Privacy Policy

1. Data we collect

We collect only the data we need to operate the Service:

• Account data — name, email, organization, authentication identifiers (provided via WorkOS SSO).
• Integration data — when you connect GitHub, we receive repository metadata, pull-request diffs, and branch information required to run tests. Full repository clones exist only inside an isolated test sandbox and are destroyed with it: at the end of the run for a Compose stack, and when the pull request closes for a single repository; retained test artefacts may contain code excerpts, as described in Section 6.
• AI coding assistant data — when you connect an AI coding assistant or editor to our MCP server, directly or through the qlane plugin, we receive what the assistant sends on your behalf: the name or clone URL of the repository it is working in; the names, descriptions and settings of the projects it creates or changes for you, including which issue tracker and source-control provider they use; the settings of the test environments it creates or changes (such as a repository name, branch, build and start commands, or a target URL); the names of the environment variables and test accounts it asks you to fill in; the text it searches your connected repositories for; and — when you ask it to plan tests for changes you have not opened a pull request for — the diff of those changes, the commit it is based on, and an optional title and description. Variable values and test-account passwords never pass through the assistant: you enter them on a qlane page. With each tool call, the assistant can also send a one-line statement of why it is making the call, and the identifier of the model it says it is running as. We send both to PostHog as product analytics, after removing email addresses, phone numbers, IP addresses, card numbers, URL parameter values and the secret parts of our private links from the statement, where we detect them.
• Issue-tracker data — when you connect Jira, we read project, issue-type, and field metadata, label suggestions, and the open/closed status of issues we have filed. While the issue-filing dialog is open we also read the list of users assignable to the selected project — names and account identifiers from your Jira — so you can pick an assignee. That list is fetched when the dialog opens and discarded when it closes; we never store or cache it. What we keep is limited to an encrypted authentication token, your Jira site identifier and address, the project and issue type you selected, and the key and URL of each issue we file. For Jira Cloud that means we retain no Jira user profiles, account identifiers, or email addresses. For self-hosted Jira Data Center we additionally store one item: the display name of the account whose access token you supply, shown as a label so you can tell the connection apart.
• Usage data — pages viewed, feature interactions, session identifiers, and approximate location derived from IP address.
• Technical data — browser type, device type, language, and similar diagnostic information collected via server logs.
• Communications — content of emails or support messages you send us.
• Marketing-email choices — whether you agreed to marketing email from us, declined it or withdrew; when and where in the Service you answered; the wording you were shown; the email address your account had at that moment; the confirmations we send when you withdraw; a record of each marketing email we send you, and what our email provider tells us about it: that it bounced, that it was reported as spam, or that it was not sent because the address is on the provider's block list; and whether you opened each one and which of its links you clicked.

We do not knowingly collect special categories of personal data (GDPR Art. 9) and ask you not to submit such data through the Service.

2. Legal bases for processing

We process personal data under the following GDPR legal bases:

• Contract (Art. 6(1)(b)) — to provide the Service, manage your account, and fulfil our agreement with you.
• Legitimate interests (Art. 6(1)(f)) — to secure the Service, prevent abuse, analyse aggregate usage, improve features, show you notices in the Service that carry no promotion, and keep your "no" to marketing email so we honour it and do not ask you again. You can object at any time.
• Consent (Art. 6(1)(a)) — for non-essential cookies, optional analytics, and marketing email: news about new features, offers, testing tips and short product-survey invitations, sent only if you agree to it in the Service, together with seeing whether you open those emails and which of their links you click. You may withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)) — to comply with tax, accounting, and other applicable laws, including keeping a record of your marketing-email consent and of its withdrawal (Slovak Act No. 452/2021 Coll., §116).

3. How we use data

• Provide, operate, and maintain the Service.
• Run AI-driven QA sessions against the repositories you connect.
• Plan tests for code changes your AI coding assistant submits before a pull request exists.
• File bug reports in the issue tracker you connect, when you choose to — a filed issue contains the failing test’s title, description, and evidence such as screenshots, and carries a temporary qlane label that we remove when the test passes again.
• Authenticate users and secure accounts.
• Respond to support requests and communicate service changes.
• Send marketing email, only if you agreed to it in the Service. You can withdraw at any time: use the unsubscribe link in any marketing email, open Account → Email preferences in the Service, or write to privacy@qlane.ai. We confirm by email every withdrawal you make yourself. We do not confirm a withdrawal recorded because you deleted your account, as the address is gone, or because our email provider told us an email to you bounced, was reported as spam or was blocked.
• Detect, prevent, and address fraud, abuse, and technical issues.
• Comply with legal obligations.

We do not use your source code or other service content to train machine-learning models, and the model providers that process AI requests for us do not train on them, under their terms or our AI gateway provider’s agreements with them. Zero data retention is available under an Enterprise agreement. The mechanism is described on our Security page.

4. Sharing and recipients

We share personal data only with trusted providers acting as processors under GDPR Art. 28, and only to the extent necessary. Current categories of recipients:

• Authentication — WorkOS, Inc. (USA).
• Cloud infrastructure & sandbox execution — Vercel Inc. (USA), Railway Corp. (USA), FoundryLabs, Inc. (E2B) (USA, sandbox runtime), Browserbase, Inc. (USA, managed Chromium for QA-agent browser automation), Google LLC (USA, Artifact Registry, storing your test environments’ cached build layers in your organization’s data region).
• AI model providers — Anthropic, PBC, OpenAI OpCo, LLC, Amazon Web Services, Inc. and Microsoft Corporation for language-model inference, and TypeSafe AI, Inc. for evaluation-model inference, all reached through Vercel AI Gateway, which restricts every request made in work started after 12 October 2026 to them. None of them trains on our requests, under their terms or our AI gateway provider’s agreements with them.
• Source-code platform integrations — GitHub, Inc. (only repositories you explicitly connect).
• Issue-tracker integrations — Atlassian Pty Ltd (Jira Cloud; only the sites and projects you explicitly connect). qlane — not Atlassian — is responsible for the privacy, security, and integrity of the data qlane processes through this integration. Self-hosted Jira Data Center instances are different: they run on your own infrastructure, we authenticate with a personal access token you provide (stored encrypted), and no data flows to Atlassian.
• Networking & content delivery — Cloudflare, Inc. (USA).
• Billing — Stripe Payments Europe Ltd (for payment processing).
• Email delivery (transactional and marketing), and measuring opens and clicks of marketing email — Resend, Inc. (USA).
• Error monitoring — Sentry (Functional Software, Inc.) (USA), with EU-region ingestion and automatic PII attachment disabled.
• Product analytics and session replay — PostHog, Inc.; stored in the EU. Session replays record your screens in the web application and, if you accept analytics cookies, on our website, with form fields and the secrets we display hidden.

We do not sell personal data. We may disclose data where required by law, court order, or to protect the rights, property, or safety of users or third parties.

5. International transfers

Some of our processors are located outside the European Economic Area, primarily in the United States. Where we transfer personal data outside the EEA we rely on appropriate safeguards under GDPR Chapter V, in particular the European Commission’s Standard Contractual Clauses (Decision 2021/914) and, where applicable, the EU–US Data Privacy Framework. For the full sub-processor list, regional split (customer content / processing / control planes), and per-vendor transfer mechanism, see our Data Residency page.

6. Retention

• Account data — for the lifetime of your account, plus up to 12 months thereafter for dispute resolution.
• Marketing-email records (your answers about marketing email, each with the email address it was given for; the confirmations of your withdrawals; and the record of marketing emails sent to you, with any bounce, spam report or block our email provider tells us about) — kept for 4 years after you withdraw, as Slovak law requires, including after your account is deleted, and deleted within one month after that. If you declined, that answer is kept, with its address, for 4 years after you gave it, and deleted within one month after that. Whether you opened a marketing email and which of its links you clicked is deleted 2 years after that email was sent, or when your account is deleted, whichever comes first. Our email provider, Resend, keeps its own record of each email it sends for us, including opens and clicks, for up to 30 days.
• Test session artefacts (screenshots, logs, test cases, session transcripts, and test-case embeddings; these may contain code excerpts) — retained for the duration of your subscription, then deleted within 90 days of termination. This does not cover agent tool outputs, which are a distinct class with their own retention, described in the next bullet.
• Agent tool outputs (what a tool returned during a test run — page snapshots, command output, API responses; these may contain code excerpts and application data) — the content is retained for 30 days, after which it is deleted and only a size and a cryptographic digest are kept; those are deleted within 90 days of termination.
• Changes submitted for test planning (the diff an AI coding assistant sends through our MCP server) — the diff itself is deleted when planning finishes, or by an automatic clean-up if planning is interrupted. The test plan produced from it — its test cases and their steps, the changed files and API endpoint paths they cover, and notes on what it does and does not cover, all of which reflect your code — is kept until you delete the project or your organization, together with the commit the diff is based on, a cryptographic digest of the diff, and the title and description sent with it.
• Source code in sandboxes — destroyed with the sandbox: at the end of the run for a Compose stack, and when the pull request closes for a single repository, whose saved state expires 72 hours after its last run in any case.
• Cached build layers (what your test environment’s build steps produce; these can contain source code and dependencies) — up to 15 days after the environment’s last build; deleted when you turn build caching off for the environment or delete your organization.
• Billing records — retained for 10 years as required by Slovak accounting law (Act No. 431/2002 Coll.).
• Server logs — up to 30 days.
• Product analytics (usage events) — up to 12 months, then deleted.
• Session replays — up to 90 days, then deleted.

Two of the classes above — screenshots, and the larger agent tool outputs — are written to object storage as well as to our database. When an agent tool output reaches the end of its 30-day window we delete the stored object first and clear our pointer to it only once that has succeeded, so a deletion that fails is retried rather than lost. Outside that sweep — for screenshots, which have no sweep of their own, and for anything still inside its window when you delete your organization, since the records then go with the organization and the sweep never sees them again — the database record goes and the object-storage copy is unlinked rather than erased item by item: nothing in the product can reach it.

7. Your rights

Under GDPR Art. 15–22 you have the right to:

• access your personal data (Art. 15);
• rectify inaccurate data (Art. 16);
• erase data (“right to be forgotten”, Art. 17);
• restrict processing (Art. 18);
• data portability (Art. 20);
• object to processing based on legitimate interests (Art. 21);
• withdraw consent at any time where processing is based on consent; for marketing email, use the unsubscribe link in any marketing email or Account → Email preferences in the Service;
• not be subject to decisions based solely on automated processing (Art. 22).

To exercise any of these rights, contact us at privacy@qlane.ai. We respond within one month.

8. Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority. In the Slovak Republic this is the Úrad na ochranu osobných údajov Slovenskej republiky (https://dataprotection.gov.sk), Hraničná 12, 820 07 Bratislava 27, Slovakia. You may also lodge a complaint with the supervisory authority in your country of residence.

9. Cookies

We use strictly necessary cookies to operate the Service (authentication, session, CSRF). We set non-essential cookies (analytics, marketing) only with your consent. Your consent choice is stored in your browser’s localStorage under the key qlane:cookie-consent. To withdraw or change your choice, clear the site data (localStorage and cookies) for this domain in your browser settings — the consent banner will then appear again on your next visit. For details see our Terms of Service.

10. Security

We apply appropriate technical and organisational measures to protect personal data, including encryption in transit and at rest, least-privilege access controls, sandboxed execution, audit logging, and regular review of our security posture. Our Security page describes the architecture in detail — repository access scopes, sandbox isolation, and AI data handling. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.

11. Children

The Service is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes we will update the “Last updated” date and, where appropriate, notify you by email or via the Service.

13. Contact

Questions about this policy or our data practices? Email us at privacy@qlane.ai or write to Ploono s.r.o., Klincová 18973/39, 821 08 Bratislava, Slovakia.