# AstraZ AI QA OPS — Privacy Policy **Effective Date:** May 5, 2026 **Product:** AstraZ AI QA OPS (`astraz-qa`) **Publisher:** Vamshi, Sole Proprietor trading as AstraZ AI, India --- ## 1. Summary AstraZ AI QA OPS is a **local-first** command-line QA testing tool. Your test recordings, browser interactions, screenshots, traces, and generated test files **never leave your local machine** unless you explicitly configure cloud sync. **We collect zero Personally Identifiable Information (PII).** We do not have access to your passwords, DOM contents, source code, cookies, session tokens, or application data. --- ## 2. Data That Stays Local (Never Transmitted) The following data is generated and stored exclusively on your local filesystem (the `.astraz/` directory) and is **never transmitted** to AstraZ AI servers: | Data Type | Storage Location | Transmitted? | |---|---|---| | Recorded browser flows (flow.json) | `.astraz/flows/<name>/flow.json` | ❌ Never | | Screenshots | `.astraz/flows/<name>/screenshots/` | ❌ Never | | Trace files | `.astraz/flows/<name>/traces/` | ❌ Never | | Flow history/versions | `.astraz/flows/<name>/history/` | ❌ Never | | Generated Playwright test files | `astraz-tests/*.spec.ts` | ❌ Never | | HTML QA reports | `.astraz/reports/` | ❌ Never | | Project configuration | `.astraz/config.json` | ❌ Never | | Branding configuration | `.astraz/branding.json` | ❌ Never | | Authorization log | `.astraz/authorization.json` | ❌ Never | | Debug logs | `.astraz/astraz-debug.log` | ❌ Never | | Credentials | `~/.astraz/credentials.json` | ❌ Never | --- ## 3. Data We May Receive (Optional Cloud Features) If you configure `ASTRAZ_API_URL` and opt into cloud features, the following **minimal metadata** may be transmitted to our Supabase backend: | Data Type | Purpose | Size Limit | Contains PII? | |---|---|---|---| | CI run summary | Track pass/fail/flaky status | ≤ 32 KB | ❌ No | | Flow ID (hash) | Identify which flow ran | 16 chars | ❌ No | | Base URL host hash | Anonymized target identifier | 32 chars (SHA-256) | ❌ No | | CLI version | Compatibility tracking | ~10 chars | ❌ No | | Step count (passed/failed) | Summary metrics | Integer | ❌ No | **We never receive:** passwords, form values, DOM content, page HTML, screenshots, traces, cookies, session tokens, API keys, source code, file contents, or any user-entered data. --- ## 4. Sensitive Data Masking AstraZ AI automatically masks sensitive data **before writing to disk**: - Password fields → `[ASTRAZ_REDACTED]` - OAuth tokens, API keys, session tokens → `[ASTRAZ_REDACTED]` - Authorization headers, cookies → `[ASTRAZ_REDACTED]` - URL fragments containing `access_token`, `refresh_token` → Redacted - Form fields matching sensitive patterns → `[ASTRAZ_REDACTED]` The following fields can **never** be added to the allow-list: `authorization`, `cookie`, `set-cookie`, `access_token`, `refresh_token`, `password`. --- ## 5. Credential Security - CLI credentials are stored locally in `~/.astraz/credentials.json` - Protected by HMAC-SHA256 integrity check using a machine-local secret - File permissions set to `0600` on macOS/Linux (best-effort on Windows) - CI tokens are hashed (SHA-256) before server storage; plain token is shown once and never stored or retrievable again --- ## 6. Third-Party Services | Service | Purpose | Data Shared | |---|---|---| | Supabase (optional) | Auth, licensing, CI summaries | Minimal metadata only (see §3) | | npm registry | Package distribution | Package metadata only | | GitHub Actions (user's CI) | Test execution | Runs in customer's own CI | AstraZ AI does **not** use any analytics, tracking, advertising, or data brokerage services. --- ## 7. Data Retention - **Local data:** Retained indefinitely on your machine. You control deletion. - **Cloud CI summaries:** Retained for the lifetime of your workspace. - **Audit events:** Retained for 180 days, then eligible for deletion. - **Debug logs:** Automatically rotated at 10 MB; maximum 3 rotated files. - **Flow history:** Last 20 versions per flow; older versions auto-pruned. --- ## 8. Your Rights - **Access:** All your data is stored locally in `.astraz/`. You have full read/write access. - **Deletion:** Delete `.astraz/` to remove all project data. Delete `~/.astraz/` to remove credentials. - **Portability:** All data is stored in standard JSON format. Export at any time. - **Opt-out:** Do not set `ASTRAZ_API_URL` to operate fully offline with zero cloud communication. --- ## 9. Children's Privacy AstraZ AI QA OPS is a professional B2B development tool. It is not intended for use by individuals under 18 years of age. --- ## 10. Regulatory Compliance ### India — Digital Personal Data Protection Act, 2023 (DPDPA) AstraZ AI operates from India and complies with the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. As a **local-first** tool that processes zero personal data by default: - AstraZ AI acts as a **Data Fiduciary** only for the minimal authentication metadata described in §3 - No personal data is collected, stored, or processed without explicit user action (opt-in cloud features) - The Data Protection Board of India is the supervisory authority for complaints related to Indian data subjects - Users may exercise their rights under Section 11-14 of the DPDPA by contacting the Grievance Officer (see §12) ### EU — General Data Protection Regulation (GDPR) AstraZ AI's local-first architecture ensures GDPR compliance by design: - **Data Minimization** (Art. 5): Zero PII collection; all heavy data stays on customer's machine - **Privacy by Design** (Art. 25): Sensitive data masked before disk write - **Right to Erasure** (Art. 17): Delete `.astraz/` and `~/.astraz/` for complete removal - **Lawful Basis** (Art. 6): Legitimate interest (contract performance) for minimal CI metadata For EU-based customers, AstraZ AI processes data under the **Standard Contractual Clauses** framework where applicable. --- ## 11. Changes to This Policy We may update this privacy policy. Material changes will be communicated via the GitHub repository changelog and npm release notes. --- ## 12. Grievance Officer (India — DPDPA) As required under the Digital Personal Data Protection Act, 2023: **Grievance Officer:** Vamshi **Email:** vamshi@astrazai.com **Response Time:** Within 30 days of receipt of complaint **Address:** India --- ## 13. Contact For privacy questions: **info@astrazai.com** For support: **support@astrazai.com** GitHub: [github.com/AstraZ-AI/astraz-qa](https://github.com/AstraZ-AI/astraz-qa) --- *This privacy policy was last updated on May 5, 2026.*