others.

Qualflare is established in Estonia and stores customer data inside the European Union. Our application servers and primary PostgreSQL database run in Google Cloud's europe-central2 region (Warsaw, Poland). Object storage and edge services are provided by Cloudflare with EU-region routing. We do not store customer data outside the European Economic Area in the ordinary course of operating the Services.

Some of our sub-processors are based in the United States or operate global infrastructure. When personal data leaves the European Economic Area, we rely on one of the following safeguards under Chapter V GDPR:

• EU-US Data Privacy Framework for sub-processors that are certified under the Framework (currently Google LLC and several of the US-based vendors listed above).
• Standard Contractual Clauses (Module 2 or Module 3) adopted by the European Commission in Decision 2021/914, supplemented by transfer impact assessments and the technical and organisational measures described in section 11.
• Adequacy decisions for transfers to the United Kingdom and Switzerland.

You can request a copy of the safeguards we have in place for any specific transfer by writing to [email protected].

We retain personal data only for as long as it is needed for the purpose for which we collected it, unless a longer period is required or permitted by law. The schedule below summarises the main retention periods.

When the retention period expires we either delete the personal data or irreversibly anonymise it.

We protect personal data with technical and organisational measures appropriate to the risk. These measures include:

• Encryption in transit. All connections to the Services use TLS 1.2 or higher.
• Encryption at rest. Customer data is stored in encrypted databases and object storage.
• Access control. Role-based access control inside the application; least-privilege access for Qualflare employees; mandatory single sign-on and multi-factor authentication for production systems.
• Audit logging. Security-sensitive actions are recorded in an immutable audit log retained for at least 365 days.
• Software development. Code review on every change, automated security testing, dependency scanning, and patching of known vulnerabilities.
• Sub-processor due diligence. We assess each sub-processor before engagement and reassess on a regular cadence.
• Incident response. Documented procedures for detecting, containing, and reporting security incidents.
• Personnel. All employees are bound by confidentiality and receive privacy and security training.

Compliance certifications. We have not yet obtained third-party security certifications such as SOC 2 or ISO 27001. As we grow we plan to pursue independent attestation, and we will update this notice when we do.

No security programme can guarantee absolute protection. We do everything we reasonably can; you can help by choosing a strong password and enabling multi-factor authentication.

Qualflare is a B2B service designed for software development and QA professionals. The Services are not directed at children, and we do not knowingly collect personal data from anyone under 13 years of age (the digital-consent threshold under Estonian law implementing Article 8 GDPR).

If you believe a child has provided personal data to us, please contact [email protected] and we will delete the data and the associated account.

Subject to local law, you have the following rights regarding your personal data:

• Right of access (GDPR Art 15) — obtain a copy of the personal data we hold about you and information about how we process it.
• Right to rectification (Art 16) — correct inaccurate data, complete incomplete data.
• Right to erasure (Art 17, “right to be forgotten”) — request that we delete your personal data.
• Right to restriction (Art 18) — ask us to limit processing in defined situations.
• Right to data portability (Art 20) — receive your data in a structured, commonly used, machine-readable format. To request a copy, email [email protected]; we will deliver an export within 30 days of receiving a verified request.
• Right to object (Art 21) — object to processing based on legitimate interests, including profiling, and to direct marketing at any time.
• Right not to be subject to a solely automated decision (Art 22) — see section 14.
• Right to withdraw consent at any time, where processing is based on consent, with no effect on the lawfulness of prior processing.

How to exercise your rights

The fastest way is to email [email protected] from the address registered on your account. You can also use the contact form at https://qualflare.com/contact. We will verify your identity, respond within one calendar month (Article 12(3) GDPR), and act on your request free of charge in most cases.

If we say no

If we deny your request, we will tell you why and explain how to appeal. To appeal, reply to our response email within 45 days. We will reconsider the decision and respond within 45 days. (Several US state laws require this appeal process — see section 16.)

Right to lodge a complaint

If you believe we have not handled your personal data lawfully, you have the right to complain to a data protection supervisory authority. We would appreciate the chance to address your concerns first, but you can complain directly at any time:

• Estonia (lead authority for Qualflare): Andmekaitse Inspektsioon (AKI), Tatari 39, 10134 Tallinn — [email protected] — https://www.aki.ee
• United Kingdom: Information Commissioner's Office (ICO) — https://ico.org.uk
• Switzerland: Federal Data Protection and Information Commissioner (FDPIC) — https://www.edoeb.admin.ch
• Canada: Office of the Privacy Commissioner (OPC) — https://www.priv.gc.ca
• Other EU/EEA member state: the supervisory authority where you live or work

We do not make decisions that have legal or similarly significant effects on you using solely automated processing within the meaning of Article 22 GDPR. AI features inside Qualflare suggest test cases, cluster defects, and analyse results, but every meaningful action is taken by a human user — the AI never approves, rejects, or otherwise commits a decision that affects you on its own.

If we ever introduce automated decision-making with legal or similarly significant effects, we will update this notice, give you meaningful information about the logic involved, explain the significance and consequences, and give you the right to obtain human review, express your view, and contest the decision.

If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Estonian Data Protection Inspectorate (AKI) without undue delay and, where feasible, no later than 72 hours after becoming aware of it, in line with Article 33 GDPR. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly and without undue delay (Article 34 GDPR), unless an exception applies. In addition, our Data Processing Addendum sets out our breach notification commitments to customers.

European Economic Area, United Kingdom, Switzerland

Sections 5, 9, and 13 already cover your rights under GDPR, UK GDPR, and the revised Swiss FADP. Your supervisory authority is listed in section 13.

Canada

If you are a Canadian resident, the Personal Information Protection and Electronic Documents Act (PIPEDA) applies. We process your personal information based on your express or implied consent and the purposes set out in this notice. You may withdraw consent at any time and complain to the Office of the Privacy Commissioner of Canada (see section 13).

United States

This section applies if you are a resident of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, Iowa, New Hampshire, New Jersey, Maryland, Minnesota, Rhode Island, or any other US state with a comprehensive consumer privacy law.

Categories of personal information collected. See section 3 for a complete inventory.

Categories of personal information sold or shared. We do not sell personal information for money. We do not share personal information for cross-context behavioural advertising. If you are a California resident, you can confirm this by visiting the link below.

Sensitive personal information. We process authentication credentials and payment information only as necessary to deliver the Services and never for inferring characteristics about you. You can ask us to limit our use of sensitive personal information at the link below.

Your rights. Subject to verification, you may:

• Confirm whether we process your personal information and access it
• Correct inaccurate personal information
• Request deletion of your personal information
• Obtain a copy of the personal information you provided to us, in a portable format
• Opt out of any sale or sharing of personal information (which we do not currently do)
• Opt out of profiling for decisions that produce legal or similarly significant effects (which we do not currently do)
• Limit our use of sensitive personal information
• Appeal a denial of any of the above (see section 13)
• Not be discriminated against for exercising any of these rights

How to exercise. Email [email protected] or use https://qualflare.com/contact. The same links serve as our:

• “Do Not Sell or Share My Personal Information” request form
• “Limit the Use of My Sensitive Personal Information” request form

Global Privacy Control (GPC). We honour the GPC browser signal as a valid opt-out of sale and sharing for visitors from US states whose laws recognise universal opt-out mechanisms. Implementation details are in the Cookie Policy.

Authorised agents. You may designate an authorised agent to make requests on your behalf. We will require proof of authorisation and may verify your identity directly.

Notice of financial incentive. We do not offer financial incentives or loyalty programs in exchange for personal information.

Retention. See the table in section 10.

We may update this notice from time to time. The “Last updated” date at the top will reflect the date of the most recent change. If a change is material, we will notify you in advance — by email, in-product banner, or both — so that you have the opportunity to review the change before it takes effect.

For privacy questions, requests to exercise your rights, or to report a concern:

• Email: [email protected]
• Web form: https://qualflare.com/contact
• Post:
  Qualflare OÜ

  Sepapaja tn 6

  15551 Tallinn

  Estonia