Privacy Policy

Mahmoud Nasr Elsayed, of 1st Mohamed Hassan Street, Haram, Giza, Egypt, is the controller of the personal data described in this policy. Data-protection contact: support@vera-agent.com. Representative or data protection officer: none appointed.

For the content you put into the Service about other people — for example, a test account on a site you are testing, or a name that appears in a screenshot — you are the controller and we act as your processor, on your instructions.

Account data

Name, email address, password hash (or your identity provider’s subject identifier), workspace name and membership, role and permissions, and invitation records.

Workspace content

Projects, tests, flows, chains, schedules, variables and environment configuration — including any login credentials or API tokens you choose to store so that tests can sign in. Credentials and AI provider keys are encrypted at rest and are never returned by our API once saved.

Run artifacts

Videos, screenshots, traces, console output, network summaries and step results produced when a test runs. These are recordings of the pages you point the Service at, so they may contain whatever those pages display — including personal data belonging to you or to third parties.

Usage and technical data

Server logs (IP address, user agent, request path, timestamp, response status), run counts and durations, AI invocation counts, feature usage, and error reports. Used for operating, securing, debugging and metering the Service.

Billing data

Plan, subscription status, and the payment processor’s customer and transaction identifiers. We do not receive or store your card number — the processor handles that (section 5).

Support and correspondence

Messages you send us, and the context you attach to them.

We do not knowingly collect special-category data, and the Service is not designed to process it. Please do not point a test at a system whose recordings would capture health, biometric or similarly sensitive data unless you have a lawful basis and have configured masking and retention accordingly.

• To provide the Service — authenticate you, run your tests, store and display results. Basis: performance of our contract with you.
• To bill and prevent abuse — meter usage, enforce plan limits, rate-limit, detect fraud. Basis: contract and our legitimate interest in running the Service sustainably.
• To secure and improve the Service — logs, diagnostics, aggregate usage analysis. Basis: legitimate interests, balanced against your rights.
• To communicate — service notices, security announcements, and support replies. Basis: contract. Marketing email, if any, is consent-based and always has a one-click unsubscribe.
• To comply with law — tax and accounting records, responding to lawful requests. Basis: legal obligation.

We do not sell personal data, and we do not use your workspace content to train AI models.

When you use an AI feature, we send the context needed for that request — the extracted structure of the page under test, your instruction, and the test being generated or healed — to the AI provider selected for your workspace (Anthropic, OpenAI or Google).

Beyond a small included allowance for new workspaces, those calls are made with your provider key: the provider is a controller in its own right for that request, under its own terms, and you choose which one to use. Requests made under the included allowance use our key with the same providers. We record the fact and size of each call for metering; we do not retain the prompt content beyond what is needed to show you the resulting test and its history in your workspace.

We share personal data only with service providers that help us run the Service, and only as needed. The categories, and the providers used in each, are:

Hosting and infrastructure

Railway — application hosting, managed PostgreSQL, and S3-compatible object storage for run artifacts.

Payments

Paddle.com Market Limited, as Merchant of Record — checkout, invoicing, sales tax and fraud screening. Paddle receives your billing details directly and processes them under its own buyer terms and privacy notice.

Authentication

An identity provider (Clerk) where a workspace uses hosted sign-in. Self-hosted and built-in email/password sign-in keeps authentication entirely on our own infrastructure.

AI providers

Anthropic, OpenAI or Google, as selected for your workspace — see section 4.

Email

An email provider for transactional and test-inbox mail, where those features are enabled.

Optional integrations you enable

Source hosts and CI providers (GitHub, GitLab, Bitbucket) and chat tools (Slack) receive run results and links when you connect them. Connecting one is your instruction to share with it; disconnecting stops it.

We also disclose data where the law requires it, to enforce our Terms, or to a successor in a merger or sale of the business — in which case we will tell you before your data becomes subject to a different policy.

Primary storage and processing take place in the United States (US West). Some of the providers above operate internationally, so personal data may be transferred outside your country. Where that happens from the UK or EEA we rely on an adequacy decision or on Standard Contractual Clauses with the provider.

• Account and workspace data — for as long as the account exists, then deleted or anonymised within 90 days of closure.
• Run artifacts — kept until you delete them, or until the retention period your workspace administrators configure. Retention is off by default, so nothing expires unless you turn it on; you can delete a run or a project at any time.
• Closing a workspace — you can close a workspace yourself, at any time, from Settings → Workspace. Closing takes effect immediately: API tokens and connected agents are revoked, scheduled runs stop, and no new runs can start. Deletion is not immediate. There is a grace period — the exact date is shown to you when you close, and again while the workspace is closing — during which you can cancel and restore the workspace. After that date everything in it is permanently deleted and cannot be recovered.
• Server logs — a rolling operational window, then discarded.
• Invoices and tax records — for the period the law requires, regardless of account closure.

• Traffic is served over HTTPS.
• Stored credentials, AI provider keys and integration secrets are encrypted at rest with keys held outside the database.
• Workspaces are isolated: every data access is scoped to the requesting workspace, and access within a workspace is governed by per-member permissions.
• Passwords are stored only as salted hashes; sessions can be revoked.
• Access to production by our own staff is limited to what operating the Service requires.

No system is perfectly secure. If a breach affects your personal data and the law requires notification, we will notify you and the relevant authority without undue delay. To report a vulnerability, write to support@vera-agent.com.

Depending on where you live, you may have the right to access your personal data, correct it, delete it, object to or restrict processing, withdraw consent, receive a portable copy, and complain to your data-protection authority. Californian residents additionally have rights of access, deletion, correction, and to opt out of “sale” or “sharing” — we do neither.

Much of this you can do yourself in the application: edit or delete projects, tests and runs, remove members, rotate or remove stored keys, export a portable copy of your workspace, and close a workspace. The export is a file of your projects, tests, flows and recent results; it deliberately leaves out stored credentials, API keys and captured browser sessions, which we never hand back out once they are stored. For anything else, write to support@vera-agent.com. We respond within one month and will not discriminate against you for exercising a right.

We use the minimum needed to make the application work, and no advertising or cross-site-tracking cookies.

vera_session (cookie)

Strictly necessary. Keeps you signed in. HttpOnly, SameSite-restricted, and Secure over HTTPS. Cleared when you sign out.

vera-theme, vera-lang, vera-sidebar, vera.orgId (local storage)

Preference storage in your own browser — chosen theme, interface language, sidebar state, and last-used workspace. Never sent to us as a cookie; clearing site data removes them.

Because none of these are used for advertising or analytics profiling, no consent banner is shown. Our payment processor loads its script on this site and may set its own cookies, under its own notice — at checkout, and on our public pages so it can recognise a returning subscriber whose payment failed and offer them a one-click card update. It is not used for advertising or cross-site profiling.

The Service is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has given us personal data, contact support@vera-agent.com and we will delete it.

We will post any update on this page and change the effective date. If a change materially affects how we use personal data, we will notify account administrators before it takes effect.