Privacy Policy

1. Introduction & Scope

Dokimore (“Company,” “we,” “us,” or “our”) is committed to protecting the privacy and security of your personal data. This Privacy Policy describes how we collect, use, disclose, retain, and safeguard information when you access or use our quality assurance automation platform, associated APIs, documentation, and related services (collectively, the “Service”).

This Policy applies to all individuals who interact with our Service, including but not limited to account administrators, authorized users within enterprise organizations, visitors to our website, and individuals who communicate with us via email, support channels, or other means. It covers data processed in connection with:

• Our cloud-hosted SaaS platform and on-premise deployments
• Browser extensions, CLI tools, and desktop agents related to the Service
• Our marketing website, blog, and documentation portals
• Customer support interactions, webinars, and events
• Integration endpoints with third-party CI/CD systems and development tools

By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you are using the Service on behalf of an organization, you represent that you are authorized to accept these terms on behalf of that organization. If you do not agree with the practices described herein, you must discontinue use of the Service immediately.

This Privacy Policy should be read in conjunction with our Terms of Service, Data Processing Agreement (DPA), and Cookie Policy. In the event of a conflict between this Privacy Policy and a separately executed DPA, the terms of the DPA shall prevail with respect to the processing of Customer Data as defined therein.

2. Information We Collect

2.1 Personal Data You Provide

When you register for an account, subscribe to the Service, or communicate with us, we may collect the following categories of personal data:

• Account Information: Full name, email address, job title, department, company name, phone number, and billing address.
• Authentication Credentials: Hashed passwords, multi-factor authentication tokens, OAuth access tokens from identity providers (e.g., Google, GitHub, Azure AD, Okta).
• Payment Information: When you buy a Solo Pro or Team plan through the in-app checkout we collect billing details — the invoiced name, business name where applicable, billing address, billing email and phone, and any tax identification number (for example a GSTIN or VAT number) required for the invoice — and we record your acceptance of these terms with a timestamp. Billing details are encrypted at rest. We do not collect, process or store card numbers: payment today is by bank transfer against an invoice, and no payment-card data is entered on our pages.
• Communications: Contents of support tickets, emails, chat messages, feedback forms, survey responses, and any attachments you provide.
• Profile Preferences: Language settings, timezone, notification preferences, dashboard configurations, and accessibility settings.

2.2 Usage Data

We automatically collect information about how you interact with the Service, including:

• Test Execution Metadata: Test suite names, execution timestamps, pass/fail status, duration, scan configurations, and error logs. Note: We do not inspect the content of your tested applications; metadata is collected solely for Service functionality and analytics.
• Feature Usage Patterns: Pages visited within the platform, features accessed, API endpoints called, frequency and timing of interactions, and workflow sequences.
• Performance Metrics: Response times, error rates, resource utilization, and system health telemetry generated during your use of the Service.
• Integration Activity: Metadata related to third-party integrations you configure (e.g., CI/CD pipeline identifiers, webhook delivery statuses, repository names).

2.3 Device & Technical Data

When you access the Service, we automatically collect technical information from your device and network:

• Device Identifiers: IP address (anonymized in analytics pipelines), browser type and version, operating system, screen resolution, and device type.
• Network Information: Internet service provider, approximate geolocation derived from IP address (city/region level only), and connection type.
• Log Data: Server access logs, application error logs, API request logs (with request bodies redacted or excluded), and audit trail entries.

2.4 Cookies & Tracking Technologies

We use cookies, local storage, session storage, and similar technologies to maintain session state, remember your preferences, understand usage patterns, and enhance security. Categories include:

• Strictly Necessary Cookies: Required for authentication, session management, CSRF protection, and load balancing. These cannot be disabled.
• Functional Cookies: Store your preferences such as language, theme, timezone, and dashboard layout.
• Analytics Cookies: Help us understand aggregate usage patterns, feature adoption, and performance bottlenecks. We use privacy-focused analytics that do not create individual user profiles for advertising purposes.
• Security Cookies: Assist in fraud detection, anomalous access pattern identification, and rate limiting enforcement.

For detailed information on the specific cookies we use, their purposes, and how to manage them, please refer to our Cookie Policy.

2.5 Customer Data

In the course of providing the Service, you may submit data to or through the platform (“Customer Data”). Customer Data may include test configurations, application URLs, API schemas, environment variables, and test results. We process Customer Data solely on your behalf as a data processor (under GDPR) or service provider (under CCPA). Our access to Customer Data is limited to what is necessary to provide, maintain, and improve the Service, unless you provide explicit written consent for additional processing.

3. How We Use Your Information

3.1 Service Delivery & Operations

• Provisioning, configuring, and maintaining your account and workspace
• Executing test suites, security scans, and generating reports
• Processing payments and managing subscriptions
• Providing technical support and resolving service issues
• Enforcing rate limits, usage quotas, and fair use policies
• Delivering real-time notifications, alerts, and scheduled reports

3.2 Analytics & Improvement

• Analyzing aggregate usage patterns to improve platform performance, reliability, and user experience
• Identifying and resolving bugs, errors, and performance bottlenecks
• Conducting A/B testing and feature experimentation (using anonymized or pseudonymized data only)
• Developing new features and services based on aggregate demand signals and feedback
• Generating benchmarking reports and industry trend analyses using anonymized, aggregated data that cannot be linked to individual customers

3.3 Communications

• Transactional: Account verification, password resets, payment receipts, service disruption notices, and security alerts. These communications are essential to the Service and cannot be opted out of.
• Product Updates: Feature announcements, release notes, and platform maintenance schedules. You may opt out of non-critical product updates via your notification settings.
• Marketing: Educational content, webinar invitations, case studies, and promotional offers. Marketing communications are sent only with your prior consent and include an unsubscribe mechanism in every message.

3.4 Security & Compliance

• Detecting, preventing, and responding to fraud, abuse, and unauthorized access
• Monitoring for security threats, vulnerabilities, and anomalous activity within the platform infrastructure
• Maintaining audit trails and access logs for compliance purposes
• Complying with applicable laws, regulations, legal processes, and enforceable governmental requests
• Enforcing our Terms of Service, Acceptable Use Policy, and other contractual obligations

4. Legal Basis for Processing

Under the General Data Protection Regulation (GDPR), we are required to identify a lawful basis for each processing activity. We rely on the following legal bases as set out in Article 6(1) of the GDPR:

For processing activities involving special categories of personal data (which we do not intentionally collect), we will obtain your explicit consent in accordance with Article 9(2)(a) of the GDPR before any such processing takes place.

5. Data Sharing & Third Parties

We do not sell, rent, or trade your personal data to any third party for their marketing or commercial purposes. We do not participate in data brokerages. We share your information only in the following limited circumstances:

5.1 Sub-Processors

We use a small number of service providers (“sub-processors”) that process personal data on our behalf. This is the complete list:

Product analytics runs on our own servers and is not shared with an analytics vendor. When you pay by bank transfer, your bank and ours process the payment under their own terms as independent controllers; we never receive card details. We will update this list before a new sub-processor starts receiving personal data, and customers with a signed data processing agreement receive at least 30 days' notice and may object.

5.2 Legal & Regulatory Disclosures

We may disclose personal data if required to do so by law, or in the good faith belief that such disclosure is reasonably necessary to: (i) comply with a legal obligation, regulatory requirement, or valid legal process; (ii) enforce our Terms of Service or other agreements; (iii) protect and defend the rights, property, or safety of Dokimore, our users, or the public; or (iv) detect, prevent, or address fraud, security, or technical issues. Where permitted by law, we will notify affected users before making such disclosures.

5.3 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your personal data may be transferred as part of such transaction. We will provide notice via email and/or a prominent notice on our website before your personal data becomes subject to a different privacy policy. You will have the opportunity to opt out of such transfer if the new entity’s privacy practices materially differ from those described herein.

5.4 Aggregated & De-Identified Data

We may share aggregated, anonymized, or de-identified data that cannot reasonably be used to identify you. Such data may be used for industry benchmarking, academic research, and product marketing purposes. This data is not considered personal data under applicable data protection laws.

6. International Data Transfers

The service is operated from and hosted in India, in a data centre located in Mumbai. If you are located outside India — including in the European Economic Area, the United Kingdom, Switzerland or the United States — your personal data will be transferred to, stored in, and processed in India, and potentially in other jurisdictions where our sub-processors operate. These jurisdictions may have data protection laws that differ from those in your country of residence.

6.1 Transfers Into India

Because we operate from India, personal data you provide is processed there under the Digital Personal Data Protection Act, 2023 (DPDPA). India has not received an adequacy decision from the European Commission. We have not yet executed Standard Contractual Clauses or completed a transfer impact assessment, and we are not certified under the EU-U.S. Data Privacy Framework — an India-operated entity is not eligible for that framework. If you are an EEA, UK or Swiss customer and require a documented transfer mechanism before entrusting personal data to us, please contact us before doing so; we would rather tell you this up front than have you rely on a safeguard that is not in place.

6.3 Supplementary Measures

Alongside the legal position described above, these technical and organisational measures protect personal data wherever it is processed:

• Encryption in transit with TLS between your browser and our servers.
• Field-level encryption (AES-256-GCM) for the most sensitive values we store, such as billing details, saved test credentials and plan entitlements; database backups are stored encrypted.
• Access to production systems is limited to named operators, and every privacy request (access, deletion, consent change) is written to a tamper-evident audit log.
• Passwords typed during a test recording are hidden in recording views, exports and the test code we generate.

7. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, comply with our legal obligations, resolve disputes, and enforce our agreements. The specific retention periods depend on the nature of the data and the context in which it was provided:

Upon account termination, we will delete or anonymize your personal data within 30 days, except where retention is required by applicable law or is necessary to fulfill a legitimate business purpose as described above. Customer Data will be made available for export for a period of 30 days following termination, after which it will be permanently and irreversibly deleted from our production systems. Our encrypted backups follow a fixed rotation (seven daily, four weekly and six monthly copies), so deleted data can remain inside a backup for up to about six months until that copy expires. Backups exist only to recover from a failure; they are not used to bring deleted data back into service.

8. Your Rights

Depending on your jurisdiction, you may have certain rights with respect to your personal data. We are committed to facilitating the exercise of these rights in a timely manner.

8.0 Rights Under India's Digital Personal Data Protection Act, 2023

We process personal data in India, so these rights apply to everyone whose data we hold, wherever they live:

• Access: a summary of the personal data we process about you, the processing activities, and the other data fiduciaries and processors we have shared it with.
• Correction and erasure: to have inaccurate or incomplete data corrected, completed or updated, and to have data erased when it is no longer needed for the purpose you gave it for, unless the law requires us to keep it.
• Withdraw consent: as easily as you gave it, at any time. Withdrawal does not affect processing that already happened.
• Grievance redressal: to complain to our Grievance Officer and receive a response. If you are not satisfied, you may complain to the Data Protection Board of India.
• Nominate: to name another person who can exercise these rights for you if you die or become unable to act.

Use the self-service controls in your account (Profile → Privacy & data), or reach us through support@dokimore.com (subject “Privacy request”) or the privacy request form. Grievances go through support@dokimore.com (subject “Grievance”) or the grievance form.

8.1 Rights Under the GDPR (EEA, UK, Switzerland)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights under the GDPR:

• Right of Access (Art. 15): You have the right to obtain confirmation as to whether your personal data is being processed, and, if so, to request access to that data along with information about the purposes of processing, categories of data, recipients, and retention periods.
• Right to Rectification (Art. 16): You have the right to obtain the correction of inaccurate personal data and to have incomplete data completed.
• Right to Erasure (Art. 17): You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent, where you object to processing and there are no overriding legitimate grounds, or where the data has been unlawfully processed.
• Right to Data Portability (Art. 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format (e.g., JSON or CSV), and to transmit that data to another controller without hindrance.
• Right to Restriction of Processing (Art. 18): You have the right to request restriction of processing where you contest the accuracy of your data, the processing is unlawful, we no longer need the data but you require it for legal claims, or you have objected to processing pending verification of legitimate grounds.
• Right to Object (Art. 21): You have the right to object to processing based on legitimate interests or for direct marketing purposes. Upon objection, we will cease processing unless we demonstrate compelling legitimate grounds that override your rights.
• Right Not to Be Subject to Automated Decision-Making (Art. 22): You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you. Our Service does not currently engage in such automated decision-making.

To exercise any of these rights, use the self-service controls in your account (Profile → Privacy & data: download your data, request deletion, withdraw consent) or contact us through support@dokimore.com (subject “Privacy request”) or the privacy request form. We will respond within one month. If we need more time for a complex request (up to two further months), we will tell you why within the first month.

You also have the right to lodge a complaint with your local supervisory authority. A list of EU/EEA supervisory authorities is available at https://edpb.europa.eu.

8.2 Rights Under the CCPA (California Residents)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and its amendment, the California Privacy Rights Act (CPRA):

• Right to Know: You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which information was collected, the business or commercial purpose for collecting the information, and the categories of third parties with whom we share personal information.
• Right to Delete: You have the right to request the deletion of personal information we have collected from you, subject to certain exceptions permitted by law (e.g., completing a transaction, detecting security incidents, complying with legal obligations).
• Right to Correct: You have the right to request that we correct inaccurate personal information that we maintain about you.
• Right to Opt-Out of Sale or Sharing: We do not sell your personal information, and we do not share it for cross-context behavioural advertising. You can still record an opt-out at any time from Your privacy choices, and we honour the Global Privacy Control (GPC) signal: if your browser sends it, we treat it as an opt-out and keep optional analytics off without asking.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights. We will not deny you the Service, charge you different prices, provide a different level of quality, or suggest that you will receive different treatment for exercising your rights.
• Right to Limit Use of Sensitive Personal Information: We do not use or disclose sensitive personal information for purposes beyond those permitted under the CPRA.

To submit a verifiable consumer request, contact us through support@dokimore.com (subject “Privacy request”) or the privacy request form. We will verify your identity before fulfilling your request by matching the information you provide with information we have on file. We will respond within 45 days, with the possibility of a 45-day extension for complex or voluminous requests upon notice to you.

You may designate an authorized agent to submit requests on your behalf. To do so, you must provide the agent with written permission and verify your own identity directly with us.

8.3 Additional State Privacy Rights

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and other states with comprehensive privacy legislation may have similar rights. We honor data subject requests from all U.S. residents consistent with the most protective applicable standard.

9. Children’s Privacy

The Service is a business tool and is not directed at children. You must be at least 18 years old to create an account or use the Service. Under India's Digital Personal Data Protection Act, 2023, a child is anyone under 18, and processing a child's personal data needs verifiable consent from a parent or guardian, which we do not collect. We therefore do not knowingly process personal data of anyone under 18.

If we learn that we hold personal data of someone under 18, we will delete it without undue delay. If you believe a child has given us personal data, please tell us through support@dokimore.com (subject “Privacy request”) or the privacy request form so that we can act on it.

10. Security Measures

We implement and maintain a comprehensive, multi-layered security program designed to protect your personal data against unauthorized access, alteration, disclosure, or destruction. Our security measures include, but are not limited to:

10.1 Encryption

• Data in Transit: All communications between your browser/client and our servers are encrypted using TLS 1.3 with forward secrecy. We enforce HSTS (HTTP Strict Transport Security) with a minimum max-age of one year, including subdomains.
• Data at Rest: All data stored in our databases, file systems, and backup media is encrypted using AES-256 encryption. Encryption keys are managed through a dedicated key management service with automatic key rotation.
• Database-Level Encryption: We employ Transparent Data Encryption (TDE) on all production database instances and field-level encryption for sensitive attributes.

10.2 Access Control

• Role-based access control (RBAC) with the principle of least privilege applied across all systems
• Multi-factor authentication (MFA) mandatory for all employees and contractors with access to production systems
• Just-in-time (JIT) privileged access provisioning with automatic revocation for administrative operations
• Comprehensive audit logging of all access to personal data, with tamper-evident log integrity verification

10.3 Certification Status & Vulnerability Disclosure

We are not currently certified under SOC 2, ISO 27001, ISO 27701 or PCI DSS, and we do not claim to be. We design our controls with reference to these frameworks, and we will publish an audit report here only once an independent auditor has issued one. We would rather tell you what we actually run than what sounds reassuring.

We do not currently operate a paid bug-bounty programme. We do welcome coordinated vulnerability disclosure: please report suspected security issues to the contact in our SECURITY.md, and we will acknowledge your report and keep you informed of remediation.

10.4 Incident Response

We maintain an incident response plan covering identification, containment, eradication, recovery and post-incident review. If a personal data breach affects you, we will tell you without undue delay, with what happened, what data was involved, what we are doing and what you can do. We will also notify the authorities whose deadlines apply: CERT-In within six hours of noticing a reportable cyber security incident, the Data Protection Board of India under the DPDPA, the relevant EU or UK supervisory authority within 72 hours under Article 33 of the GDPR, and California residents as required by Civil Code section 1798.82.

11. Cookie Policy

We use cookies and similar tracking technologies (including local storage and session storage) to operate and improve the Service. For a comprehensive description of the cookies we use, including their names, purposes, providers, types, and expiration periods, please refer to our dedicated Cookie Policy.

You can control and manage cookies through your browser settings. Most browsers allow you to refuse or accept cookies, delete existing cookies, and set preferences for certain websites. Please note that disabling strictly necessary cookies may impair the functionality of the Service.

For users in the European Economic Area and the United Kingdom, we display a cookie consent banner on your first visit, allowing you to accept or reject optional cookies before they are placed. Your preferences are stored and can be updated at any time through the cookie settings link in the footer of our website.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or business operations. When we make changes:

• Material Changes: We will notify you via email (to the address associated with your account) and through a prominent notice on our platform at least 30 days before the changes take effect. Material changes include new categories of data collected, new processing purposes, changes to data sharing practices, or changes to your rights.
• Non-Material Changes: Minor clarifications, formatting updates, or changes that do not materially affect your rights will be reflected in an updated “Last Updated” date at the top of this Policy.
• Version History: We maintain an archive of prior versions of this Privacy Policy, which is available upon request.

Your continued use of the Service after the effective date of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the revised Policy, you must discontinue use of the Service and may request deletion of your account and personal data.

13. Contact Information & Grievance Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact us using the following information:

We acknowledge privacy requests within five business days. We complete them within the time the law that applies to you allows: one month under the GDPR and UK GDPR (extendable by two months for complex requests, with notice), 45 days under the CCPA/CPRA, and without undue delay under the DPDPA.