Privacy Policy

2.1Coverage

This Policy applies to all individuals who register for an Account on the Platform; visitors to BitAssert’s website and web properties; individuals whose personal data is submitted as part of Customer Data; and individuals who communicate with BitAssert for support, sales, legal, or compliance purposes.

2.2Processor Activities

Where BitAssert processes personal data on behalf of a Customer as a data processor, the terms of the applicable Data Processing Agreement govern that processing. This Policy addresses BitAssert’s own data processing activities as a controller or Data Fiduciary.

4.1BitAssert as Data Fiduciary

For the purposes of the DPDP Act and applicable Indian data protection law, BitAssert Software Private Limited acts as the Data Fiduciary in respect of personal data it collects and processes for its own purposes, including account management, platform operation, support, billing, security, and communications.

Company Name

BitAssert Software Private Limited

CIN

U62013TS2025PTC203531

Registered Address

SY:11, WeWork Krishe Emerald, Laxmi Cyber City, Cyberabad, Shaikpet, Hyderabad 500081, Telangana, India

Authorised Signatory

Sudheer Kumar D, Co-Founder and Chief Executive Officer

Platform URL

app.bitassert.com

Legal Contact

legal@bitassert.com

Grievance Officer

Sudheer Kumar D

Grievance Email

grievance@bitassert.com

Grievance Phone

[Mobile Number — To Be Confirmed]

Response Time

Within 30 days of receipt of a valid grievance

5.1Account Registration and Authentication

When a user registers for a Platform Account, BitAssert collects the following:

• full name and email address;
• job title and employer name;
• hashed account password, where the user registers via email and password;
• OAuth authentication tokens issued by Google or GitHub, where the user authenticates using the ‘Sign in with Google’ or ‘Sign in with GitHub’ options. BitAssert does not store the user’s Google or GitHub password — authentication is delegated to those providers under the OAuth 2.0/OIDC protocol;
• account administrator designation and role configuration within the Platform; and
• organisation name and project identifiers.

5.2Billing and Commercial Data

BitAssert has no payment gateway currently integrated into the Platform. When a payment mechanism is introduced, billing information will be collected and this Policy will be updated to reflect the applicable data flows and subprocessors.

5.3Platform Usage Data

In the course of operating the Platform, BitAssert automatically collects log data including IP addresses, browser type and version, operating system, session identifiers, pages accessed, and error reports; organisation and project usage metadata; and platform performance and telemetry data.

No third-party analytics platforms, error tracking tools, session replay tools, or advertising scripts are currently deployed. Usage data is collected only through native Platform logging.

5.4Customer Data Containing Personal Data

Customers may upload or generate Customer Data that incidentally contains personal data, including test scripts referencing personal data, screenshots of applications under test, video recordings of test sessions, and AI prompts submitted through the AI authoring interface.

BitAssert processes such Customer Data solely to provide the Platform. Customers are solely responsible for their legal basis to submit personal data and must use anonymised or synthetic data in test environments where possible.

5.5AI Feature Data

Where a Customer enables AI Features, the following data may be submitted for inference processing:

• natural-language prompts describing test scenarios submitted through the AI test authoring interface;
• application source code or source code fragments provided through the Local Agent;
• API endpoint definitions, parameter data, and JSON response schemas for expression generation; and
• test case step descriptions for AI-assisted authoring.

Data is submitted in raw or verbatim form to BitAssert’s third-party AI provider(s). All AI-generated test case outputs are assigned ‘in_review’ status in the Platform workflow and are not executed until the Customer reviews and approves them.

Inference location is confirmed: AI requests are sent to BitAssert’s third-party AI provider(s), each of which processes inference in the United States and stores associated data in the United States. Each AI request is therefore a cross-border transfer from India to the United States.

BitAssert’s AI providers do not use data submitted via their APIs to train or fine-tune their models by default, under each provider’s current commercial terms. BitAssert does not use Customer Data to train any AI model.

5.6Local Agent Data

The Local Agent runs in the Customer’s environment and reads the Customer’s application source code within the project folder the Customer selects, to support AI-assisted test authoring. As confirmed by BitAssert engineering, the Local Agent transmits no data to BitAssert’s cloud; it communicates with the BitAssert web application over a local loopback connection. The Local Agent does not read OS environment variables or credential stores and does not require root or administrator privileges in steady-state operation.

5.7Data Not Currently Collected

BitAssert confirms the following are not currently collected or deployed:

• cookies — no cookies are deployed on the BitAssert website or Platform application;
• third-party analytics or tracking scripts (Google Analytics, LinkedIn Insight Tag, Meta pixels, session replay tools);
• personal data of children below 18 years of age — the Platform is not directed at minors; and
• government-issued identification numbers, except where required for tax compliance.

8.1Confirmed Subprocessors

As of the date of this Policy, BitAssert has confirmed the following third-party subprocessors. These are the only third-party services that process personal data on BitAssert’s behalf. No public cloud infrastructure provider, CDN, analytics platform, error tracking tool, CRM, or payment processor is currently engaged.

8.2Law Enforcement and Regulatory Disclosure

BitAssert may disclose personal data to governmental authorities, courts, or law enforcement where required by applicable law, including CERT-In directions under the IT Act. BitAssert will limit such disclosures to what is strictly required and will notify affected individuals where legally permissible.

8.3Corporate Transactions

In the event of a merger, acquisition, restructuring, or asset sale, personal data may be transferred as part of that transaction. BitAssert will take reasonable steps to ensure that the acquiring entity provides privacy protections at least equivalent to those in this Policy.

8.4No Sale of Personal Data

BitAssert does not sell personal data to third parties for commercial or marketing purposes.

9.1Infrastructure

The Platform is operated on BitAssert’s private cloud infrastructure in India. No public cloud providers are used for primary Customer Data hosting. Authentication uses industry-standard OAuth 2.0/OIDC protocols. Specific infrastructure and security architecture details are set out in the Security and Subprocessor Schedule.

9.2Security Measures

BitAssert maintains administrative, technical, and organisational measures that it considers commercially reasonable for the nature and scale of the Platform. Confirmed measures include role-based access within the Platform, encrypted transmission between the Local Agent and BitAssert’s cloud API, and network-based isolation of test execution infrastructure.

9.3Breach Notification

In the event of a personal data breach, BitAssert will comply with its notification obligations under the DPDP Act, including notification to the Data Protection Board of India and affected Data Principals as required by applicable law and Rules.

10.1Primary Hosting in India

All Customer Data is stored on BitAssert’s private cloud infrastructure in India. BitAssert does not currently offer data residency selection or multi-region hosting.

10.2Transfer via Backups

BitAssert takes daily backups which are stored outside India. This constitutes a cross-border transfer of personal data. The transfer is subject to appropriate safeguards and the backups are retained for 30 days and purged within 30 days following primary deletion.

10.3Transfer via Third-Party AI Providers for AI Feature Processing

Where AI Features are enabled, data including natural-language prompts, application source code, and API schemas is transmitted to BitAssert’s AI providers — currently Anthropic PBC and OpenAI, L.L.C. — for inference processing. This constitutes a transfer of data from India to the United States, processed under each provider’s Data Processing Addendum (incorporating the EU Standard Contractual Clauses).

The legal basis for this cross-border transfer under the DPDP Act is: (a) consent of the Data Principal through acceptance of this Policy and the applicable Terms of Service; and (b) contractual necessity in connection with providing AI-assisted testing services requested by the Customer.

A Data Processing Addendum is in place with each AI provider, automatically incorporated under that provider’s standard commercial terms. Each addendum establishes the provider as a processor under GDPR Article 28, prohibits use of API data for model training by default, and incorporates the EU Standard Contractual Clauses for international transfers. The cross-border transfer to the United States is, as at June 2026, lawful under the DPDP Act (no restricted-country notification under Section 16 is currently in force) and is supported by the SPDI Rules 2011 and each provider’s DPA.

10.4Transfer via Resend for Email Delivery

Transactional email is delivered by Resend, Inc., which processes and stores email data in the United States. This is a cross-border transfer governed by Resend’s Data Processing Addendum, which incorporates the EU Standard Contractual Clauses and aligns with the EU-U.S. Data Privacy Framework.

10.5Customers and Data Principals Outside India

BitAssert is established in India and currently serves customers in India, with active expansion into the United States, the European Union, the United Kingdom, Singapore, Australia, and Canada. Where BitAssert processes personal data of individuals located in these jurisdictions, additional data protection laws may apply, and BitAssert handles such data consistently with their core requirements:

• European Union / EEA (GDPR): BitAssert acts as a processor on behalf of its Customers for Customer Data. International transfers from the EEA to India or the United States are made under the European Commission’s Standard Contractual Clauses. EEA Data Subjects retain the rights of access, rectification, erasure, restriction, portability, and objection, and may lodge complaints with their local supervisory authority.
• United Kingdom (UK GDPR and Data Protection Act 2018): equivalent rights apply. Transfers from the UK are made under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. UK Data Subjects may complain to the Information Commissioner’s Office (ICO).
• United States (CCPA/CPRA, where applicable): for California residents, BitAssert acts as a service provider and does not sell or share personal information. California residents may exercise rights of access, deletion, correction, and non-discrimination through the contacts in this Policy. BitAssert warrants that it will not sell, retain, use, or disclose personal information processed on a Customer’s behalf for any purpose other than providing the Services under the Customer’s agreement with BitAssert, and will not combine such personal information with personal information BitAssert receives from other sources, except as permitted by the CCPA/CPRA.
• Singapore (PDPA), Australia (Privacy Act), and Canada (PIPEDA): where these laws apply, BitAssert processes personal data consistently with their consent, purpose-limitation, access, and correction requirements.

In each case, the lawful basis for processing and any cross-border transfer is as set out in the Data Processing Agreement entered into with the relevant Customer. Where a conflict arises between this Policy and a Customer’s Data Processing Agreement, the Data Processing Agreement governs in respect of that Customer’s personal data.

11.1Retention by Subscription Plan

Test Artefacts are retained for the following periods by subscription plan:

Test Artefacts subject to this tiered retention include: test scripts, test execution results and logs, screenshots, video recordings, HAR files, network traces, AI-generated outputs, and API request/response payloads.

11.2Account and Registration Data

Account and registration data is retained for as long as the Account is active and for a reasonable period thereafter for legal compliance, dispute resolution, and billing purposes.

11.3Activity Logs

User activity logs are currently subject to data loss on new platform deployments. A backup policy is under development. Until implemented, BitAssert cannot make retention commitments for user activity logs.

11.4Retention Schedule

11.5Customer Deletion

Customers may delete individual Test Artefacts at any time through the Platform’s built-in manual deletion function. Upon termination, BitAssert will make Customer Data available for export for 30 days and will delete primary data within 30 days thereafter, subject to backup purge timelines and legal hold obligations. Upon written request, BitAssert will issue a written Deletion Certificate confirming that Customer Data has been deleted from primary systems in accordance with the applicable Data Retention Schedule.

12.1Rights Under the DPDP Act

12.2Exercise of Rights

To exercise any right or to raise a grievance, contact:

Grievance Officer

Sudheer Kumar D

Email

grievance@bitassert.com

Telephone

[Mobile Number — To Be Confirmed]

Postal Address

BitAssert Software Private Limited, SY:11, WeWork Krishe Emerald, Laxmi Cyber City, Cyberabad, Shaikpet, Hyderabad 500081, Telangana, India

Response Time

Within 30 days of receipt

13.1AI Features and Human Review

BitAssert integrates AI-assisted test authoring into the Platform. AI Features produce Generated Outputs — test scripts, validation expressions, and test step suggestions — that are presented to users for review. All AI-generated test cases are assigned an ‘in_review’ status in the Platform workflow and require human review and approval before execution. No AI-generated output is auto-executed.

13.2AI Model and Provider

13.3No Automated Decision-Making

BitAssert does not use automated decision-making processes that produce legal effects or similarly significant effects on individuals. All AI Features produce suggestions for Customer review. No binding decisions are taken autonomously.

13.4AI Output Limitations

AI-generated outputs may be incomplete, inaccurate, or require technical validation before use. BitAssert does not warrant the accuracy, completeness, or fitness for purpose of any AI-generated output.

13.1No Legally Significant Automated Decisions

BitAssert does not make automated decisions about individuals that produce legal effects or similarly significant effects on those individuals. All decisions affecting Platform users are made by human personnel. The AI Features integrated into the Platform are assistive tools that generate suggestions for Customer review — they do not make autonomous binding decisions about any individual.

13.2AI Features are Assistive Only

AI-generated test cases, validation expressions, and suggestions are assigned ‘in_review’ status within the Platform and require explicit Customer approval before execution. BitAssert does not apply AI Features to evaluate, score, rank, or make decisions about Platform users, Authorised Users, or Data Principals. AI Features are applied to software testing workflows and artefacts, not to personal data of individuals in a manner that produces automated decisions about those individuals.

13.3No Profiling for Significant Purposes

BitAssert does not profile Platform users for the purpose of evaluating personal aspects relating to their professional performance, economic situation, preferences, interests, reliability, behaviour, or location. Usage analytics and platform telemetry are used solely to improve Platform features and operational performance, and are not used to construct individual profiles for decision-making.

13.4Customer Automated Decision-Making

Where a Customer uses Customer Data in connection with its own automated decision-making or profiling activities, the Customer is solely responsible for ensuring compliance with applicable law, including any obligations under the DPDP Act or GDPR to inform affected individuals, provide human oversight, implement appropriate safeguards, or offer rights to contest automated decisions.

14.1How to Submit a Grievance

Under the Digital Personal Data Protection Act, 2023, Data Principals have the right to have any grievance addressed by BitAssert’s Grievance Officer. To submit a grievance regarding BitAssert’s processing of personal data:

14.2Grievance Response Timeline

14.3Data Protection Board of India

The Data Protection Board of India, established under the Digital Personal Data Protection Act, 2023, is the designated authority for adjudication of complaints under the Act. Once the Board is operationally constituted and complaint procedures are notified, Data Principals may lodge complaints directly with the Board if they are not satisfied with BitAssert’s response to a grievance. Information about the Board’s complaint procedures will be published on the Ministry of Electronics and Information Technology’s official website.