Data Processing Addendum

For customer content submitted to or retrieved through authorized Connections to run tests, including issue content, comments, supported attachment content and metadata, linked pull request context, tests, target URLs, page content captured during runs, credentials, environment variables, and run artifacts, Customer is generally the controller and Smoketest is generally the processor.

Smoketest remains an independent controller for account administration, billing, service security, product analytics, support, legal compliance, and communications as described in the Privacy Policy.

Smoketest will process customer personal data only to provide, secure, support, and maintain the service; to follow Customer's documented instructions through product configuration, API calls, authorized Jira, Linear, and repository Connections, integrations, and support requests; and as required by law.

Customer is responsible for ensuring that it has all rights, permissions, notices, and legal bases necessary to use Smoketest with the Jira or Linear workspaces, repositories, systems, accounts, URLs, credentials, attachments, and personal data it provides or instructs Smoketest to retrieve.

Smoketest uses technical and organizational measures designed to protect customer personal data, including:

• encryption in transit for service connections;
• AES-256-GCM encryption for stored customer credentials, issue Jira and Linear OAuth tokens, and environment variables;
• signature or token verification before accepted provider webhook events are processed;
• sanitization, length limits, attachment allowlists, and recognized-secret redaction for issue and linked pull request context;
• signed URLs/private access for run artifacts;
• 90-day lifecycle deletion for run artifacts stored in Cloudflare R2;
• workspace scoping for customer data access;
• structured log redaction for authorization and cookie headers;
• server backups, monitoring, and operational logging;
• limited access to production systems based on operational need.

No system is perfectly secure. Customer should use dedicated test accounts and avoid real credentials or unnecessary production personal data whenever possible.

Customer authorizes Smoketest to use the subprocessors below to provide the service. Smoketest remains responsible for its subprocessors' processing of customer personal data as required by applicable data protection law.

Jira, Linear, GitHub, Slack, and Discord are customer-directed services configured by Customer. If Customer enables them, Customer instructs Smoketest to retrieve from or send the selected data to those services. Customer's own agreement with each provider also governs that provider's handling of data in the provider's service.

Smoketest and its subprocessors may process personal data outside the European Economic Area. Where required, Smoketest will rely on lawful transfer mechanisms such as adequacy decisions, standard contractual clauses, data processing terms, or other safeguards recognized by applicable law.

If Smoketest becomes aware of a personal-data breach affecting customer personal data processed on Customer's behalf, Smoketest will notify Customer without undue delay after becoming aware of the incident.

The notice will include available information reasonably needed for Customer to meet its own breach-notification obligations. Smoketest may provide information in phases as investigation progresses.

Smoketest will provide reasonable assistance for data subject requests, deletion or export requests, security questions, and data protection inquiries relating to customer personal data processed through the service. Structured exports may include issue-derived records and provider provenance, but do not include OAuth tokens, webhook secrets, or third-party data the requester is not authorized to receive.

Deletion is currently handled manually. Contact [email protected] for privacy requests, or [email protected] for security issues.

Upon request or account termination, Smoketest will delete or anonymize customer personal data within a commercially reasonable period unless retention is required for legal, accounting, billing, fraud-prevention, security, backup, dispute-resolution, or similar legitimate reasons.

Run artifacts stored in Cloudflare R2 are generally deleted after 90 days. Database run metadata may be retained longer until Smoketest defines and implements a formal metadata retention policy.

Disconnecting Jira or Linear removes stored provider credentials and its Connection registration but does not by itself delete historical Test Requests, Attempts, Results, frozen issue or supported attachment content, linked pull request context, synchronization records, or audit history. Those records are included when the related workspace data is deleted upon a valid request, subject to the exceptions above.

Smoketest will make reasonable information available to demonstrate compliance with this DPA. For self-service customers, this may include this DPA, the Privacy Policy, security documentation, subprocessor information, and written responses to reasonable privacy or security questions.

Smoketest may update this DPA and subprocessor list from time to time. If we make a material change that meaningfully affects processing of customer personal data, we will update this page and provide additional notice where required by applicable law or contract.