Privacy Policy
Last updated: September 1, 2026
This Privacy Policy explains how Asserto ("we", "us") collects, uses, and protects information about you when you use our Service. We are committed to protecting your personal data in compliance with applicable privacy laws including GDPR.
1. Data We Collect
| Category | Data | Purpose |
|---|---|---|
| Account data | Name, email address, password hash | Authentication and account management |
| Organization data | Organization name, domain, billing plan | Multi-tenant access control and billing |
| Test data | Test cases, recorded steps, screenshots, session replays, API call logs | Core product functionality |
| Usage data | Hosted-browser minutes, API-test request count, managed AI usage, run history | Billing, quota management, product improvement |
| Payment data | Billing address and tokenized payment details | Processed by Stripe — we never store raw card data |
| Integration credentials | Jira API tokens, AI provider API keys (encrypted) | Third-party integrations you configure |
| Log data | IP address, browser type, access timestamps | Security, debugging, fraud prevention |
2. How We Use Your Data
- To provide and operate the Service
- To process payments and manage subscriptions via Stripe
- To send transactional emails (billing receipts, quota alerts, invitations)
- To improve the Service based on aggregated, anonymized usage patterns
- To detect and prevent fraud or abuse
- To comply with legal obligations
We do not sell your personal data to third parties. We do not use your test data to train AI models.
3. Third-Party Services
We share data with the following third parties only as necessary to provide the Service:
- Stripe — payment processing. Stripe processes tokenized payment and billing data under its own privacy policy; Asserto remains responsible for the Service and its billing terms.
- AI providers (OpenAI, Anthropic, Google, xAI) — when you use AI-powered features, test content is sent to the AI provider you configure. You may use your own API keys (BYOK), in which case usage is governed by your agreement with that provider.
- Jira / Atlassian — if you connect Jira integration, we access your Jira data according to your OAuth permissions.
- Infrastructure providers — cloud hosting and database services under appropriate data processing agreements.
4. Data Storage and Retention
Your data is stored on servers in the European Union. We retain account data for the duration of your subscription plus 30 days after cancellation. Test data and session replays are retained according to your plan's data retention settings. You may request deletion of your data at any time.
5. Security
We protect your data with industry-standard measures including encryption in transit (TLS), encryption at rest for sensitive credentials, access controls, and regular security reviews. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.
6. Your Rights (GDPR)
If you are located in the European Economic Area, you have the following rights:
- Access — request a copy of your personal data
- Rectification — correct inaccurate data
- Erasure — request deletion of your data
- Portability — receive your data in a machine-readable format
- Objection — object to processing based on legitimate interests
- Withdraw consent — where processing is based on consent
To exercise your rights, contact us at [email protected]. We will respond within 30 days.
7. Cookies
We use essential cookies for authentication (session tokens) and preference storage. We do not use advertising or tracking cookies. No third-party analytics scripts are loaded without your knowledge.
8. Children
The Service is not directed to individuals under 16 years of age. We do not knowingly collect personal data from children.
9. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you by email or in-app notice before material changes take effect. The updated policy will be posted at this URL with a revised date.
10. Contact
Privacy questions or data requests: [email protected]