Privacy Policy

RobotActions — Privacy Policy

Effective: 2026-08-13

9377-5146 Quebec Inc., doing business as RobotActions ("RobotActions", "we", "us", "our"), is a Quebec corporation with its head office in Saint-Laurent, Quebec, Canada. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use our Service.

This Privacy Policy applies to robotactions.com, all tenant subdomains (for example, your-name.robotactions.com), our APIs, our MCP endpoints, and any related software or documentation (together, the "Service").

If you are a Quebec resident, this Policy is also designed to satisfy our obligations under the Quebec Act respecting the protection of personal information in the private sector (the "Quebec Privacy Act", as amended by Law 25). If you are elsewhere in Canada, it also reflects our obligations under the Personal Information Protection and Electronic Documents Act (PIPEDA).

1. Information We Collect

1.1 Account information

When you sign up through Auth0, we collect:

• Your email address.
• Your name (if provided).
• Authentication metadata (Auth0 user ID, identity provider, MFA factors).
• Hashed password (stored by Auth0, not by us).

1.2 Tenant information

• Your assigned tenant subdomain.
• Your role within the tenant (owner, admin, member).
• Audit logs of administrative actions in your tenant.

1.3 Billing information

• Stripe customer ID and a transaction history (date, amount, currency, tax, status).
• Credit balance and credit-debit ledger entries.
• Tax-identification metadata you provide (for example, GST/QST or VAT numbers for business invoices).

We do not store your full card number, CVV, or bank account details. Stripe stores and processes that information directly under its own terms.

1.4 Usage information

• Device sessions you start (which device, when, for how long).
• Test runs you execute (which flow, which device, outcome).
• AI agent transcripts (your prompts and the agent's responses, tool calls, and outputs).
• Screenshots, page-source snapshots, and other artifacts captured during testing.
• Flow recordings (the device interactions you record for playback).
• API and MCP request logs.

1.5 Telemetry

• Page views and feature-usage events within the web portal.
• Error and crash reports sent to GlitchTip (which may include stack traces, browser metadata, and the URL where the error occurred).
• Audit logs of administrative actions (who changed what, when).

1.6 Integration credentials

When you connect a third-party service (Jira, TestRail, Azure DevOps, an AI provider with your own API key, and similar), we collect the API tokens or OAuth credentials you provide. These are encrypted at rest using AES-256-GCM and decrypted only at the moment they are used to make an outbound request on your behalf.

1.7 Communications

If you contact us at [email protected], we collect the contents of your message, your email address, and any attachments.

1.8 Information we do not collect

We do not run third-party advertising or analytics trackers. We do not buy or enrich personal information from data brokers.

2. How We Use Personal Information

We use personal information to:

| Purpose | Examples | |---|---| | Operate the Service | authenticate you, provision your tenant, run device sessions and AI agents, deliver test results | | Bill you | process Stripe payments, calculate GST/QST, issue invoices, manage credit balances | | Support you | respond to your [email protected] messages, diagnose issues you report | | Secure the Service | detect and respond to abuse, fraud, intrusion, and acceptable-use violations | | Comply with law | meet tax-record-keeping obligations, respond to lawful requests, enforce our Terms | | Improve the Service | aggregate, de-identified usage analysis; bug triage; product roadmap prioritization | | Send you transactional email | account, billing, security, and Service-change notices |

We do not sell personal information to third parties. We do not use personal information for third-party advertising or for cross-context behavioural advertising.

3. AI Agent Data — What Leaves the Platform

When you invoke an AI agent (Anthropic Claude, OpenAI, Google Gemini, or another supported provider), we transmit the following to the provider so it can produce a response:

• Your prompts (the instructions you give).
• The system prompt RobotActions assembles to scaffold the agent.
• Tool-call inputs and outputs the agent generates (including device screenshots, page-source XML, and shell or HTTP responses).
• Context from your flow recordings or test scripts that you choose to provide to the agent.

House credits (default). When you use our managed credentials, the request goes through RobotActions' provider accounts. The provider receives the data described above and processes it under its terms (notably, Anthropic's Privacy Policy and Commercial Terms, OpenAI's Privacy Policy, and Google's Privacy Policy).

Bring-your-own keys (BYO). If you configure your own API key for an AI provider, the data goes directly to that provider under the account associated with your key. RobotActions does not act as an intermediary for the substantive content of those requests beyond what is needed to route the call.

We choose providers that contractually commit not to use commercial API inputs and outputs to train their general-purpose foundation models by default. Provider policies can change; you should review the linked provider policies before sending sensitive data.

4. Third-Party Processors

We rely on the following processors to deliver the Service. Each receives only what it needs for its role.

| Processor | Role | What it receives | Location | |---|---|---|---| | Auth0 (Okta, Inc.) | Authentication and user directory | email, name, hashed password, MFA factors, login metadata | United States | | Stripe, Inc. | Payment processing, tax calculation, invoicing | name, email, card details (collected by Stripe directly), billing address, transaction history | United States, Ireland | | Anthropic, PBC | AI inference (Claude) | prompts, agent transcripts, screenshots, page source — when you invoke Claude | United States | | OpenAI, L.L.C. | AI inference | prompts, agent transcripts, screenshots, page source — when you invoke OpenAI | United States | | Google LLC | AI inference (Gemini) | prompts, agent transcripts, screenshots, page source — when you invoke Gemini | United States | | Microsoft Corporation (Microsoft 365) | Transactional email delivery | recipient email, subject, message body | United States, Canada |

| GlitchTip (self-hosted) | Error monitoring | stack traces, browser metadata, error context | Currently Canada | | Cloudflare, Inc. | DNS, CDN, tunnel, DDoS protection | IP, request metadata, TLS termination | Global edge | | Microsoft Azure (future) | Infrastructure hosting | application data we process | TBD |

We sign data-processing agreements (DPAs) or equivalent terms with each processor, including obligations of confidentiality, security, sub-processing controls, and breach notification.

5. Data Residency and Cross-Border Transfers

5.1 Where data lives today

Our primary hosting today is in Canada (Quebec for the Mac Mini device fleets; Toronto and Montreal for application infrastructure where applicable). Stripe and the AI providers we support are based in the United States. Cloudflare operates globally.

5.2 Cross-border assessments

When personal information is transferred outside Quebec, we conduct a Transfer Impact Assessment under section 17 of the Quebec Privacy Act, evaluating:

• The sensitivity of the information.
• The purpose of the transfer.
• The legal framework in the receiving jurisdiction.
• The contractual and technical safeguards in place (encryption in transit, encryption at rest, DPAs, sub-processor controls).

We rely on standard contractual protections (including DPAs that incorporate clauses substantially equivalent to the EU Standard Contractual Clauses where relevant) and on the providers' own privacy programs.

5.3 Enterprise customers — EU or regional residency

We do not currently offer EU or regional data residency. Enterprise customers with regional-residency requirements should contact [email protected] to discuss options.

6. How Long We Keep Personal Information

| Category | Retention | |---|---| | Account data (email, name, role) | While your account is active, plus 90 days after closure, then deleted or anonymized — except where law requires longer retention | | Tenant configuration | While your account is active, plus 90 days after closure | | Billing and tax records | 6 years from the end of the relevant tax year, per Canadian federal and Quebec tax law (Income Tax Act, Excise Tax Act, Quebec Tax Administration Act) | | Stripe transaction history | Stripe retains under its own policy; we retain a reference copy for the same 6-year period as billing records | | Flow recordings, test artifacts, AI agent transcripts | While your account is active, subject to the storage settings in your tenant. No automatic purge is currently enabled. | | Audit logs | 24 months rolling | | Error and crash reports (GlitchTip) | 90 days rolling | | Support email | 24 months from last message in thread |

If you ask us to delete your account, we will delete or anonymize data on the retention timelines above, except where law requires us to keep it longer (notably billing and tax records).

7. Security

We protect personal information with:

• TLS 1.2+ for all data in transit, including device streaming and API traffic.
• AES-256-GCM encryption at rest for stored integration credentials and other secrets.
• Auth0-managed authentication, password storage, and MFA.
• JWT session cookies, scoped per tenant.
• Role-based access controls within tenants.
• Audit logging of administrative and billing actions.
• Internal access controls limiting who at RobotActions can access customer data, with logging.
• Vulnerability monitoring and regular dependency updates.

No method of electronic transmission or storage is 100% secure. If we detect or are notified of a security incident that affects your personal information and presents a risk of serious injury (as defined under PIPEDA and Law 25), we will notify you and the relevant authorities (in particular the Commission d'accès à l'information du Québec and the Office of the Privacy Commissioner of Canada) without unreasonable delay.

8. Your Rights

8.1 Rights available under Quebec Law 25 and PIPEDA

Subject to applicable law and the carve-outs in this Policy, you may:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete personal information.
• Delete your personal information (subject to carve-outs in §8.2).
• Portability — receive a copy of certain computerized personal information you provided to us, in a structured, commonly used technological format. (Law 25, in force since September 2024.)
• Withdraw consent to the processing of personal information; note that withdrawing consent for processing essential to the Service terminates your ability to use the Service.
• Object to certain automated decisions made exclusively on the basis of an automated processing of personal information, and request a human review of those decisions.
• De-indexation and cessation of dissemination — require us to stop disseminating your personal information, or to de-index any hyperlink attached to your name that gives access to that information by a technological means, where the dissemination contravenes the law or a court order, or where it causes you serious injury in relation to your right to reputation or privacy, that injury is clearly greater than the public's interest in knowing the information, and the cessation or de-indexation requested does not exceed what is necessary to prevent the perpetuation of the injury. (Law 25, section 28.1.)

8.2 Limits on deletion

We must retain certain records to comply with law, in particular:

• Billing and tax records (see §6, 6-year retention).
• Records we are legally required to preserve for ongoing investigations, audits, or legal proceedings.

8.3 How to exercise your rights

Email [email protected] from the email address associated with your account, or use the in-app "Privacy" controls when available. We will respond within 30 days as required by Law 25. We may need to verify your identity before fulfilling the request.

8.4 Right to complain

If you believe we have not handled your personal information appropriately, you may contact us first at [email protected]. You also have the right to file a complaint with:

• The Commission d'accès à l'information du Québec (CAI) — https://www.cai.gouv.qc.ca/.
• The Office of the Privacy Commissioner of Canada (OPC) — https://www.priv.gc.ca/.

9. Cookies and Similar Technologies

We use only strictly necessary cookies to operate the Service:

• An Auth0 session cookie to keep you signed in.
• A small number of preference cookies (theme, locale) on your browser.

We do not use:

• Third-party analytics cookies.
• Advertising or retargeting cookies.
• Cross-site tracking pixels.

Because we use only strictly necessary cookies and do not engage in profiling for advertising, we do not currently display a cookie-consent banner. If we ever add non-essential tracking, we will obtain prior consent in compliance with Law 25.

10. Children

The Service is not directed to children. We do not knowingly collect personal information from anyone under 14 without the consent of a parent or tutor as required by Quebec Law 25. Use of the Service by anyone under the age of majority (18 in Quebec) requires consent from a parent or tutor and must comply with our Terms of Service.

If you believe we have inadvertently collected personal information from a minor under 14 without proper consent, contact [email protected] and we will delete it.

11. International Transfers — Legal Basis

We transfer personal information to processors located outside Quebec and outside Canada, principally to the United States. For each such transfer, we rely on:

• Contractual safeguards with the processor (DPAs, confidentiality, security obligations, sub-processor controls, breach notification, and assistance with data-subject requests).
• Technical safeguards (encryption in transit and at rest, scoped access).
• Transfer Impact Assessments under section 17 of the Quebec Privacy Act, documented and reviewed periodically.

You may request a summary of our Transfer Impact Assessment for a specific processor by emailing [email protected].

12. Automated Decision-Making

Some Service features rely on AI agents that produce automated outputs. We do not use these systems to make decisions about you (for example, about whether to grant you service, set your price, or limit your account) based exclusively on automated processing of your personal information. Where automated tools flag accounts for review (for example, abuse detection), a human reviews the matter before any material action is taken against your account.

13. Person Responsible for the Protection of Personal Information

Under section 3.1 of the Quebec Privacy Act, the person at RobotActions responsible for the protection of personal information is:

Name: Krish Pavuluri Title: Founder & CEO, 9377-5146 Quebec Inc. (RobotActions) Email: [email protected] (dedicated [email protected] alias TBD before publishing) Mailing address: 9377-5146 Quebec Inc., Saint-Laurent, Quebec, Canada

14. Visitors and Customers in the European Economic Area and the United Kingdom

Where the GDPR or the UK GDPR applies to our processing, the following supplements the rest of this Policy.

Controller. 9377-5146 Quebec Inc. (RobotActions), Saint-Laurent, Quebec, Canada is the controller for the personal information described in §1.

Lawful bases. We rely on:

• Performance of a contract (Article 6(1)(b)) — account creation, tenant provisioning, device sessions, and billing.
• Legitimate interests (Article 6(1)(f)) — platform security, abuse prevention, and the telemetry in §1.5 used to keep the Service reliable, balanced against your rights and freedoms.
• Legal obligation (Article 6(1)(c)) — tax and accounting records.
• Consent (Article 6(1)(a)) — optional analytics cookies (§9) and marketing email. You may withdraw consent at any time.

Additional rights. Beyond §8.1, you may request restriction of processing and object to processing carried out on the basis of legitimate interests. Requests go to [email protected].

Transfers. Canada holds a partial European Commission adequacy decision covering commercial organisations subject to PIPEDA. Where a transfer is not covered by that decision, we rely on Standard Contractual Clauses with the processor concerned, together with the safeguards described in §5 and §11.

Complaints. You may lodge a complaint with your local supervisory authority, or with the Information Commissioner's Office in the United Kingdom, in addition to the authorities named in §8.4.

15. California Residents

We do not sell or share personal information as those terms are defined by the California Consumer Privacy Act, and we have not done so in the preceding twelve months. We do not knowingly collect the personal information of consumers under 16.

Where the CCPA applies, California residents may request to know the categories and specific pieces of personal information we have collected, request its deletion or correction, and are entitled not to be treated differently for exercising those rights. Requests go to [email protected]; we verify them against your account before acting.

16. Changes to This Policy

We may update this Privacy Policy from time to time. We will provide at least 30 days' prior notice of material changes by email to the address on your account and by posting in the Service. The "Effective" date at the top of this Policy reflects the most recent revision.

If you do not agree to a change, you may close your account before the effective date (see Terms of Service §6 regarding refund of unused credits).

17. Contact

9377-5146 Quebec Inc. (doing business as RobotActions) Saint-Laurent, Quebec, Canada Email: [email protected]

For complaints to a supervisory authority:

• Commission d'accès à l'information du Québec — https://www.cai.gouv.qc.ca/
• Office of the Privacy Commissioner of Canada — https://www.priv.gc.ca/

End of Privacy Policy. Section numbers are stable; future amendments should add subsections (for example, 6.2) rather than renumber.