Privacy Policy

Who we are

Probara is developed and operated by OrderStorm Ecommerce, Inc., a Colorado corporation ("OrderStorm", "we", "us" or "our"), 11757 W. Ken Caryl Ave. F-272, Littleton, CO 80127, USA. Your privacy is important to us. This Privacy Policy explains what personal information we collect when you use the Probara web application at app.probara.net, its API and MCP server, and the websites at probara.net and docs.probara.net (together, the "Service"), how we use it, and the choices you have.

Our role

For your account and for what you send us through our websites, OrderStorm decides how and why your information is processed: we are its controller.

For the content an organization stores in Probara (projects, test cases, runs, results, defects, comments and attachments), the organization is the controller and OrderStorm processes that content on its behalf, following its instructions. If you have a question about content in an organization you belong to, contact that organization's administrators.

Payments are handled by Polar, our reseller and merchant of record. Polar processes your billing information under its own privacy policy.

Information we collect

We collect only what we need to run the Service:

• Account information: your email address, first and last name, and, if you add them, your position title, time zone, language and profile picture. We also record which version of the Terms and this policy you accepted and when.
• Sign-in information: your password, stored only as a one-way hash, and two-factor authentication secrets, stored encrypted. If you sign in with Google or through your company's single sign-on provider, we receive your name and email address from that provider.
• Content you add: everything you and your organization put into Probara, including attachments and data reported by your test runs, API calls and connected AI clients.
• Contact and feedback submissions: when you write to us through the contact form, we receive your name, email, company, the reason for contacting us, team size and message, plus the country your request came from. In-app feedback also includes your browser and app version and any screenshots you attach.
• Integration data: when your organization connects GitHub or Jira, we store the identifiers and links needed to keep both sides in sync, and the access credentials, encrypted.
• Security data: we use IP addresses and other request signals briefly to limit sign-in attempts, prevent abuse and tell people from bots. We do not record your IP address or browser with your sessions.
• Billing status: Polar tells us the plan, number of seats and status of your subscription. We do not receive your full card details.

How we use your information

We use your information to provide and secure the Service, to send the emails it depends on (such as address verification, password resets, invitations and the notifications you choose to receive), to answer your requests, to manage your subscription and to comply with the law.

We do not sell your personal information, we do not show advertising, and we do not use third-party analytics or tracking tools in the Service or on our websites.

Where data protection law requires a legal basis, as in the European Economic Area and the United Kingdom, we rely on these: performing our contract with you or your organization; our legitimate interests in keeping the Service secure, preventing abuse and answering your questions; complying with legal obligations; and your consent, where the law requires it.

Cookies and local storage

We use only the cookies the Service needs to work. They cannot be turned off without breaking sign-in:

• A session cookie that keeps you signed in. It lasts 30 days from your last activity and never more than 90 days.
• Short-lived cookies that protect a sign-in in progress: the two-factor authentication step and the return from Google or your single sign-on provider.
• A random device identifier, kept for 180 days, that lets us limit failed password attempts without locking out every device.

The app and our websites also keep your preferences, such as language, theme, currency and panel sizes, in your browser's local storage. That information stays on your device.

Sign-in and contact forms are protected by Cloudflare Turnstile, which processes signals from your browser to tell people from bots. Some documentation pages load fonts from Google Fonts and the API reference loads code from jsDelivr; those providers receive your IP address as part of the request.

If you turn cookies off in your browser, you will not be able to sign in. We do not use cookies to track you across other websites, and we do not exchange cookies with other companies.

Who we share information with

We do not share your personal information with non-affiliated third parties except as described here:

• Service providers that process data for us: Cloudflare (hosting, databases, file storage, email delivery and bot protection) and Polar (payments).
• Providers you choose to use: Google, if you sign in with Google; your company's single sign-on provider; and GitHub or Atlassian, when your organization connects them.
• The members of your organization, who can see your name, email address and profile picture, and the content you add.
• Anyone with a public run link that a member of your organization created.
• Authorities and others, to the extent required to comply with a legal or regulatory obligation, or when we believe it is necessary to protect the rights, property or safety of OrderStorm, our affiliates, our customers or others.
• A successor, if OrderStorm is involved in a merger, acquisition or sale of assets. We will notify you before your information becomes subject to a different privacy policy.

International transfers

OrderStorm is based in the United States, and our providers process data in data centers around the world. Your information may therefore be stored and processed outside your country. Where the law requires it, we protect those transfers with safeguards the law recognizes, such as standard contractual clauses.

How long we keep information

• Account information: until you delete your account. Deletion takes effect immediately; content you wrote inside an organization belongs to that organization and remains there without your name.
• Organization content: until the organization is deleted. A deleted organization is erased 14 days after the request. An organization nobody opens for 12 months is scheduled for deletion. Closed runs, their results and activity log entries are kept for the history window of the organization's plan: 90 days on Free and 2 years on Pro.
• Contact and feedback submissions: 365 days.
• Sign-in records: expired sessions are deleted 7 days after they expire, and password reset and email verification links within 30 days.
• Security data: rate limit records are deleted within one day.
• Backups: deleted data can remain in encrypted backups for up to 30 days. It is not used, and it is erased again if a backup is ever restored.

Security

We encrypt data in transit, store passwords only as one-way hashes, encrypt authentication secrets and integration credentials, isolate each organization's data from the rest, and limit access by our staff to authorized people who need it to run the Service. Any employee found violating our security and confidentiality standards is subject to our disciplinary process.

No method of transmission or storage is completely secure. If we learn of a security breach that affects your personal information, we will notify you as the law requires.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal information, to object to or restrict how we process it, and to withdraw any consent you gave. You can do most of this yourself: edit your profile, download your personal data, or delete your account from your profile settings. For anything else, contact us and we will answer within the time the law requires. We may ask you to confirm the request from the email address on your account.

For content inside an organization, send your request to that organization's administrators; we will help them answer it.

If you are in the European Economic Area, the United Kingdom or another region with a data protection authority, you can also complain to that authority. California residents: we do not sell or share personal information for cross-context behavioral advertising, and we will not discriminate against you for exercising your rights.

Children

The Service is not directed to children and you must be at least 18 years old to create an account. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

Links to other websites

The Service may link to websites and services we do not control, such as connected integrations. Those websites are not bound by this policy and may have their own policies or none at all. We encourage you to review their privacy policies.

Changes to this policy

We may update this policy when our Service or the law changes. We will publish the new version on this page with a new "Last updated" date, and when a change is material we will notify you by email or in the app before it takes effect.

Contact

If you have questions about this policy or want to exercise your rights, contact us through the contact form on probara.net or by mail at:

• OrderStorm Ecommerce, Inc., 11757 W. Ken Caryl Ave. F-272, Littleton, CO 80127, USA