Privacy policy

1. Who we are

Robotesta is operated by Robotesta LLC, New Cairo, Cairo, Egypt (“we”, “us”).

Robotesta connects to the tools your team already uses, such as GitHub, Jira and Confluence. It reads the information you choose from them and shows how your requirements, code and tests line up, and how complete that information is.

For the content your organization connects, we act on your organization’s behalf and follow its instructions. For your own account, we decide how your data is used, as this policy describes.

2. What we collect

Your account

• Your email address, and your name if you add one.
• How you sign in. If you create a password, we keep only a salted scrypt hash of it, never the password itself. If you sign in with Google or GitHub, our sign-in provider WorkOS handles it and we keep the account identifier it returns.
• The organizations you belong to, your role in each, and the projects you can access.
• The email addresses of the people you invite.

The tools you connect

An owner or admin of your organization decides which tools to connect and which repositories, projects, spaces or teams Robotesta reads. Robotesta reads only what the tool’s permissions allow and only what was chosen. This content can include personal data, such as the names or account IDs of the people involved and the text they wrote. Not every tool below can be connected yet; the list says what each one reads when it is.

GitHub

Issues, pull requests, commits, releases and check runs in the repositories you choose. With the optional “Actions: Read” permission, also GitHub Actions workflow runs and the test reports they upload (JUnit, Playwright, Allure and Cypress results, with their screenshots and videos).

Code: for each repository you choose, Robotesta reads the Python, TypeScript and JavaScript source files at the latest commit of the default branch, skipping dependency and build folders, up to 300 files of up to 256 KB each. The file contents are kept only as a raw copy (see How long we keep it). What Robotesta keeps after that is each file’s path, size and fingerprint (a hash), and the names and positions of the functions, classes and other declarations found in it, not the code itself.

The Robotesta GitHub App asks for read access to code, checks and repository metadata, and for read and write access to issues and pull requests (see What Robotesta writes into your tools).

Jira

Issues in the projects you choose: summary, status, type, priority, resolution, labels, dates, sprint, parent and versions, which fields changed and when, and the Atlassian account IDs of the assignee and reporter. Comments are read only if they are switched on for a project; they are off by default. Robotesta asks Atlassian for read access to Jira work and users, and for offline access so it can keep reading without asking you to sign in again.

Confluence

Pages in the spaces you choose, with their labels and the details of their attachments (name, type and size, never the files). Comments are read only if they are switched on; they are off by default. Robotesta asks Atlassian for read access to pages, spaces, attachments, content details and comments, and for offline access.

Sentry

Issues, error events, releases and environments of the Sentry projects you choose. Before an error event is stored, Robotesta removes the user details Sentry attached to it, such as an email or IP address, and keeps only a one-way hash of them. Robotesta asks Sentry for read access only.

Slack

Robotesta uses Slack only to send notifications. It reads the names of channels so you can pick one (private channels only if you ask for them), and posts to the one channel you choose. It does not read messages or files. Notifications contain fixed text and counts, never the content of your tools.

Notion

The pages and databases you share with Robotesta: their text, headings, the pages nested under them, and database rows with their properties. Comments only where you ask for them. People are recorded by their Notion user ID; Robotesta does not ask Notion for email addresses. Access is read-only.

Linear

Issues in the teams you choose: title, description, state, labels, assignees and when they changed. Comments only where you ask for them. Robotesta asks Linear for read access only, or uses a personal API key you paste.

Asana

Tasks in the projects you choose, with their subtasks, fields and whether they are done; comments and activity on those tasks, unless you turn that off; and attachment details (names and types, never the files). Robotesta also lists your workspaces and projects so you can choose, and keeps a webhook on each chosen project so Asana tells it about changes.

AIO Tests

Test cases and their folders for the Jira projects you already collect, read with an API token you paste: title, steps, precondition, BDD script, status and the Jira requirements each case names.

Credentials

The access tokens and keys that let Robotesta read your tools. See Security for how they are protected.

Technical data

• Request logs: the route, result and duration of each request to Robotesta, not its content.
• An audit trail of actions in your organization and of every request Robotesta makes to a connected tool (see Security).
• One session cookie keeps you signed in, and your choice of light or dark theme is kept in your browser. The app uses no advertising cookies and no analytics.

3. What we do not do

• We do not sell your data, and we do not share it for advertising.
• We do not use your data to train AI models. See How Robotesta uses AI.
• We do not read beyond the permissions you approve in each tool and the repositories, projects, spaces or teams you choose.
• We do not change your tools on our own. See What Robotesta writes into your tools.

4. How Robotesta uses AI

Robotesta uses an AI model to draft tests and reviews. The model is Claude, made by Anthropic.

What is sent

• The text of your stories, and of related stories.
• Passages of Confluence pages linked to a story.
• Pull request titles, descriptions and the changed lines.
• The structure of the pages Robotesta explores: headings, form labels and button names.

What is never sent

• Credentials.
• Secrets, test-account passwords, emails, bank numbers, card numbers and phone numbers. Robotesta replaces them with placeholders before anything is sent.
• Screenshots and images.

What happens to it

• Nothing you send is used to train models.
• Robotesta keeps a hash of each prompt, not its text. It does store the model’s answers: they become the drafts and findings you see, and they are cached for your organization.
• Screenshots, videos and raw copies are kept 30 days, then erased, with a receipt.

5. What Robotesta writes into your tools

Robotesta writes to GitHub or Jira (a review comment, a bug) only when a person on your team clicks to do it.

A GitHub review comment is posted only when a person clicks Post. Later reviews of the same pull request edit that same comment. A bug that Robotesta filed can also get a “seen again” comment. Robotesta posts no other comments on its own: automatic comments are off, and we will update this policy before they are switched on.

Production apps are only browsed, never changed.

The Robotesta GitHub App holds write access to issues and pull requests because GitHub requires it for an app to comment on them.

Other changes Robotesta makes today:

• Slack: Robotesta posts notifications to the channel an owner or admin chose. Each kind of notification can be switched on or off.
• Asana: Robotesta creates a webhook on each project you choose, so Asana can tell it about changes, and deletes it when you disconnect.
• Disconnecting: Robotesta asks Slack, Asana, Linear and Notion to revoke the access you approved there, and asks Sentry to uninstall the Robotesta app from your Sentry organization.

6. Where your data is stored

Robotesta’s servers and database are hosted by DigitalOcean. Your data is stored there, and it may be processed in a country other than the one you live in.

7. How long we keep it

• Raw copies: 30 days. When Robotesta reads from a tool, or a tool sends it a notification of a change, Robotesta keeps the data exactly as received (a raw copy), so that every record can show what it came from. A raw copy can hold more than Robotesta shows, for example every field of a Jira issue. Raw copies are erased 30 days after they arrive, and at once when the tool is disconnected.
• Collected records: until they are deleted. The records Robotesta builds from what it read, such as an issue’s status and history, a file’s path and fingerprint, or a test result, are kept so you can see how things changed over time. Disconnecting a tool stops collection and keeps these records; they are kept until your organization asks us to delete them. When an item is deleted in the tool, Robotesta marks it as removed and stops showing it as current; its earlier history is kept.
• Credentials: until the tool is disconnected or the access is replaced. Robotesta then destroys its stored copy.
• Account data: until your account is deleted. Write to us to delete it (see Your rights).
• Audit trail: kept with your organization’s data.

Copies you exported yourself, and the data held by the tools themselves, are outside our control.

8. Who can see it

Only people in your organization can see its data, and what each person sees depends on their role:

• Owner: everything an admin can do. Only an owner can rename the organization and make someone an admin.
• Admin: connects and manages tools; manages people, invitations and projects; sees every project and the audit log.
• Member: sees the projects they were given access to, and the tool data shared with those projects.
• Viewer: the same as a member, read-only.

A tool’s data is shared with a project when an owner or admin chooses that project for it, and they can stop sharing at any time. Everyone in an organization can see who else belongs to it: name, email address and role.

Each organization’s data is kept separate. Every request is checked against the organization and role of the person making it, and one organization cannot read another’s data.

The people who run Robotesta can reach its servers and database to operate the service. We look at customer data only to run, secure or support the service, or when you ask us to.

9. Security

• Credentials are encrypted with AES-256-GCM before they are stored, under a key kept outside the database. They are never written to logs, and Robotesta destroys its copy when the tool is disconnected.
• Passwords are stored only as salted scrypt hashes.
• Robotesta is served over HTTPS (TLS), and it calls your tools’ APIs over HTTPS.
• Robotesta keeps an audit trail of who did what and when, for example who disconnected a tool or changed people or roles, and of every request Robotesta makes to a connected tool. Your organization’s audit entries are linked in a hash chain, so a change to an earlier entry can be detected. Owners and admins can read the audit log in Robotesta.
• Robotesta asks each tool for read access only, except the GitHub permissions described in What Robotesta writes into your tools and the Slack and Asana permissions its notifications and webhooks need.

To report a security problem, write to sam@robotesta.ai.

10. Sub-processors

We use these companies to run Robotesta:

• DigitalOcean hosts Robotesta’s servers and database.
• WorkOS handles sign-in with Google or GitHub, and receives the details of the account you sign in with.
• Resend sends Robotesta’s emails, such as email verification, password reset and invitations, and receives each recipient’s email address and the email’s content.
• Anthropic is the AI provider. It receives the text and page structure described in How Robotesta uses AI, and never screenshots or images.
• Cloudflare provides DNS for Robotesta’s domains and the proxy for event.robotesta.app.

When you connect a tool, Robotesta exchanges data with that tool’s provider (for example GitHub, Atlassian or Slack) on your behalf. Those providers handle your data under your own agreements with them.

We give 30 days’ notice before we add or replace a sub-processor.

11. Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, and to object to or restrict how we use it.

• Correct: you can change your name on your Account page at any time.
• Access and export: write to us for a copy of your account data. An organization owner can also ask for a copy of the data Robotesta collected for the organization.
• Delete: write to us to delete your account. An organization owner can also ask us to delete the data Robotesta collected for the organization.
• Stop collection: owners and admins can disconnect a tool at any time. Disconnecting a tool stops reading it for the whole organization.

Write to sam@robotesta.ai from the email address on your account. We may need to confirm it is you before we act. If your data is in content your organization connected (for example an issue you wrote in Jira), your organization’s owner is usually the right first contact, and we will help them answer.

You can also complain to your data protection authority.

12. Changes to this policy

When we change this policy, we will publish the new version on this page and update its effective date. If a change affects how we use your data in a significant way, we will tell your organization’s owners by email before it takes effect.

13. Contact

Robotesta LLC, New Cairo, Cairo, Egypt

Email: sam@robotesta.ai

This policy is governed by the law of Egypt.

For help using Robotesta, see Support.

14. Early access applications