Privacy

Last updated 10 September 2026. This covers both qaright.com, the marketing site, and the QAright product at app.qaright.com. An earlier version of this page only covered the site and said the product wasn't live yet — that stopped being true when the product launched, so this revision replaces it. It has not yet been reviewed by a lawyer; treat it as an accurate engineering account of what the system does, not a substitute for legal advice.

What this website collects

Nothing. qaright.com itself — the marketing pages you're reading now — has no sign-up form, no analytics, no tracking pixel and no advertising network. It sets no cookies and stores nothing in your browser. Everything below this section is about the product, not the marketing site.

What the product collects

Creating a QAright account collects your email address, the name you give it, and a password (stored as a salted hash, never in plain text). Signing up also creates a personal workspace (an "organization" in the product) that your account belongs to.

Using the product to build and run tests stores the test content you create or record: test suites and steps, element locators, run results, and screenshots captured during a run. This is the product's core function — there is no way to use QAright without it holding your test data.

The browser extension

Recording a test needs a browser that somebody clicks through. One way to get one is the QAright Recorder extension for Chrome, which records in your own browser. This section is about that extension. There are two other ways to record — a small program you run on your own computer, and a browser we run for you — and both collect the same things for the same reason.

It does nothing until you press Record. The extension has no settings, no account of its own and no activity of its own. It starts when the QAright tab you are signed in to asks it to, and it stops when you press Stop or close the tab it opened.

While a recording is running, and only in the tab it opened for that recording and any tab opened from it, it collects:

• What you interacted with. For each element you click, type into or choose from: its tag, its attributes, its visible text and where it sits among its neighbours. This becomes the element locator, which is how the test finds the same control again on the next run.
• What you typed. The value you put into a field becomes the value the test enters when it runs.
• The addresses of the pages you visited in that tab, which become the navigation steps of the test.

It reads no other tab, and it collects nothing at all outside a running recording.

Where it goes. Straight to the QAright server you are signed in to, over HTTPS, authenticated as you, and nowhere else. The extension makes no other network request. It has no analytics, no crash reporting and no third-party endpoint of any kind.

Passwords. If you record a sign-in, what you typed into the password field is stored with the test, because the test has to type it again in order to run. It is flagged as a secret at the moment it is captured, and every screen that shows the test afterwards masks it: the test case page, the run report, exports and CSV downloads. It is never included in anything sent to an AI provider. Masking hides it from view; it does not encrypt it separately from the rest of your test data. If you would rather the real password were not stored at all, replace the recorded value afterwards with a token pointing at an environment variable or a data profile entry marked secret.

None of this is sold, used for advertising, used to assess creditworthiness, or passed to anyone outside the sub-processors listed below.

Where that data lives

All of it — account data and test data alike — is stored in MongoDB Atlas, a hosted database service operated by MongoDB, Inc. We do not run our own database server; Atlas is the only place this data is persisted. It is bound by MongoDB's own Cloud Terms of Service, a commercial agreement between us and MongoDB, not a licence covering your data.

Screenshots captured during a test run are kept for 90 days and then removed automatically, unless you've explicitly saved one as a visual baseline.

AI features and Azure OpenAI

Most of what QAright does — running your recorded tests, retrying a broken element locator, healing a test after your UI changes — happens entirely on our own infrastructure and never leaves it.

A smaller set of features is explicitly AI-powered: generating a test from a plain-language description, the AI crawler that explores your app to propose tests, natural-language step summaries, and root-cause analysis of a failure. When you use one of these features, the specific page content involved — DOM structure, visible text, element locators, and sometimes a screenshot — is sent to Microsoft Azure OpenAI Service to generate that one response. It is processed under Microsoft's Online Services Terms and is not used to train Microsoft's models. We do not send your data to Azure OpenAI unless one of these specific features is invoked.

Who else sees it (sub-processors)

• MongoDB Atlas — stores all account and test data.
• Microsoft Azure OpenAI Service — processes page content only when you use an AI feature (above).
• Render — hosts the API that the product runs on.
• Cloudflare — hosts and serves both this site and the product's web app.

None of these are permitted by us to use your data for anything other than providing the service back to us. We have not sold, and do not sell, any customer data to anyone.

Hosting and logs

Like any web service, our hosts (Render and Cloudflare) keep short-lived request logs — IP addresses and similar metadata — for security and abuse prevention. Our own application logs may include the same. We do not sell or share this.

Deleting your data

You can delete individual test suites, cases and runs yourself from within the product. To delete your account and everything tied to it, write to hello@qaright.com and we will remove it and confirm when it's done. We don't yet have a self-service export or deletion tool covering everything automatically — if you need that sooner than we've built it, tell us.

If you email us

Every button on this site opens your own mail client. If you write to hello@qaright.com we keep your message and your address for one reason: to reply to you, and to talk to you about the product if that is what you asked about.

• We do not add you to a marketing list.
• We do not sell it, share it or pass it to anyone else.
• Ask us to delete it and we will, and we will confirm when it is done.

Asking us anything

If you want to know what we hold about you, or want it removed, write to hello@qaright.com.

QAright is a young product. This page will keep changing as we add things like self-service data export — pretending it's more finished than it is would be the wrong way to write it.