Record of Processing Activities
This register documents every category of personal data processed by RuyQA, as required by Article 30 of the GDPR and Section 29 of the Nigeria Data Protection Act 2023. Last reviewed: June 2026.
Account Registration & Management
Purposes
- Create and authenticate user accounts
- Manage subscriptions and billing
- Send transactional emails (invoices, security alerts)
- Provide customer support
Personal Data Categories
- Full name
- Email address
- Password (hashed)
- Company / organization name
- Job title
- Phone number (optional)
Legal Basis
Contract (Art. 6(1)(b) GDPR) — necessary to provide the Service
Retention
While account is active + 90 days after termination (legal/backup purposes)
Storage Location
Database (encrypted at rest) — AWS / GCP
Third-Party Recipients
- Stripe or Paystack (payment processing)
- SendGrid / Mailjet (transactional email)
No
Test Management Content
Customers are controllers of this data. RuyQA acts as processor.
Purposes
- Create, store, and execute test cases
- Run manual and automated test executions
- Track defects and triage decisions
- Generate reports and analytics
- Manage test data factories
Personal Data Categories
- Names, emails, or identifiers embedded in test cases, comments, attachments, or defects by users
- Screenshots and videos captured during test runs
- Test data generated by data factories (may contain synthetic personal data)
Legal Basis
Contract (Art. 6(1)(b) GDPR) — necessary to provide the Service
Retention
Until deleted by customer or account termination (subject to backup retention up to 90 days)
Storage Location
Database (encrypted at rest) — AWS / GCP, File storage for attachments — AWS S3 / GCS
Third-Party Recipients
- AWS S3 (file attachments)
- GCP Cloud Storage (videos/screenshots)
No — users control content
Automation Run Execution
Purposes
- Execute Playwright test scripts on cloud infrastructure
- Capture test logs, screenshots, and videos
- Ask an AI model to suggest a rewrite of failing test steps and run it once
Personal Data Categories
- Test logs that may contain application data
- Screenshots of application under test
- Browser environment metadata
Legal Basis
Contract (Art. 6(1)(b) GDPR) — necessary to provide the Service
Retention
Logs: 30–90 days per plan. Screenshots/videos: retained until run is deleted or account terminated.
Storage Location
Ephemeral runner containers + persistent storage — AWS / GCP
Third-Party Recipients
- Playwright browser binaries (open source)
- Gemini API (for suggested rewrites, no training retention tier)
Yes. An AI model suggests a rewrite of a failing test and the rewrite is run once. A test that passes after a rewrite is flagged for human review and is not counted as a pass
AI Failure Analysis & Healing
Gated by AI credits. Requires explicit opt-in per project. Full audit trail visible to customer.
Purposes
- Diagnose test failures via Gemini AI
- Generate updated test steps with corrected selectors
- Retry failed tests with healed scripts
- Classify failures into triage statuses
Personal Data Categories
- Test titles, error messages, log content (sent to Gemini for analysis)
- Triage decisions, assignee names, notes
Legal Basis
Legitimate interests (Art. 6(1)(f) GDPR) — improving test reliability
Retention
Diagnosis results retained with test run until deleted by customer
Storage Location
Database + Gemini API (zero-retention tier — data not used for training)
Third-Party Recipients
- Google Gemini API (zero-retention, no training use)
Yes — AI diagnoses, refines steps, and retries automatically
Integrations (Jira, Slack, GitHub, GitLab, Jenkins)
Purposes
- Sync defects and test results to Jira
- Post notifications to Slack channels
- Trigger automation runs from CI/CD pipelines
- Post check statuses to pull requests
Personal Data Categories
- Jira issue keys, project names, usernames
- Slack channel names, webhook URLs
- GitHub/GitLab commit SHAs, branch names, PR metadata
- Authentication tokens for each integration
Legal Basis
Contract (Art. 6(1)(b) GDPR) — necessary to provide integration features
Retention
Integration configuration retained until disconnected by customer. Tokens encrypted at rest.
Storage Location
Database (encrypted at rest) — AWS / GCP
Third-Party Recipients
- Jira Cloud API
- Slack API
- GitHub API
- GitLab API
- Jenkins (customer-hosted)
No — integrations are user-initiated and configured
Analytics & Product Usage
No cross-site tracking. No marketing cookies. No data sold.
Purposes
- Measure feature adoption and usage patterns
- Detect errors and performance issues
- Improve product UX and prioritize features
Personal Data Categories
- Page views, feature interactions, click events
- Session duration, referrer URL
- Browser type, device type, OS version
- Anonymized IP address (truncated / hashed)
Legal Basis
Legitimate interests (Art. 6(1)(f) GDPR) — product improvement and security
Retention
Aggregated: 24 months. Raw event logs: 12 months.
Storage Location
Analytics platform — Vercel Analytics / PostHog (self-hosted)
Third-Party Recipients
- Vercel Analytics (anonymized, no personal data shared)
No — aggregated trend analysis only
Billing & Invoicing
Purposes
- Process subscription payments
- Generate and send invoices
- Manage tax records and accounting compliance
Personal Data Categories
- Billing name and address
- Payment card details (processed by payment processor — not stored by RuyQA)
- Invoice history and payment status
Legal Basis
Legal obligation (Art. 6(1)(c) GDPR) — tax and accounting requirements
Retention
7–10 years (tax/legal requirements)
Storage Location
Payment processor (Stripe/Paystack) + encrypted database records
Third-Party Recipients
- Stripe (payment processing)
- Paystack (payment processing — Nigeria)
No
Customer Support & Communication
Marketing emails require consent. Withdrawal mechanism available at any time.
Purposes
- Respond to support tickets and inquiries
- Troubleshoot technical issues
- Send product updates, security notices, and maintenance alerts
Personal Data Categories
- Name, email address
- Support ticket content and attachments
- Chat messages (if applicable)
- Communication history
Legal Basis
Contract (Art. 6(1)(b) GDPR) — necessary to provide support. Legitimate interests (Art. 6(1)(f)) — product communication.
Retention
Support tickets: 3 years after resolution. Marketing opt-out records: indefinitely.
Storage Location
Email system + support platform — Google Workspace / HelpScout
Third-Party Recipients
- Google Workspace (email)
- HelpScout or similar (support ticketing)
No
Scheduled & CI/CD Automation Triggers
Purposes
- Execute scheduled test runs via cron expressions
- Receive CI webhooks from GitHub Actions, GitLab CI, Jenkins
- Trigger automation runs and report results back
Personal Data Categories
- CI pipeline metadata (repository name, commit SHA, branch)
- Schedule configuration (cron expression, suite selection)
- Build status and webhook payloads
Legal Basis
Contract (Art. 6(1)(b) GDPR) — necessary to provide automation features
Retention
Schedule configurations retained until deleted. Webhook logs: 30 days.
Storage Location
Database — AWS / GCP
Third-Party Recipients
- GitHub / GitLab / Jenkins (customer-controlled)
Yes — cron daemon automatically triggers runs at scheduled times
Data Subject Access Request (DSAR) Handling
DSARs can be submitted via the Privacy Center (/privacy-center) or by emailing privacy@tensflare.com. The DPO (dpo@tensflare.com) oversees all DSAR processing.
Purposes
- Receive and log data subject access requests from the Privacy Center
- Verify requestor identity before processing
- Fulfill rights requests (access, deletion, correction, opt-out, portability)
- Maintain audit trail of DSAR submissions and responses
- Respond within statutory timeframes (30 days GDPR/NDPA)
Personal Data Categories
- Full name and email address of requestor
- Request type and detailed description of request
- Internal handling notes and status updates
- Resolution timestamp and supporting documentation
Legal Basis
Legal obligation (Art. 6(1)(c) GDPR) — compliance with data protection law
Retention
DSAR records retained for 3 years after resolution (statute of limitations for regulatory complaints). Requestor identity verification data deleted after 90 days post-resolution.
Storage Location
Database (encrypted at rest) — AWS / GCP
Third-Party Recipients
- None — DSARs are processed internally by the DPO
No — each DSAR is reviewed manually by the DPO or designated privacy team member
Data Controller & Processor
Tensflare Inc. (Denver, Colorado, United States) is the data controller for customer account data and billing data. For customers who pay in African currencies, our affiliate Tensflare Ltd (Abuja, Nigeria) bills as authorised reseller and processes their billing data. For test management content uploaded by customers, the customer acts as data controller and RuyQA acts as data processor under a Data Processing Addendum (DPA).
This ROPA is maintained in accordance with Article 30 GDPR and Section 29 NDPA. Last updated: June 2026. Reviewed quarterly. For questions, contact dpo@tensflare.com.