Introduction
This Privacy Policy describes how ValiqAI ("ValiqAI", "we", "us", "our") handles personal information when you visit valiqai.com, join the waitlist, create an account, or use the scanning platform.
ValiqAI is an automated QA and security testing service. If you run a scan, we operate a real browser against a URL you authorize. That is different from a typical SaaS dashboard, so this policy explains scan data in detail.
This policy describes our practices. It does not take away rights you have under applicable law. Where the law requires a separate choice (for example, certain cookies), we will ask for that choice. If you do not want your information handled as described here, do not use the service.
In this policy
Who we are
ValiqAI is operated by Abhi Jandyala. For privacy questions and requests, email abhi@valiqai.com.
Related documents: Terms of Service, Cookie Policy, Data Processing Agreement, Subprocessors, and Security & Trust.
Two kinds of data
We handle personal information in two different roles:
Your account and our website. For waitlist signups, accounts, billing, support, and visitors to our site, ValiqAI is the controller. We decide how that information is used to operate the product.
Data inside apps you ask us to scan. A scan may capture personal data that already exists on a target you authorize (for example a name on a dashboard screenshot, or an email in a verification message). For that data, you are the controller and ValiqAI is the processor. We handle it to provide the scan you requested, as described in our Data Processing Agreement. You must have the right to scan that system.
Information we collect
We collect information you provide, information generated by the product, and information we receive from services you connect.
Account information
When you create an account, we collect:
Email address (required to create and recover the account)
Name or display name
Password, stored as a one-way hash. We cannot see the password itself.
Profile photo, if you upload one or if an OAuth provider supplies one
Optional profile fields such as username, job title, company, bio, and timezone
The date you agreed to our Terms, Acceptable Use Policy, and this Privacy Policy, and which version you agreed to, so we can show what applied to your account
OAuth and single sign-on
If you sign in with Google or GitHub, we receive your email, name, profile picture URL if available, and a provider account identifier. We do not receive that provider's password. We may store OAuth tokens issued to ValiqAI so we can keep the account linked.
If an organization enables SSO (SAML or OIDC), we process identity assertions from that organization's identity provider, typically name and email, in order to sign members in. SSO connection secrets are encrypted at rest. Your identity provider has its own privacy policy.
Waitlist and contact
If you join the waitlist, we collect your email address and company name. If you use the contact form, we collect your name, email, and message so we can reply.
Organization and team
If you create or join an organization, we collect the organization name, billing email, member roles, and email addresses of people you invite. Inviting someone shares that they have been invited to ValiqAI.
Preferences and API keys
We store settings you choose: theme, notification preferences, default scan options, and similar product preferences. If you create API keys, we store a hashed copy of the key, a name, and usage metadata. We cannot recover the full key after it is shown to you.
Payment information
Payments are processed by Stripe. Stripe collects and stores payment card details. We do not store your full card number. We store a Stripe customer ID, subscription IDs and status, and limited display details such as the last four digits of a card when Stripe provides them.
Integrations you enable
If you connect Slack, Jira, GitHub, or similar tools, we store the tokens or webhook URLs needed to deliver what you configured, and we send scan-related data to those services as you set them up. Tokens are stored encrypted. Each integration is optional and controlled by you.
Technical, security, and diagnostic data
When you use the site or the app, our servers and the application collect:
IP address, used for security, abuse prevention, and approximate location
Browser type, device type, operating system, and user-agent
Pages and APIs requested, timestamps, and referrer
A device identifier generated in the browser (via FingerprintJS or a fallback from basic device attributes) and stored with the account and some scan records to prevent abuse, such as repeated free-scan claims from the same device. This is not used for advertising.
We do not currently use a third-party marketing analytics product such as Google Analytics. The technical data above is collected to operate, secure, and debug the service.
Error monitoring
We don't use a third-party error-monitoring or session-replay service. When something fails, the error is recorded in our own server logs so we can fix it. See also our Cookie Policy.
How scans work, and what they capture
A scan is the core of the product. You submit a URL you are authorized to test. We then run a browser session against that target. Depending on the scan options, we may collect and store:
The URL, domain, and scan settings you choose
Screenshots, page text, DOM snapshots, and accessibility or security findings
Console logs and network requests from the scanned session, which can include URLs, headers, and response bodies visible to the browser
HAR traces, session replays of the target site, and short video clips of failures
Cookies and storage from the target, used to continue an authenticated session during that scan
Login credentials you provide for a scan, stored encrypted and used only to authenticate that scan
Automated signup and disposable email. If a scan is set to create a test account, we generate a synthetic identity (for example a name, email address, and password) to fill signup forms. These are test identities, not real people. When temporary-email mode is on, we create a disposable inbox through MailSlurp so the scanner can receive verification emails such as one-time codes or magic links. Inbox content is processed to complete the scan and may be kept as scan evidence.
Incidental data on the target. If a scanned page already shows personal data of your users or other people, that data may appear in screenshots, logs, or replays. We do not seek that data for our own purposes. You are responsible for only scanning systems you are allowed to test, and for not directing scans at systems where special-category data (health, precise geolocation, and similar) would be captured. The Service is not designed to process special-category data.
Public verification. If you enable a public verification badge or share a verification link, limited scan metadata such as the target URL, scan date, and a high-level risk summary may be visible without signing in. Detailed evidence stays behind your account.
Improving later runs in your workspace. We may keep technical scan metadata so a later run in the same workspace can reuse what already worked (for example, how a flow behaved). We do not sell this data, and we do not use the contents of your scanned applications to train our own models.
How we use your information
Provide the service: create accounts, run scans, generate reports, deliver evidence, and operate organizations and integrations.
Account and billing: authenticate you, manage subscriptions and credits, and send receipts or access notices.
Communication: send transactional messages (scan results, security alerts, billing) and, if you have not turned them off, product updates. Waitlist and contact submissions are used to follow up on that request.
Security and abuse prevention: detect fraud, repeated free-tier abuse, unauthorized access, and attacks on the service.
Reliability: diagnose errors, keep the platform available, and fix bugs.
Legal: meet legal obligations and respond to lawful requests.
Legal bases (EEA, UK, and Switzerland)
If European data-protection law applies, we process personal information on these bases:
Contract: to create your account and provide the scanning service you asked for.
Legitimate interests: to secure the service, prevent abuse, debug failures, and understand how the product is used at a technical level. You may object to processing based on legitimate interests.
Consent: where we ask for it, including certain optional cookies or similar technologies. You can withdraw consent without affecting processing that already happened.
Legal obligation: for example retaining billing records.
We do not use personal information for automated decisions that produce legal or similarly significant effects about you. Device identifiers and IP addresses may be used to limit abuse of free scans; that is an anti-abuse control, not credit scoring or similar profiling.
AI processing
ValiqAI uses third-party AI providers (currently Anthropic and OpenAI) to analyze scanned pages and produce results. Those providers receive data from the site you test: its URL, page content, and screenshots, including pages behind a login when a scan signs in. They do not receive your private ValiqAI account data: passwords, payment details, API keys, billing records, or similar. They do not use data sent through their APIs to train their models.
Under their API terms, those providers process this data to return a response to us and do not use API data to train their models. We do not use customer scan content to train our own models. The full provider list is on our Subprocessors page.
Transactional email is part of the service: sign-in codes, password reset, billing, security notices, and scan notifications you have turned on.
Product updates can be turned off in account notification settings. Weekly digests are off by default and can be enabled there. Waitlist mail is sent because you asked to be notified about access.
How long we keep information
We keep information for as long as needed to provide the service, unless a longer period is required by law. Typical periods:
Account, waitlist, and contact data: until you delete the account or we complete the request, then removed from active systems as described below
Scan history and artifacts (Free): 7 days
Scan history and artifacts (paid plans): 90 days to longer retention depending on plan, including screenshots, replays, HAR traces, videos, and disposable-inbox evidence associated with the scan
Test credentials: while they remain configured for your scans, then deleted with the account or when you remove them
Billing records: 7 years, where needed for tax and accounting
Security logs and device identifiers: as needed to prevent abuse, then deleted or aggregated
Server logs: kept for a limited time by our hosting provider, used only to run and fix the service
To delete individual scans, email us and we'll remove them. When you delete your account, we delete personal information from active systems within 30 days. Encrypted backups may take longer to age out on the normal backup cycle. Some records may be kept longer if we must, for example to resolve a dispute or meet a legal requirement.
Security
We protect personal information with measures appropriate to the risk, including:
TLS (HTTPS) in transit
Encryption at rest on our hosting and object-storage providers
Passwords hashed with bcrypt
Encryption of stored secrets such as scan credentials, integration tokens, and SSO secrets
Organization-level access so scans belong to the workspace that owns them
We are working toward SOC 2 Type II. A fuller description is on our Security & Trust page. No system is perfectly secure. If you find a vulnerability, email abhi@valiqai.com.
International transfers
ValiqAI is operated from the United States, and most subprocessors are in the United States (MailSlurp is in the EU). If you are in the EEA, UK, or Switzerland, your information may be transferred to and processed in the United States. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses provided by, or entered into with, the relevant subprocessor. More detail is on the Subprocessors page and in the DPA.
Your rights
Depending on where you live, you may have some or all of the following rights. You can exercise many of them in account settings. For waitlist-only contacts, or for anything you cannot do in the product, email abhi@valiqai.com. We will verify the request using the email we have on file, or other information reasonably needed to confirm it is you, and respond within the time the law requires.
Access and portability. You can ask for a copy of the personal data we hold about you. You can also request an export from account settings; we will provide the data in a common electronic format, or by email if you contact us directly.
Correction. You can update most account information in settings. Ask us if something else needs correcting.
Deletion. You can delete your account in settings. Some information may be retained where the law requires it.
Restriction and objection. You can ask us to limit certain processing, or object to processing based on legitimate interests.
Withdraw consent. Where we rely on consent, you can withdraw it at any time.
Complaint. You can lodge a complaint with your local data protection authority (in the UK, the ICO).
If you live in a U.S. state with a consumer privacy law (for example Virginia, Colorado, or Connecticut), you may have similar rights to know, delete, correct, and opt out of sale or targeted advertising. We do not sell personal information or share it for targeted advertising. Email us to make a request.
For California residents (CCPA/CPRA)
In the past 12 months we have collected the categories described in this policy, including identifiers (name, email), commercial and account information, internet and usage activity, professional information you choose to provide, and inferences drawn from scans you run. Sources are you, your organization, your identity or payment provider, and the systems you authorize us to scan. We use these categories for the business purposes described above.
Scan login credentials you provide can be sensitive personal information under CPRA. We use them only to run the scans you request, not to infer characteristics about you. We do not sell personal information or share it for cross-context behavioral advertising, so there is currently nothing to opt out of under those rights.
Right to know the categories and specific pieces we have collected, the sources, the business purpose, and the categories of third parties.
Right to delete and correct, subject to legal exceptions.
Right to limit use of sensitive personal information to the purposes allowed by law. For ValiqAI that use is providing the scan you asked for.
Right to non-discrimination for exercising these rights.
Email abhi@valiqai.com. You may use an authorized agent. We will take reasonable steps to verify the agent and the request. Because we do not sell or share for cross-context advertising, a Global Privacy Control signal does not change a sale we do not perform. You can still decline non-essential cookies as described in the Cookie Policy.
Children's privacy
ValiqAI is not directed at children. You must be at least 13 years old, or 16 if you are in the European Economic Area or the United Kingdom, to use the service. We do not knowingly collect personal information from children below those ages. If you believe a child has provided information, email abhi@valiqai.com and we will delete it.
What we do not do
We do not sell personal information.
We do not run third-party advertising networks on ValiqAI.
We do not use customer scan content to train our own models.
We do not send your private ValiqAI account data (passwords, payment details, API keys, or billing records) to AI providers.
We do not use disposable scan identities as real people, or for marketing to those identities.
Changes to this policy
We may update this policy as the product or the law changes. The "Last updated" date at the top will change. If we make material changes, we will notify you by email or by a notice in the product. Continued use after an update means the new policy applies to that ongoing use, except where the law requires a different form of consent.
Contact
Privacy questions and requests: abhi@valiqai.com. If you need a signed DPA for procurement, use the same address.