Privacy Policy

This Privacy Policy (“Policy”) explains how Qarmiq, Inc. ("Qarmiq", "we", "us") collects, uses, and protects information across our marketing website (qarmiq.ai), our product (app.qarmiq.ai), our Witness capture widget, and our Witness browser extension. If you have subscribed to the Qarmiq platform, please refer to our SaaS Subscription Agreement, Data Processing Agreement, and Acceptable Use Policy.

Who we are

Qarmiq, Inc. ("we", "us", "our") is a corporation incorporated in the State of Delaware, United States, with its registered office at 251 Little Falls Drive, Wilmington, New Castle County, Delaware 19808. We operate the website qarmiq.ai and the Qarmiq testing platform at app.qarmiq.ai. If you have any questions about this Policy or our privacy practices, contact us at contact@qarmiq.ai.

Scope of this Policy

This Policy covers personal data we collect and process in two different roles:

(i) As a controller, when you visit our marketing site, contact us, or subscribe to updates, we determine the purposes and means of processing your personal data.

(ii) As a processor, when a customer organization uses the Qarmiq platform, we process personal data on behalf of, and in accordance with the instructions of, the customer. The customer is the controller of that data and we are the processor. The customer's own privacy notice applies to the processing of personal data of the end users inside the platform.

Sections 3 to 6 describe our practices when we act as a controller, while Sections 7 and 8 describe our privacy practices when we act as a processor.

Marketing website, information we collect

(i) Contact form submissions: Your name, email address, company name, and any message you provide when you contact us or request a trial.

(ii) Analytics data: Anonymized usage data including pages visited, time spent on the website, referring source, browser type, and general geographic region. This data is collected through Google Tag Manager and the analytics tags it loads. Visitors in the European Economic Area, the United Kingdom and Switzerland are asked for consent first. Elsewhere it is collected unless you opt out.

How we use marketing-site information

We use the information collected through our marketing website to:

(i) respond to your enquiries and trial requests

(ii) understand how visitors use our website so we can improve it

(iii) communicate with you regarding our products, services, and updates that you have requested or consented to receive.

We do not sell, rent, or share your personal information with third parties for marketing purposes.

Where applicable privacy laws require a legal basis for processing personal data, Qarmiq processes personal data on the basis of one or more of the following: (i) your consent; (ii) the performance of a contract or steps taken prior to entering into a contract; (iii) compliance with legal obligations; and (iv) our legitimate interests, provided such interests are not overridden by your rights and freedoms.

Cookies and analytics

Our marketing website uses a small number of cookies and similar technologies. Details about each cookie, its purpose, and how to manage your cookie preferences are set out in our Cookie Policy.

Data retention (marketing site)

(i) Contact form data: Retained for as long as necessary to respond to your request and maintain our business relationship, and thereafter archived for a further 24 months for record-keeping.

(ii) Analytics data: Retained in accordance with the default retention period of the analytics provider concerned (for Google Analytics, up to 14 months).

Notwithstanding the above, we may retain personal data where required or permitted by applicable law or where necessary to establish, exercise, or defend legal claims.

Qarmiq platform: Customer Data We Process

If your organization uses the Qarmiq platform (app.qarmiq.ai), Qarmiq acts as a processor for the personal data your organization uploads to, stores in, puts into or otherwise processes through the service. The categories of data we process on the Customer's behalf include:

(i) Scenarios and checks authored in the platform

(ii) Test run results, including pass, fail, blocked and skip verdicts submitted by testers

(iii) Defect records, including descriptions, affected URLs, severity, and any attachments

(iv) Test evidence captured by Witness and the autonomous testing agent: interaction events (what was clicked or selected, identified by the role and accessible name of the element, not by typed content), screenshots (including those a tester attaches to a defect), traces and recordings produced by autonomous checks, console and JavaScript error output, network activity logs (URL, HTTP method, status code and duration), performance events, and page URLs and titles

(v) Coverage data: scenario and check coverage, and the routes and pages discovered in the Customer's environments

(vi) AI conversation history: see "AI processing" below

(vii) Audit logs of user actions, resource access, and modifications within the platform

(viii) Account and team information: name, email address, role, and organization membership of your users

(ix) Authentication credentials the Customer chooses to store for automation purposes (for example, a test-user login for the application under test). These are encrypted at rest at the application layer using AES-256-GCM authenticated encryption

Where data is stored

Customer data is stored in the following locations:

(i) AWS in the United States (us-east-1): screenshots, traces, recordings and other large evidence artifacts produced by autonomous checks.

(ii) Managed MongoDB in the United States (New York): scenarios, checks, runs, verdicts, defects, coverage data, AI conversation history, audit logs, and user and organization metadata. The managed MongoDB service is hosted by DigitalOcean in its New York data center.

The Qarmiq application server runs on a virtual private server operated by Hostinger in the United States (Needham, Massachusetts), and the isolated browser runners that execute autonomous checks run on Fly.io in the United States (Newark, New Jersey). Backup and lifecycle artifacts may be moved between S3 storage tiers within the same AWS region. AI calls (see below) are transmitted to AI providers' infrastructure, typically located in the United States.

Sensitive information captured by Witness: important notice

By default, Witness does not record the values typed into form fields: password fields are never read, and interactions are recorded by the role and accessible name of the element, not by what was typed. Screenshots, however, show the page as the tester sees it, so any sensitive information visible on screen at that moment may appear in a screenshot. Testers can mark up a screenshot and use the Hide tool to remove regions of it before it is sent.

To support testing of applications that handle sensitive personal data (including under HIPAA, PCI-DSS, or GDPR special-category data regimes), Customers should:

(i) Use non-production test accounts and test data when running Witness sessions or autonomous checks wherever possible;

(ii) Use the Hide tool to remove sensitive regions from screenshots before filing a defect, and avoid displaying sensitive information on screen during a test session where possible; and

(iii) Avoid running Witness sessions or autonomous checks against real customer data in a production environment unless appropriate safeguards are in place.

Customers retain control over and remain responsible for the data that they put into the Service. Captured events are redacted server-side before storage, but Qarmiq does not otherwise scrub screenshots or other evidence after capture.

AI processing

The Qarmiq platform uses third-party AI providers (currently OpenAI and Anthropic) to power features including the Zoe in-app assistant, scenario and check suggestions, autonomous testing, defect briefs, and automation script generation. The Customer may also configure its own AI provider keys ("Bring-Your-Own-AI" or "BYOAI"), in which case the same metadata recording applies and the AI provider acts as the Customer's processor under the Customer's own agreement with that provider.

What we record for every AI call: the AI provider and model used, timestamp, input and output token counts (including cached tokens where applicable), the user and project context that initiated the call, the feature that invoked it, and whether a BYOAI key was used.

AI conversation storage: for AI features that maintain conversational context (including the Zoe in-app assistant), the platform stores the content of the prompt sent to the AI and the AI's response in the conversation history. This is necessary to power conversation continuity, allow Users to return to past sessions, and improve the quality of AI features. AI conversation content is treated as Customer Data, is logically scoped to the Customer's organization, is encrypted in transit, and is retained according to the retention rules below. It is not used to train any foundation model. Qarmiq does not use Customer Data or AI conversation content to train its own artificial intelligence or machine learning models.

AI Vision: the autonomous testing agent and its judge may send screenshots of the page under test to a multimodal AI provider (such as OpenAI or Anthropic) for visual analysis. The resulting analysis is stored as part of the check result.

What AI providers receive: scenario and check text, summaries of captured interaction and network events (URL, method and status), the context of the question being asked, and (for AI Vision) screenshots.

Limited PII redaction. Qarmiq applies redaction to certain content in AI features. Internal identifiers are removed from assistant answers, and pattern-based redaction is applied to certain context before it is sent to the AI provider, replacing recognized emails, phone numbers, payment card numbers, IP addresses, API keys, and similar tokens with redaction markers. This redaction is limited, is applied at the point of transmission to the AI provider only, and does not change the content the Customer originally entered, which is what is stored in the conversation history. Customers should not rely on this redaction as a substitute for masking sensitive data at the point of capture (see the notice above on sensitive information) or for sending only non-production data into AI-assisted flows.

Retention of customer data

Customer Data is retained for the lifetime of your organization's subscription. Following cancellation of a subscription, Customer Data is made available for export for thirty (30) days, after which it is permanently deleted from production systems. Backup artifacts are retained for the duration of our backup cycle, after which they are deleted in the normal course of operations. Large recording artifacts in S3 are subject to lifecycle policies that may archive older recordings to cold storage during the subscription period for cost efficiency. Customers may request export or earlier deletion at any time under the terms of the SaaS Subscription Agreement, subject to retention required by applicable law.

Other product integrations

The platform supports optional integrations the Customer may configure, including but not limited to:

(i) GitHub, for read-only code lookup through a GitHub App that the Customer installs (code is read transiently and is not stored);

(ii) Customer-configured connectors and MCP clients, for exchanging findings, verdicts and scenarios with tools the Customer chooses (for example, external verifiers and AI coding agents). Payloads may contain test data. Customers remain responsible for the security of the endpoints and clients they connect, including authentication and HTTPS.

Witness capture widget and browser extension

Witness is a script that the Customer's team embeds in its own application under test so that testers can record verdicts and file defects while they test. It is inert until the page is opened with a run token, a short-lived link generated when a tester selects "Test manually" on a Run in Qarmiq. All data capture is performed by this script, as described in Section 7 above.

The widget's behavior is as follows:

(i) Activation: only when the page address carries a valid run token. The token is removed from the address bar when the page loads. There is no passive listener for browsing activity outside a test session.

(ii) Storage: the widget keeps the run token and the scenario last selected in the browser's storage so that tabs of the same browser can follow each other. The stored token expires with the server-side token. The widget does not set advertising or tracking cookies.

(iii) Transmission: the widget sends captured events, verdicts, defects and screenshots only to Qarmiq's backend (app.qarmiq.ai), authenticated by the run token. It does not transmit data to any other party.

(iv) Session links: run tokens are scoped to a single Run and expire after 24 hours. They can be revoked at any time from the Run page (End sessions).

(v) Permissions: when the Customer embeds it as a script, the widget is not a browser extension and requests no browser permissions. It operates only inside the page in which the Customer has embedded it. The Witness browser extension, described below, requests the permissions listed there.

(vi) Third-party requests: the widget loads no third-party code or fonts. A host page may lend its own fonts and positioning to the widget through CSS variables.

(vii) The widget stores no credentials or passwords and does not read the values typed into fields. It does not perform fingerprinting or advertising analytics. It is served from Qarmiq's own content delivery address (cdn.qarmiq.ai), as a small loader that fetches the widget from beside itself only while a test is under way, and loads no other remote code.

The Witness browser extension is an alternative way to put the widget on a page, for teams that do not want to add a script to their own code. The widget it shows and the data it captures are the same as described above. The extension's behavior is as follows:

(i) Activation: a tester starts it on one tab by pasting a run link from their Qarmiq account into the extension. It does nothing on any page until then, and acts only on the tab where it was started and on the sites the tester chose. Each further site is allowed one at a time, through the browser's own permission prompt.

(ii) Permissions: the extension requests the browser permissions activeTab, scripting, storage and webNavigation, and access to app.qarmiq.ai. Access to any other site is optional and is requested from the browser when the tester chooses that site, not when the extension is installed. The extension does not read cookies or browsing history.

(iii) Storage: the run token and the session are held in the browser's session storage, which is kept in memory and cleared when the browser closes. They are not written to disk. The token is held by the extension and is not given to the page being tested.

(iv) Transmission: the extension sends captured events, verdicts, defects and screenshots only to Qarmiq's backend (app.qarmiq.ai). It does not transmit data to any other party, sell data, or use it for advertising or for any purpose unrelated to testing in Qarmiq.

(v) Code: all of the extension's code is packaged in it. It does not download or run code from elsewhere.

(vi) Stopping: Stop removes Witness from one tab. End session, in the Witness bar, ends the person's session in every browser. Run links expire after 24 hours, and an administrator can end all sessions from the Run page (End sessions).

International data transfers

Customer Data flows across borders in the ordinary course of providing the Service:

(i) United States (AWS us-east-1) for S3-stored evidence and artifacts from autonomous checks.

(ii) United States (DigitalOcean Managed MongoDB in New York, the Hostinger application server in Massachusetts, and Fly.io runners in New Jersey) for scenarios, checks, runs, verdicts, defects, AI conversation history, audit logs, and user and organization metadata, and for the execution of autonomous checks.

(iii) United States, when AI features are used (OpenAI, Anthropic).

(iv) Other regions for optional Customer-configured integrations (GitHub), for Resend (transactional email delivery) and for Cloudflare Turnstile bot-protection edge nodes.

(v) Where personal data of EU/UK Data Subjects is transferred to a country that is not the subject of an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (SCCs) and (for UK data) the UK International Data Transfer Addendum, as applicable. A current list of sub-processors and transfer mechanisms is maintained as a schedule to our Data Processing Agreement.

Qarmiq may engage additional trusted third-party service providers and sub-processors to support the operation, maintenance, security, and delivery of the Service. We will ensure that such sub-processors are subject to appropriate contractual obligations consistent with applicable data protection laws. A current list of our sub-processors is maintained as a schedule to our Data Processing Agreement.

Your rights

Depending on your jurisdiction (including under the EU/UK GDPR, the Australian Privacy Act 1988, India's Digital Personal Data Protection Act 2023, and similar laws), you may have the right to:

(i) Access the personal data we hold about you

(ii) Request correction or deletion of your data

(iii) Withdraw consent for analytics tracking

(iv) Object to or restrict certain processing

(v) Receive your data in a portable format

(vi) Lodge a complaint with a supervisory authority (in Australia, the Office of the Australian Information Commissioner)

If your personal data is processed inside a customer's Qarmiq account, you should direct your request to that customer first; we will provide reasonable assistance to them in responding to such request. To exercise your rights against Qarmiq when it acts as a controller, email us at contact@qarmiq.ai.

Security

We maintain appropriate technical and organizational measures to protect personal data, summarized below. Full details are in Schedule 2 of our Data Processing Agreement.

(i) Encryption in transit: TLS 1.2 or higher for connections to the platform. HTTP Strict Transport Security (HSTS) is enforced with a twelve-month max-age.

(ii) Encryption at rest: sensitive credentials stored on behalf of Customers, including test-environment authentication credentials and stored API keys, are encrypted at rest using AES-256-GCM authenticated encryption. Bulk Customer Data stored in AWS S3 and on managed databases (DigitalOcean Managed MongoDB) is encrypted at rest using the provider's default encryption (AWS-managed keys and DigitalOcean-managed keys respectively). Customer-managed key (CMK) encryption is not currently offered.

(iii) Access control: role-based access enforced at the application layer; project-scoped membership checks gate access to Customer Data on every request.

(iv) Audit logging: security-relevant events (authentication, authorization changes, data access, data export, configuration changes, and similar) are recorded in a dedicated audit log.

(v) Personnel access: infrastructure access is restricted to authorized Qarmiq personnel using SSH keys and AWS IAM permissions, scoped to the minimum necessary for the role.

(vi) Bot protection: Cloudflare Turnstile is enabled to protect public endpoints from automated abuse.

(vii) Multi-factor authentication: two-factor authentication is available to users and is recommended for enterprise deployments. It is not currently enforced by default.

(viii) Single-region deployment: the Service is currently deployed in the United States only, with the application server in Massachusetts, the managed database in New York and evidence storage in AWS us-east-1. Cross-region failover and a formally documented disaster-recovery runbook are planned for future implementation. Customers will be notified in advance of any change.

We will notify Customers without undue delay (and in any case within seventy-two (72) hours) if we become aware of a personal data breach affecting their data, in line with our Data Processing Agreement.

Third-party links

Our website may contain links to third-party websites (for example, documentation and LinkedIn). We are not responsible for the privacy practices, content, or availability of these third-party websites. Your use of those websites or services is governed by their respective privacy policies and terms.

Changes to this Policy

We may update this Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Where changes are material, we will notify customers in the product or by email. We encourage you to review this page periodically.

Contact

Privacy enquiries: contact@qarmiq.ai

General contact: contact@qarmiq.ai

Postal: Qarmiq, Inc., 251 Little Falls Drive, Wilmington, New Castle County, Delaware 19808, United States.

Questions about this document can be sent to contact@qarmiq.ai.