Privacy policy

1. Who we are

Robotesta is operated by Robotesta LLC, New Cairo, Cairo, Egypt (“we”, “us”).

Robotesta connects to the tools your team already uses, such as GitHub, Jira and Confluence. It reads the information you choose from them and shows how your requirements, code and tests line up, and how complete that information is.

For the content your organization connects, we act on your organization’s behalf and follow its instructions. For your own account, we decide how your data is used, as this policy describes.

2. What we collect

Your account

• Your email address, and your name if you add one.
• How you sign in. If you create a password, we keep only a salted scrypt hash of it, never the password itself. If you sign in with Google or GitHub, our sign-in provider WorkOS handles it and we keep the account identifier it returns.
• The organizations you belong to, your role in each, and the projects you can access.
• The email addresses of the people you invite.

The tools you connect

An owner or admin of your organization decides which tools to connect and which repositories, projects, spaces or teams Robotesta reads. Robotesta reads only what the tool’s permissions allow and only what was chosen. This content can include personal data, such as the names or account IDs of the people involved and the text they wrote. Not every tool below can be connected yet; the list says what each one reads when it is.

GitHub

Issues, pull requests, commits, releases and check runs in the repositories you choose. With the optional “Actions: Read” permission, also GitHub Actions workflow runs and the test reports they upload (JUnit, Playwright, Allure and Cypress results, with their screenshots and videos).

Code: for each repository you choose, Robotesta reads the Python, TypeScript and JavaScript source files at the latest commit of the default branch, skipping dependency and build folders, up to 300 files of up to 256 KB each. The file contents are kept only as a raw copy (see How long we keep it). What Robotesta keeps is each file’s path, size and fingerprint (a hash), and the names and positions of the functions, classes and other declarations found in it, not the code itself.

Reading the code around a story: only when a person on your team clicks Read the code on a story and confirms the credits, Robotesta reads up to 12 source files around that story (the files changed for it and for the stories it relates to, and their tests) at the latest commit of the default branch, up to 120,000 characters in all. It never reads files whose names suggest secrets, and it replaces secrets in the text with placeholders before sending it to the AI provider. Robotesta keeps what it found in the code, each with the file, lines and a short quote as proof (up to 300 characters, masked), the path and fingerprint of each file read, and the path of each file it skipped with the reason, not the files themselves. Where a fact sets a value in the code against the value one of the story’s acceptance criteria states (for example a limit), Robotesta also keeps both values, each found word for word in the code and in the story. File names and lines are shown only to people who can see that repository in GitHub, checked again at least every 10 minutes.

The Robotesta GitHub App asks for read access to code, checks and repository metadata, and for read and write access to issues and pull requests (see What Robotesta writes into your tools).

Jira

Issues in the projects you choose: summary, status, type, priority, resolution, labels, dates, sprint, parent and versions, which fields changed and when, and the Atlassian account IDs and display names of the assignee and reporter. Robotesta also reads the PDF and Word files attached to issues, up to 5 MB each: it keeps each file in its own storage as it was received, and replaces secrets in the text it takes from a file with placeholders before using or sending that text. Robotesta reads the comments on those issues: it keeps their text with email addresses, phone numbers, card numbers and secrets replaced by placeholders. A person @mentioned in a comment is kept as an Atlassian account ID or as “@person”, not by name, and the author by account ID only; a name written as plain text in a comment is kept as written. To stop comments being read for a project, write to sam@robotesta.ai. Robotesta asks Atlassian for read access to Jira work and users, and for offline access so it can keep reading without asking you to sign in again.

Confluence

Pages in the spaces you choose, with their labels and the details of their attachments (name, type and size). When a page is linked to a story Robotesta checks, Robotesta also reads the PDF and Word files attached to the page, up to 5 MB each, as it does for Jira. Comments are read only if they are switched on; they are off by default. Robotesta asks Atlassian for read access to pages, spaces, attachments, content details and comments, and for offline access.

Sentry

Issues, error events, releases and environments of the Sentry projects you choose. Before an error event is stored, Robotesta removes the user details Sentry attached to it, such as an email or IP address, and keeps only a one-way hash of them. Robotesta asks Sentry for read access only.

Slack

Robotesta uses Slack only to send notifications. It reads the names of channels so you can pick one (private channels only if you ask for them), and posts to the one channel you choose. It does not read messages or files. Notifications contain fixed text and counts, never the content of your tools.

Notion

The pages and databases you share with Robotesta: their text, headings, the pages nested under them, and database rows with their properties. Comments only where you ask for them. People are recorded by their Notion user ID; Robotesta does not ask Notion for email addresses. Access is read-only.

Linear

Issues in the teams you choose: title, description, state, labels, assignees and when they changed. Comments only where you ask for them. Robotesta asks Linear for read access only, or uses a personal API key you paste.

Asana

Tasks in the projects you choose, with their subtasks, fields and whether they are done; comments and activity on those tasks, unless you turn that off; and attachment details (names and types, never the files). Robotesta also lists your workspaces and projects so you can choose, and keeps a webhook on each chosen project so Asana tells it about changes.

AIO Tests

Test cases and their folders for the Jira projects you already collect, read with an API token you paste: title, steps, precondition, BDD script, status and the Jira requirements each case names.

Credentials

The access tokens and keys that let Robotesta read your tools. See Security for how they are protected.

Technical data

• Request logs: the route, result and duration of each request to Robotesta, not its content.
• An audit trail of actions in your organization and of every request Robotesta makes to a connected tool (see Security).
• One session cookie keeps you signed in, and your choice of light or dark theme is kept in your browser. The app uses no advertising cookies and no analytics.

3. What we do not do

• We do not sell your data, and we do not share it for advertising.
• We do not use your data to train AI models. See How Robotesta uses AI.
• We do not read beyond the permissions you approve in each tool and the repositories, projects, spaces or teams you choose.
• We do not change your tools on our own. See What Robotesta writes into your tools.

4. How Robotesta uses AI

Robotesta uses an AI model to draft tests and reviews. The model is Claude, made by Anthropic.

Anthropic is the only AI provider Robotesta uses. No other company receives what Robotesta sends to a model. We will update this policy before we add another.

What is sent

• The text of your stories, and of related stories.
• Passages of Confluence pages linked to a story.
• Text from PDF and Word files attached to a story or to a Confluence page linked to it, after masking.
• The comments on a Jira issue, after masking, never who wrote them (for Robotesta's memory of past work).
• Pull request titles and descriptions, the changed files and the code files related to them, your repository's own instruction files, the acceptance criteria of the work items the pull request names, earlier review findings and the notes your team wrote when dismissing them, and what your repository's own checks report on them (CI messages, code-scanning and vulnerable-dependency alerts, never a secret's value), after masking; and a question a person on your team asks Robotesta about a review finding.
• Source files around a story from a repository you chose, after masking, only when a person on your team clicks Read the code.
• The summary and description of a bug report Robotesta is asked to locate or reproduce.
• Test steps: the steps of a test case, and the steps Robotesta took while exploring your app.
• The structure of the pages Robotesta explores: headings, form labels and button names.

What is never sent

• Credentials: tokens, keys, passwords and cookies, ours or yours.
• What anyone typed into a form of your app. Robotesta never records field values.
• Secrets, test-account passwords, emails, bank numbers, card numbers and phone numbers. Robotesta replaces them with placeholders before anything is sent.
• Screenshots and images.

What happens to it

• Nothing you send is used to train models.
• Robotesta keeps a hash of each prompt, not its text. It does store the model’s answers: they become the drafts and findings you see, and they are cached for your organization.

5. What Robotesta writes into your tools

Robotesta writes to GitHub or Jira (a review comment, a bug) only when a person on your team clicks to do it.

A GitHub review comment is posted only when a person clicks Post. Later reviews of the same pull request edit that same comment. A bug that Robotesta filed can also get a “seen again” comment. Robotesta posts no other comments on its own: automatic comments are off, and we will update this policy before they are switched on.

Production apps are only browsed, never changed.

The Robotesta GitHub App holds write access to issues and pull requests because GitHub requires it for an app to comment on them.

Other changes Robotesta makes today:

• Slack: Robotesta posts notifications to the channel an owner or admin chose. Each kind of notification can be switched on or off.
• Asana: Robotesta creates a webhook on each project you choose, so Asana can tell it about changes, and deletes it when you disconnect.
• Disconnecting: Robotesta asks Slack, Asana, Linear and Notion to revoke the access you approved there, and asks Sentry to uninstall the Robotesta app from your Sentry organization.

6. Where your data is stored

Robotesta’s servers and database are hosted by DigitalOcean in Frankfurt, Germany (region FRA1). Your data is stored there. Your data may also be processed in a country other than the one you live in, by the sub-processors listed below.

7. How long we keep it

• Raw copies. When Robotesta reads from a tool, or a tool sends it a notification of a change, Robotesta keeps the data exactly as received (a raw copy), so that every record can show what it came from. A raw copy can hold more than Robotesta shows, for example every field of a Jira issue.
• Collected records: until they are deleted. The records Robotesta builds from what it read, such as an issue’s status and history, a file’s path and fingerprint, or a test result, are kept so you can see how things changed over time. Disconnecting a tool stops collection and keeps these records; they are kept until your organization asks us to delete them. When an item is deleted in the tool, Robotesta marks it as removed and stops showing it as current; its earlier history is kept.
• Credentials: until the tool is disconnected or the access is replaced. Robotesta then destroys its stored copy.
• Account data: until your account is deleted. Write to us to delete it (see Your rights).
• Audit trail: kept with your organization’s data.

Copies you exported yourself, and the data held by the tools themselves, are outside our control.

8. Who can see it

Only people in your organization can see its data, and what each person sees depends on their role:

• Owner: everything an admin can do. Only an owner can rename the organization and make someone an admin.
• Admin: connects and manages tools; manages people, invitations and projects; sees every project and the audit log.
• Member: sees the projects they were given access to, and the tool data shared with those projects.
• Viewer: the same as a member, read-only.

A tool’s data is shared with a project when an owner or admin chooses that project for it, and they can stop sharing at any time. Everyone in an organization can see who else belongs to it: name, email address and role.

Each organization’s data is kept separate. Every request is checked against the organization and role of the person making it, and one organization cannot read another’s data.

The people who run Robotesta can reach its servers and database to operate the service. We look at customer data only to run, secure or support the service, or when you ask us to.

9. Security

• Credentials are encrypted with AES-256-GCM before they are stored, under a key kept outside the database. They are never written to logs, and Robotesta destroys its copy when the tool is disconnected.
• Passwords are stored only as salted scrypt hashes.
• Robotesta is served over HTTPS (TLS), and it calls your tools’ APIs over HTTPS.
• Robotesta keeps an audit trail of who did what and when, for example who disconnected a tool or changed people or roles, and of every request Robotesta makes to a connected tool. Your organization’s audit entries are linked in a hash chain, so a change to an earlier entry can be detected. Owners and admins can read the audit log in Robotesta.
• Robotesta asks each tool for read access only, except the GitHub permissions described in What Robotesta writes into your tools and the Slack and Asana permissions its notifications and webhooks need.

To report a security problem, write to sam@robotesta.ai.

10. Sub-processors

We use these companies to run Robotesta:

• DigitalOcean hosts Robotesta’s servers and database in Frankfurt, Germany (FRA1).
• WorkOS handles sign-in with Google or GitHub, and receives the details of the account you sign in with.
• Resend sends Robotesta’s emails, such as email verification, password reset and invitations, and receives each recipient’s email address and the email’s content.
• Anthropic is the AI provider. It receives the text and page structure described in How Robotesta uses AI, and never screenshots or images.
• Cloudflare provides DNS for Robotesta’s domains and the proxy for event.robotesta.app.

When you connect a tool, Robotesta exchanges data with that tool’s provider (for example GitHub, Atlassian or Slack) on your behalf. Those providers handle your data under your own agreements with them.

We give 30 days’ notice before we add or replace a sub-processor.

11. Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, and to object to or restrict how we use it.

• Correct: you can change your name on your Account page at any time.
• Access and export: write to us for a copy of your account data. An organization owner can also ask for a copy of the data Robotesta collected for the organization.
• Delete: write to us to delete your account. An organization owner can also ask us to delete the data Robotesta collected for the organization.
• Stop collection: owners and admins can disconnect a tool at any time. Disconnecting a tool stops reading it for the whole organization.

Write to sam@robotesta.ai from the email address on your account. We may need to confirm it is you before we act. If your data is in content your organization connected (for example an issue you wrote in Jira), your organization’s owner is usually the right first contact, and we will help them answer.

You can also complain to your data protection authority.

12. Changes to this policy

When we change this policy, we will publish the new version on this page and update its effective date. If a change affects how we use your data in a significant way, we will tell your organization’s owners by email before it takes effect.

13. Contact

Robotesta LLC, New Cairo, Cairo, Egypt

Email: sam@robotesta.ai

This policy is governed by the law of Egypt.

For help using Robotesta, see Support.

14. Early access applications