Qaptly

Privacy Policy

Last Updated: October 16, 2025

This Privacy Policy (the "Policy") is established by DBAM AI LLC ("Company," "we," "us," or "our") and applies to the DBAM AI Qaptly Platform and its related APIs, websites, software, cloud, and SaaS services (collectively, the "Service").

This Policy explains how we collect, use, store, and protect your personal data, and your rights under applicable laws (including GDPR).

By using the Service, you agree that you have read, understood, and agree to this Policy.

1. Data Controller Information

DBAM AI LLC Email: [email protected]

If we appoint a Data Protection Officer (DPO), their contact information will be announced on our website or in updates to this Policy.

2. Categories of Personal Data Collected

We may collect the following types of data:

1. Account & Identity Data

  • Email address
  • Username or display name
  • Account creation and login records
  • Organization/Team identification (e.g., Tenant ID, Workspace Name)

2. Usage Data

  • Test plans, test records, and execution history
  • AI content generated using the Service (e.g., test cases, descriptions)
  • Cloud computing logs, API call records, error logs
  • Raw data used for generating test cases or analysis (e.g., requirements text, screenshots, UI structure info)

3. Technical Data

  • IP address
  • Device type and OS information
  • Browser type and version
  • Usage time, time zone, language settings
  • Cookies and other online identifiers

4. Billing Data

  • Order numbers, invoice or receipt information
  • Payment amount, plan type, payment status

We do not directly store complete credit card numbers. Such information is typically stored and processed by third-party payment processors.

5. AI Processing Data

  • Content you actively upload or input, such as:
    • Requirement documents, specifications, screenshots
    • Test flows, scripts, UI component info
    • Other data used for AI model inference, analysis, and generation

We DO NOT use user data to train our or third-party AI models unless we have obtained your explicit written consent or are required by law.

3. Purposes & Legal Basis (GDPR)

We process personal data for the following purposes and legal bases:

1. Providing and Maintaining the Service

  • To create accounts, verify identity, provide system functions, and maintain availability.
  • Legal Basis: GDPR Art. 6(1)(b) Performance of a contract.

2. AI Model Inference & Analysis

  • To use uploaded data for AI inference, generating test cases, analyzing test results, etc.
  • Legal Basis: GDPR Art. 6(1)(b) Performance of a contract.

3. Billing & Notifications

  • For billing, verifying payments, sending invoices/receipts, and plan change notifications.
  • Legal Basis: GDPR Art. 6(1)(b) Performance of a contract; Art. 6(1)(c) Legal obligation.

4. Security & Abuse Prevention

  • To detect abnormal logins, API abuse, attacks, and other security incidents.
  • Legal Basis: GDPR Art. 6(1)(f) Legitimate interests.

5. Service Improvement & Statistics (De-identified)

  • To analyze usage to improve product functions and user experience.
  • Legal Basis: GDPR Art. 6(1)(f) Legitimate interests.

6. Legal Obligations or Claims

  • To comply with regulatory requirements, court orders, or to exercise/defend legal rights.
  • Legal Basis: GDPR Art. 6(1)(c) Legal obligation; Art. 6(1)(f) Legitimate interests.

7. Marketing (If applicable)

  • If we provide newsletters or marketing emails, we will obtain your explicit consent beforehand.
  • Legal Basis: GDPR Art. 6(1)(a) Consent.

4. Data Retention Period

We retain personal data for the period necessary to fulfill the purposes outlined in this Policy and as required by law:

  • Account Data: Retained while the account is active; removed or anonymized within a reasonable period after account deletion.
  • Usage Data & Logs: Generally retained for 6–24 months for tracking issues and security.
  • Billing Data: Retained for at least 5–7 years as required by tax or commercial laws.
  • Backup Data: Overwritten or deleted on a rolling cycle (e.g., 30–90 days).

5. Your Rights (GDPR)

If you are a data subject in the EU/EEA, you have the following rights:

  1. Right of Access: Confirm if we process your data and get a copy.
  2. Right to Rectification: Correct inaccurate or incomplete data.
  3. Right to Erasure: Request deletion of data in specific circumstances.
  4. Right to Restrict Processing: Request suspension of processing.
  5. Right to Data Portability: Get your data in a structured format.
  6. Right to Object: Object to processing based on legitimate interests or marketing.
  7. Right not to be subject to Automated Decision-Making: We do not use purely automated decision-making with legal effects.

To exercise these rights, contact: [email protected]

6. International Data Transfers

We may process or store data in:

  • Taiwan
  • Japan, Singapore, Hong Kong, or other APAC cloud nodes
  • United States

If transferring data from the EU/EEA to a country without an adequacy decision, we will implement appropriate safeguards (e.g., SCCs).

7. Third-Party Processors

We may use third-party providers for:

  • Payment processing
  • Cloud infrastructure (AWS, GCP, Azure, etc.)
  • AI models and inference (e.g., OpenAI)
  • Analytics and monitoring

8. Security Measures

We use TLS/HTTPS encryption, access controls, and other security measures to protect your data.

9. Children’s Privacy

The Service is not intended for children under 13. We do not knowingly collect data from children under 13.

10. Cookies

We use cookies for:

  • Security and authentication (Essential)
  • Preferences (Language, settings)
  • Analytics

11. Automated Processing

We use AI to generate test cases and analyze data, but we do not make automated decisions with legal effects based solely on this processing.

12. California Privacy Rights (CCPA/CPRA)

This section applies to California residents as required under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). For the purposes of this section, "personal information" has the meaning defined under California law.

12.1 Categories of Personal Information Collected

In the past 12 months, we may have collected the following categories of personal information:

  • Identifiers (e.g., email address, IP address, device identifiers)
  • Commercial information (e.g., subscription plans, transaction records)
  • Internet or network activity (e.g., logs, usage analytics)
  • Professional or employment-related information (if provided by enterprise users)
  • Inferences drawn from usage to improve services
  • Any information uploaded to the Service as part of AI processing or test data generation

We do not collect "sensitive personal information" except as required for account security or billing.

12.2 Purposes for Collecting Personal Information

We collect personal information to operate, maintain, and provide the Service; process payments; detect fraud and security issues; comply with legal obligations; and improve our products.

12.3 Sources of Personal Information

We may collect personal information directly from you, automatically from your use of the Service, and from service providers such as payment processors or analytics vendors.

12.4 Disclosure of Personal Information

We may disclose personal information to service providers and contractors for operational purposes, including cloud hosting, payment processing, analytics, and AI inference. We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

12.5 Your Rights Under CCPA/CPRA

California residents have the following rights:

  • Right to Know: Request disclosure of the categories or specific pieces of personal information collected, used, or disclosed in the past 12 months.
  • Right to Delete: Request deletion of personal information we have collected, subject to statutory exceptions.
  • Right to Correct: Request correction of inaccurate personal information.
  • Right to Opt-Out of Sale or Sharing: We do not sell or share personal information; therefore, no opt-out mechanism is required.
  • Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information for purposes requiring limitation under CPRA.
  • Right to Non-Discrimination: You will not be discriminated against for exercising your rights.

12.6 Exercising Your Rights

You may submit a request by contacting us at:

[email protected]

We will verify your identity before processing your request. Authorized agents may submit requests on your behalf with proof of authorization.

12.7 Retention

We retain personal information as described in Section 4 of this Policy or as required by law.

13. Changes to This Policy

We may update this Policy from time to time. Updated versions will be posted with the "Last Updated" date.

14. Contact Us

If you have questions about this Policy or GDPR rights, please contact: