Try it freeTry it

Translation provided for convenience; the French version prevails.

Privacy policy

Last updated: October 19, 2026

1. Data controller

The controller of personal data is NORNDIS (SASU), publisher of the Qaviar service, 60 rue François Ier, 75008 Paris, France, registered under SIREN number 102 057 957.

Data protection officer (DPO): dpo@qaviar.io

2. Data collected

Qaviar collects the following categories of data:

2.1 Account data

Email address, organization name, password (hashed), subscription plan, sign-up date. This data is needed to create and manage the account (legal basis: performance of the contract).

2.2 Test data

Test instructions, screenshots of the tested pages, network and console logs, generated PDF reports, and the recorded steps of each test. This data is produced through use of the service and stored on the user’s behalf.

2.3 Encrypted variables

Project, test and campaign variables (credentials, tokens, test passwords) are encrypted with AES-256-GCM before storage. They are decrypted only by the test engine, in memory, at the time of the test: they are never shown in the interface, never sent to the AI and never written in plain text in test traces. Environment variables, on the other hand, are not encrypted and remain readable by the members of the organization: they must not contain any secret.

2.4 Test email addresses

Each test has a disposable address on the test.qaviar.io domain that can be used to sign up on the tested application. When email capture is turned on, a disposable mailbox is created on the mail.qaviar.io domain. Received emails may contain personal data (tokens, names); the copy kept by Qaviar expires automatically 24 hours after the test was created.

2.5 Connection data

IP address, browser type, pages visited, and connection dates and times, recorded in technical logs for security purposes and to keep the service running properly. At sign-up, only a keyed hash (HMAC) of the IP address is kept with the organization, to detect abuse (several trial accounts testing the same site, for example); the IP address itself is not stored in the database.

3. Purposes of processing

Data is processed for the following purposes:

  • Providing and improving the automated QA service
  • Managing user accounts and subscriptions
  • Billing and payment management (through Stripe)
  • Service-related communications (notifications, alerts)
  • Security and fraud prevention
  • Compliance with legal obligations

4. Legal bases

  • Performance of the contract: account creation, provision of the service, billing
  • Legitimate interest: security, improvement of the service, fraud prevention
  • Legal obligation: retention of billing data
  • Consent: newsletter (where applicable)

5. Processors and transfers

Data is processed by the following processors:

  • Supabase (Singapore/USA): database, authentication, file storage
  • Stripe (USA): payment processing
  • Anthropic (USA): artificial intelligence API (analysis of the tested pages)
  • OVH (France): hosting of the web application and of the test execution server
  • Resend (USA): sends transactional emails (address verification, password reset)
  • Sentry (USA): technical error tracking, without request bodies, headers, cookies or URL parameters

When the user connects them, the following services receive the data they need to work: Google (sign-in with a Google account), Figma (reading designs), Slack (sending notifications), GitHub and GitLab (test status on pull requests).

Transfers of data outside the EU are governed by the European Commission’s standard contractual clauses and/or by the processors’ compliance with the EU-US Data Privacy Framework.

6. Retention period

  • Account data and test data (screenshots, reports, steps): for as long as the account exists; deleted or exported on request to dpo@qaviar.io, within 30 days
  • Sign-ups whose address was not verified: deleted automatically after 48 hours
  • Address verification and password reset links: valid for 24 hours and 30 minutes respectively, single use
  • Emails received by disposable mailboxes: 24 hours after the test was created
  • Billing data: 10 years (French legal obligation)
  • Connection logs: 12 months at most

7. Users’ rights

Under the GDPR, you have the following rights:

  • Right of access: obtain confirmation that your data is processed and receive a copy
  • Right to rectification: correct inaccurate or incomplete data
  • Right to erasure: request the deletion of your data
  • Right to data portability: receive your data in a structured, readable format
  • Right to object: object to the processing of your data
  • Right to restriction: request that processing be restricted

To exercise these rights: dpo@qaviar.io. We will reply within 30 days.

You can also lodge a complaint with the CNIL (the French data protection authority): www.cnil.fr

8. Security

Qaviar applies the following security measures:

  • AES-256-GCM encryption of sensitive variables
  • TLS/HTTPS encryption of all communications
  • Row Level Security (RLS) on every database table
  • Isolation of data by organization
  • Authentication with bcrypt password hashing
  • Verification and reset links stored only in hashed form
  • Figma tokens encrypted before storage
  • Validation of project URLs, and requests to the tested sites routed through an egress proxy (SSRF protection)
  • Rate limiting (sign-up, password reset, AI calls)

9. Artificial intelligence

Qaviar uses the Claude API (Anthropic) to analyze the tested web pages. Screenshots and test instructions are sent to the API to generate test actions and observations. The values of variables (credentials, passwords) are never sent to the API: the AI only sees their names.

Under Anthropic’s commercial terms, data sent through its API is kept for a limited period and is not used to train its models. See Anthropic’s privacy policy for more details.

Running a recorded test does not use AI: it replays the recorded steps in a browser, without calling Claude. On paid plans, when a run shows a difference, its analysis sends the AI the screenshots and the text of the steps that differ, without any variable value.

10. Changes

Qaviar reserves the right to change this policy. Users will be informed by email of any substantial change. The date of the last update shown at the top of this page applies.

11. Contact

For any question about the protection of your data: dpo@qaviar.io