Privacy Policy

1. Who we are

CogentRun is operated by CogentRun, Gwalior, MP, India. For any privacy question, contact info@cogentrun.com.

2. Information we collect

• Account information — organisation name, your name, email address, and password (stored only as a salted hash).
• Test content you create — plain-English instructions, generated scenarios, target URLs, and exported scripts.
• Connected tool data — when you connect Jira, GitHub, or Bitbucket, we read the tickets, comments, repositories, branches, and metadata you authorise so the agent can reflect the requirement and the code.
• Source code — to review a pull request or cross-reference a ticket, we read pull request metadata, the list of changed files, the unified diff, and the contents of a small number of files the agent searches for. This is your proprietary code: it is fetched per analysis, sent to our model provider as context, retained with that analysis record, and never used to train any model. Limits are applied to how much is read in one analysis.
• Knowledge learned about your app — notes the agent keeps so later runs work better, such as selector quirks on a particular domain and a map of your product's screens and elements. Scoped to your organisation.
• Run artifacts — video recordings, step screenshots, logs, network traces, and PDF reports produced by your test runs.
• Test credentials you store — usernames, passwords, and tokens you add to the credential vault so tests can sign in.
• Usage and billing data — runs executed, AI tokens consumed, device or browser minutes, wallet balance and transactions.
• Technical data — IP address, browser and device type, timestamps, and error diagnostics.

We do not ask for and do not want end-user production personal data. If your tests run against real customer records, you decide that and remain responsible for it.

3. Why we use it

• To provide the service: generate tests, execute runs, and return reports.
• To authenticate you and keep your workspace secure.
• To meter usage and charge the correct amount against your plan and wallet.
• To debug failures, improve reliability, and respond to support requests.
• To send service notices, and marketing email only where you have opted in.

Legal bases where applicable: performance of a contract, legitimate interests in operating and securing the service, consent for optional communications, and compliance with legal obligations.

4. AI processing

Generating tests, reviewing pull requests, analysing tickets, drafting scenarios, and answering questions about your product all involve sending the relevant context to model providers we use as processors. Depending on the task that context can include your instruction, ticket and comment text, excerpts of your source code and diffs, the page structure of the application under test, and screenshots of it. Our contractual position on provider training is: Amazon Bedrock does not use customer prompts or model outputs to train its models, and we do not train any model on your data. Current model providers: Amazon Web Services (Amazon Bedrock).

Writing results back to your tools

When you ask for it — or when you have enabled a webhook that does it automatically — an analysis is posted back into the system it came from, for example as a comment on a Jira issue with a PDF report attached. At that point the content leaves our systems and is governed by your agreement with that provider and by your own workspace permissions. You control this per organisation and can turn it off or revoke the integration at any time.

5. Credentials and synthetic data

Credentials in the vault are encrypted at rest and are injected into a run without being printed. CogentRun does NOT automatically redact passwords, tokens, or PII from video recordings or screenshots. Because the AI interacts with the real DOM and records visual evidence, you must use dedicated test accounts and synthetic (fake) data for all test runs. Do not expose real customer personal data to the testing environment.

6. Sharing and processors

We do not sell personal data. We share it only with service providers that run the platform on our behalf, under contract and only for that purpose — cloud hosting, real browser and device infrastructure, model providers, email delivery, and payment processing. Named providers: Amazon Web Services (application hosting, database and file storage in India; AI models via Amazon Bedrock and real browser and device testing via AWS Device Farm in the United States; e-mail via Amazon SES), Dodo Payments (merchant of record for payments, billing and tax), and the Atlassian, GitHub and Bitbucket accounts you choose to connect.

We may also disclose data where legally required, or as part of a merger or acquisition, in which case we will notify affected customers.

7. International transfers

Data may be processed outside your country by the providers above. Where required by GDPR or UK GDPR, we rely on appropriate transfer safeguards, including Standard Contractual Clauses (SCCs) and adherence to the EU-US Data Privacy Framework (DPF). Primary hosting region: India (ap-south-2 / Hyderabad) for the application, database and stored files; AI model processing in the United States (us-east-1 / N. Virginia); real device and browser testing in the United States (us-west-2 / Oregon).

8. Retention

• Account and billing records: kept while your account is active, then as required by law.
• Run artifacts (video, screenshots, logs): default retention 3 months, after which they are deleted automatically.
• Vault credentials: kept until you delete them or delete the workspace.
• Backups: retained for 7 days.

When you delete your account we delete or irreversibly anonymise your data within 30 days, except records we must keep for accounting.

9. Your rights (GDPR & CCPA)

Under laws like the GDPR (EU/UK) and CCPA (California), you have the right to access, rectify, or delete your personal data (the Right to be Forgotten). You may also request a portable copy of your data, restrict its processing, or object to processing. You can withdraw consent for marketing at any time. Email info@cogentrun.com (our designated Data Protection Officer point of contact) and we will respond within the period required by applicable law. If you are unhappy with our response you may complain to your local data protection authority.

10. Cookies and analytics

We use cookies that are strictly necessary to keep you signed in and to secure form submissions. For non-essential analytics and product-usage tooling, we provide a cookie consent banner that allows you to opt-in or out at any time. Analytics tools in use: None — we do not run third-party analytics or advertising trackers.

11. Children

CogentRun is a business tool and is not intended for anyone under 16. We do not knowingly collect data from children.

12. Changes

We will post updates on this page and, for material changes, notify account owners by email before the change takes effect.