Privacy policy

Last updated: 10 November 2026

This policy explains how QA Harness ("we", "the service"), operated by EziCode, handles personal data and Google user data. Contact: damianosdev@gmail.com.

Data we access

• Sign-in. When you sign in with Google we receive your Google account identifier, email address, name and profile picture (scopes openid, email, profile). We use them to identify your account and show who did what in your organization.
• Google Drive, when a project connects it. With drive.file, QA Harness creates files and folders for the project's test evidence and reads only the files it created or that you pick with the Google Picker. With drive.readonly, used only when a project chooses read-only access to existing documents, QA Harness reads the files the project registers as sources, such as requirement or test workbooks. We store the file identifiers, names and links that the project uses, not copies of your whole Drive.

How we use Google user data

We use Google user data only to provide and improve the user-facing features described above: signing in, storing and showing test evidence, and reading the documents a project chose to work with. QA Harness's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, do not use it for advertising, and do not use it to train generalized AI or machine learning models. People at EziCode do not read it unless you ask us to for support, it is needed for security or abuse investigation, or the law requires it.

AI features

When your organization enables AI agents, content from your project, which may include text from documents a project connected, is sent to the AI model provider your organization configured, only to perform the task you requested. That provider may not use it to train its models under our agreement with it.

Storage and protection

• OAuth tokens and other credentials are encrypted at rest with envelope encryption and are never shown again after they are saved.
• Each organization's data is isolated from other organizations at the database level.
• Access by people and AI agents is limited by roles and approvals, and recorded in an audit log.

Sharing

We share data only with the subprocessors needed to run the service (hosting, email delivery and the AI model provider your organization configured), when you direct us to (for example, publishing a defect to your issue tracker), or when the law requires it.

Retention and deletion

We keep data while your organization uses the service. Revoking a Google connection in QA Harness deletes its stored tokens; you can also remove access at myaccount.google.com/permissions. To delete your account or your organization's data, contact us at the address above; we complete deletion within 30 days, except records we must keep by law.

Changes

We will post changes to this policy on this page and update the date above.