Privacy Policy

This Privacy Policy describes how Ploono s.r.o. (“qlane”, “we”, “us”) collects, uses, and shares personal data when you visit https://qlane.ai or use our services (collectively, the “Service”). We act as the data controller under Regulation (EU) 2016/679 (“GDPR”) and Act No. 18/2018 Coll. of the Slovak Republic on the protection of personal data.

1. Data we collect

We collect only the data we need to operate the Service:

• Account data — name, email, organization, authentication identifiers (provided via WorkOS SSO).
• Integration data — when you connect GitHub, we receive repository metadata, pull-request diffs, and branch information required to run tests. Full repository clones exist only inside the ephemeral test sandbox and are destroyed with it; retained test artefacts may contain code excerpts, as described in Section 6.
• Issue-tracker data — when you connect Jira, we read project, issue-type, and field metadata, label suggestions, and the open/closed status of issues we have filed. While the issue-filing dialog is open we also read the list of users assignable to the selected project — names and account identifiers from your Jira — so you can pick an assignee. That list is fetched when the dialog opens and discarded when it closes; we never store or cache it. What we keep is limited to an encrypted authentication token, your Jira site identifier and address, the project and issue type you selected, and the key and URL of each issue we file. For Jira Cloud that means we retain no Jira user profiles, account identifiers, or email addresses. For self-hosted Jira Data Center we additionally store one item: the display name of the account whose access token you supply, shown as a label so you can tell the connection apart.
• Usage data — pages viewed, feature interactions, session identifiers, and approximate location derived from IP address.
• Technical data — browser type, device type, language, and similar diagnostic information collected via server logs.
• Communications — content of emails or support messages you send us.

We do not knowingly collect special categories of personal data (GDPR Art. 9) and ask you not to submit such data through the Service.

2. Legal bases for processing

We process personal data under the following GDPR legal bases:

• Contract (Art. 6(1)(b)) — to provide the Service, manage your account, and fulfil our agreement with you.
• Legitimate interests (Art. 6(1)(f)) — to secure the Service, prevent abuse, analyse aggregate usage, and improve features. You can object at any time.
• Consent (Art. 6(1)(a)) — for non-essential cookies, marketing emails, and optional analytics. You may withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)) — to comply with tax, accounting, and other applicable laws.

3. How we use data

• Provide, operate, and maintain the Service.
• Run AI-driven QA sessions against the repositories you connect.
• File bug reports in the issue tracker you connect, when you choose to — a filed issue contains the failing test’s title, description, and evidence such as screenshots, and carries a temporary qlane label that we remove when the test passes again.
• Authenticate users and secure accounts.
• Respond to support requests and communicate service changes.
• Detect, prevent, and address fraud, abuse, and technical issues.
• Comply with legal obligations.

We do not use your source code or other service content to train machine-learning models, and AI requests are routed with zero-data-retention and no-training enforcement. The mechanism is described on our Security page.

4. Sharing and recipients

We share personal data only with trusted providers acting as processors under GDPR Art. 28, and only to the extent necessary. Current categories of recipients:

• Authentication — WorkOS, Inc. (USA).
• Cloud infrastructure & sandbox execution — Vercel Inc. (USA), Railway Corp. (USA), FoundryLabs, Inc. (E2B) (USA, ephemeral sandbox runtime), Browserbase, Inc. (USA, managed Chromium for QA-agent browser automation).
• AI model providers — Anthropic PBC and OpenAI OpCo LLC, routed through Vercel AI Gateway with zero-data-retention routing.
• Source-code platform integrations — GitHub, Inc. (only repositories you explicitly connect).
• Issue-tracker integrations — Atlassian Pty Ltd (Jira Cloud; only the sites and projects you explicitly connect). qlane — not Atlassian — is responsible for the privacy, security, and integrity of the data qlane processes through this integration. Self-hosted Jira Data Center instances are different: they run on your own infrastructure, we authenticate with a personal access token you provide (stored encrypted), and no data flows to Atlassian.
• Networking & content delivery — Cloudflare, Inc. (USA).
• Billing — Stripe Payments Europe Ltd (for payment processing).
• Transactional email — Resend, Inc. (USA).
• Error monitoring — Sentry (Functional Software, Inc.) (USA), with EU-region ingestion and automatic PII attachment disabled.
• Product analytics — PostHog, Inc.; ingestion stays in the EU.

We do not sell personal data. We may disclose data where required by law, court order, or to protect the rights, property, or safety of users or third parties.

5. International transfers

Some of our processors are located outside the European Economic Area, primarily in the United States. Where we transfer personal data outside the EEA we rely on appropriate safeguards under GDPR Chapter V, in particular the European Commission’s Standard Contractual Clauses (Decision 2021/914) and, where applicable, the EU–US Data Privacy Framework. For the full sub-processor list, regional split (customer content / processing / control planes), and per-vendor transfer mechanism, see our Data Residency page.

6. Retention

• Account data — for the lifetime of your account, plus up to 12 months thereafter for dispute resolution.
• Test session artefacts (screenshots, logs, test cases, session transcripts, and test-case embeddings; these may contain code excerpts) — retained for the duration of your subscription, then deleted within 90 days of termination.
• Source code in sandboxes — destroyed when the microVM terminates; typically within minutes of a test session ending.
• Billing records — retained for 10 years as required by Slovak accounting law (Act No. 431/2002 Coll.).
• Server logs — up to 30 days.

7. Your rights

Under GDPR Art. 15–22 you have the right to:

• access your personal data (Art. 15);
• rectify inaccurate data (Art. 16);
• erase data (“right to be forgotten”, Art. 17);
• restrict processing (Art. 18);
• data portability (Art. 20);
• object to processing based on legitimate interests (Art. 21);
• withdraw consent at any time where processing is based on consent;
• not be subject to decisions based solely on automated processing (Art. 22).

To exercise any of these rights, contact us at [email protected]. We respond within one month.

8. Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority. In the Slovak Republic this is the Úrad na ochranu osobných údajov Slovenskej republiky (https://dataprotection.gov.sk), Hraničná 12, 820 07 Bratislava 27, Slovakia. You may also lodge a complaint with the supervisory authority in your country of residence.

9. Cookies

We use strictly necessary cookies to operate the Service (authentication, session, CSRF). We set non-essential cookies (analytics, marketing) only with your consent. Your consent choice is stored in your browser’s localStorage under the key qlane:cookie-consent. To withdraw or change your choice, clear the site data (localStorage and cookies) for this domain in your browser settings — the consent banner will then appear again on your next visit. For details see our Terms of Service.

10. Security

We apply appropriate technical and organisational measures to protect personal data, including encryption in transit and at rest, least-privilege access controls, sandboxed execution, audit logging, and regular review of our security posture. Our Security page describes the architecture in detail — repository access scopes, sandbox isolation, and AI data handling. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.

11. Children

The Service is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes we will update the “Last updated” date and, where appropriate, notify you by email or via the Service.

13. Contact

Questions about this policy or our data practices? Email us at [email protected] or write to Ploono s.r.o., Klincová 18973/39, Bratislava, Slovakia.