Privacy Policy

This Privacy Policy explains how Licklider SpA (a company organized under the laws of Chile, "Licklider," "we," "us," or "our") collects, uses, discloses, and protects information in connection with Greentest, including the web application at app.greentest.ai, the website at greentest.ai, the Greentest API, CI/CD integrations, the Greentest MCP server, the Greentest E2E runner, the Greentest Recorder browser extension, and related services (collectively, the "Services").

1. Scope and roles

Greentest is a business-to-business service used by organizations ("Customers") and their authorized users. Two different roles apply depending on the data:

• Customer Content. Test suites, test cases, results, evidence, files, API collections, environments, E2E tests, comments, backlog items and any other content that users upload or create in a Customer's organization is processed by us on behalf of the Customer, as a "service provider" or "processor." The Customer controls that data and its agreement with us governs it. If you are a member of an organization and have questions about its content, please contact your organization's administrator.
• Account, website and operational data. For information such as account registration details, sign-in data, security logs, and communications with us, Licklider acts as the business (or "controller") and this Policy applies directly.

2. Information we collect

2.1 Information you provide

• Account information: username, full name, email address, and password (stored only as a salted hash). Optionally: country, time zone, avatar color, and an "About me" bio.
• Organization information: organization name and description, billing email, membership and role (owner, admin, member), invitations you send (invitee email addresses), and document branding (logo, color and footer text).
• Customer Content: everything you or your teammates create or upload, including manual test suites and cases, execution results and notes, screenshots, photos, videos and other evidence, project files, spreadsheets imported into Greentest, generated test plans, API requests, collections, environments and variables, API responses and run history, Playwright test code, E2E execution reports, traces and videos, Scrum/Kanban items, and comments.
• Guest testers: when a member creates a guest link for user-acceptance testing, the guest's display name (entered by the member) and any results, notes, photos or videos the guest submits are stored as Customer Content.
• Communications: information you send when you contact us for support, sales or legal matters.

2.2 Information from third parties

• Sign in with Google: if you choose to sign in with Google (via Google Firebase Authentication), we receive your name, email address, whether your email is verified, and a unique Google account identifier. We do not receive your Google password, and we do not keep a Google session in your browser after you sign in. See Section 5.
• Integrations you configure: CI/CD pipelines that upload CTRF or JUnit test reports with an API token, and AI assistants or tools you connect through the MCP server or OAuth, send us the data you direct them to send.

2.3 Information collected automatically

• Security and audit logs: for actions that change data, sign-ins (successful and failed) and sign-outs, we record the user or token, organization, action, affected resource, HTTP status, IP address, user agent (browser and device type) and timestamp.
• Server logs: standard web server and application logs (request path, timing, errors). Secrets such as guest-link tokens are redacted from logs.
• Session data: strictly necessary cookies and local storage described in Section 8.

We do not use third-party advertising, behavioral tracking, session-recording or product-analytics tools in the Services. The Greentest application serves its own fonts; our public website (greentest.ai) loads typefaces from Google Fonts, so Google receives your IP address and browser information when you visit it (see Section 7).

3. How we use information

• Provide, operate and maintain the Services, including creating accounts, authenticating users, running API and E2E tests you request, and generating the reports, notifications and webhooks you configure.
• Send transactional emails such as account activation, invitations, password resets and service notices.
• Secure the Services: detect and prevent fraud, abuse and unauthorized access; enforce rate limits; maintain audit trails; and investigate incidents.
• Provide support and respond to your requests.
• Maintain, debug and improve the Services, using aggregated or de-identified information where possible.
• Comply with legal obligations and enforce our Terms of Service.

We process Customer Content only to provide the Services to the Customer, as instructed by the Customer, and as required by law.

3.1 Legal bases

Where the law requires a legal basis for processing (for example, Chilean Law No. 19,628 as amended by Law No. 21,719), we rely on:

• Performance of a contract with you or your organization: creating and operating your account, providing the Services, transactional emails and support.
• Legitimate interests that do not override your rights: securing the Services, audit logs, preventing abuse, and maintaining and improving the Services.
• Compliance with legal obligations: tax, accounting, responding to authorities and handling data-protection requests.
• Consent: optional features that you choose to use, such as Sign in with Google and marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

We do not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects on you.

4. AI features

Some optional features use third-party large language model (LLM) providers:

• Spreadsheet import (converting Excel/CSV files into manual test suites),
• Test plan generation (drafting a test plan document from project content), and
• Failure analysis (analyzing failed results in a test cycle).

When you use these features, the relevant Customer Content (for example, spreadsheet contents, project and suite information, or failed-test details) is sent to OpenAI or Anthropic through their commercial APIs solely to generate the requested output. These providers act as our subprocessors and, under their commercial API terms, do not use API data to train their models. We do not use your Customer Content to train AI models. AI output can be inaccurate; please review it before relying on it.

If you connect your own AI assistant (for example, Claude or Cursor) to Greentest through the MCP server, data you retrieve is delivered to that assistant at your direction and is governed by that provider's terms and privacy policy, not this Policy.

5. Google user data

If you sign in with Google, Greentest requests only basic profile scopes (name, email address, and Google account identifier) to create and authenticate your account. We use this information solely to sign you in, to link your Google identity to your Greentest account, and to display your name and email within the Services. We do not request access to Gmail, Google Drive, Calendar or other Google data.

Greentest's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, use it for advertising, or use it to train AI models, and humans do not read it except as necessary for security, to comply with law, or with your consent.

6. Greentest Recorder browser extension

The Greentest Recorder extension for Chrome and Edge is used to record end-to-end tests and to attach evidence to test cases. It operates only when you start it:

• Recording: while you record, the extension captures your interactions with the tab you chose (navigation, clicks, typed text, selections and key presses) and converts them into a Playwright test. Values typed into password fields are never captured; they are replaced with an environment-variable placeholder.
• Evidence: when you click to capture, the extension takes a screenshot (PNG) or records a video (WebM, up to 60 seconds) of the active tab and uploads it to the test case you select.
• Permissions: site access is requested per origin, only for your Greentest server and for the application you choose to record.
• Storage: the server address, OAuth client details and access tokens are stored locally in your browser (chrome.storage.local). The extension never asks for or stores your Greentest password; signing out revokes the grant.
• Recorded tests and evidence are sent only to your Greentest organization over HTTPS. The extension does not collect browsing history, does not run in the background on other sites, and does not send data to any third party.

The use of information received by the extension complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.

7. How we share information

We do not sell personal information and we do not "share" it for cross-context behavioral advertising. We disclose information only as follows:

• Within your organization: other members of your organization can see your name, username, avatar, bio and the content and activity you contribute, according to their roles and project access.
• Service providers (subprocessors) that process data on our behalf under contractual confidentiality and security obligations:

• Integrations you enable: when your organization configures webhooks (for example, to Slack, Microsoft Teams or Mattermost), CI tokens, the MCP server or connected apps, we send the selected data to those destinations at your direction.
• Legal and safety: when we believe in good faith that disclosure is required by law, subpoena or other legal process, or is necessary to protect the rights, property or safety of Licklider, our users or others.
• Business transfers: in connection with a merger, acquisition, financing or sale of assets, subject to this Policy's protections.
• With your consent or at your direction.

8. Cookies and local storage

Greentest uses only strictly necessary cookies and browser storage:

If you use Sign in with Google, Google may set its own cookies during the sign-in window under Google's privacy policy. Greentest keeps the Firebase sign-in session in memory only and ends it as soon as your sign-in is verified; nothing from it is stored in your browser. We do not use advertising or analytics cookies. Because we do not track you across third-party sites, we do not respond differently to "Do Not Track" signals; we honor Global Privacy Control (GPC) signals as an opt-out of sale or sharing, although we do not sell or share personal information.

9. Data retention

• Account and Customer Content: retained for as long as the account or organization is active. Customers can delete projects, suites and other content at any time; owners can delete their organization.
• Account closure: when you close your account from your profile, it is deactivated immediately and your sessions are revoked. You may request permanent deletion of your personal information by contacting us (Section 12); we will delete or de-identify it within 30 days, except where retention is required by law or the information is part of an organization's Customer Content controlled by that organization.
• Audit logs: 180 days, then automatically purged.
• E2E evidence (screenshots, videos, traces): 30 days by default, then automatically purged.
• Backups: encrypted database backups are kept for 30 days and then deleted on a rolling basis.
• Unused OAuth clients and expired tokens: purged after 30 days.

10. Security

We use administrative, technical and physical safeguards designed to protect information, including TLS encryption in transit; encryption of storage volumes and backups at rest; salted password hashing; storing only hashes of API tokens and guest links; an encrypted vault for E2E secrets; strict organization-level data isolation; role-based access controls; rate limiting; audit logging; and restricted, keyless administrative access to production. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we learn of a security breach affecting your personal information, we will notify you and the relevant authorities (including, in Chile, the Personal Data Protection Agency) as required by applicable law.

11. International transfers

Licklider is based in Chile and the Services are hosted in the United States. By using the Services, your information will be transferred to, stored and processed in the United States and other countries where our service providers operate, which may have data protection laws different from those of your country. Where required, we rely on appropriate safeguards for these transfers, such as contractual clauses with our providers that require a level of protection equivalent to that of this Policy, including the safeguards required by Chilean law for transfers to countries without an adequacy determination.

12. Your rights and choices

• Access and correction: you can view and update your profile information at any time in the app.
• Account closure: you can close your account from your profile.
• Connected apps and tokens: you can review and revoke connected apps (including the browser extension and AI assistants) under Security → Connected apps.
• Emails: transactional emails are necessary to operate the Services. We do not send marketing emails without your consent, and every marketing email includes an unsubscribe link.
• Requests: to request access to, a copy of, correction of, or deletion of your personal information, email privacy@greentest.ai. We will verify your identity before responding and respond within 30 calendar days, which we may extend once by up to 30 more days (or longer where the law of your place of residence allows) if we tell you why. Requests are free of charge. If your request concerns Customer Content, we may refer you to the relevant organization.

Depending on where you live, you may also have the right to object to or restrict certain processing, to data portability, and to lodge a complaint with your local data protection authority.

13. Chile

Licklider SpA is the data controller ("responsable") for the account, website and operational data described in Section 1, under Chilean Law No. 19,628 on the Protection of Private Life, as amended by Law No. 21,719 (in force from December 1, 2026). For Customer Content, the Customer is the controller and we act as its processor ("encargado").

• Controller: Licklider SpA, Santiago, Chile. Contact: privacy@greentest.ai.
• Your rights: access, rectification, erasure ("supresión"), objection, portability and temporary blocking of your personal data, and not to be subject to decisions based solely on automated processing. You may exercise them free of charge by writing to privacy@greentest.ai; we respond within 30 calendar days, extendable once by up to 30 more days.
• Complaints: if you are not satisfied with our response, you may file a complaint with the Personal Data Protection Agency (Agencia de Protección de Datos Personales) once it is operational, or bring the actions available before the Chilean courts.
• Security incidents: we will report breaches that create a reasonable risk to your rights to the Agency and, where required, to you, without undue delay.
• International transfers: see Section 11.

14. U.S. state privacy rights

Residents of California and other U.S. states with comprehensive privacy laws (including Colorado, Connecticut, Virginia, Utah, Texas, Oregon and others) may have the right to: (a) know what personal information we collect, use and disclose; (b) access and receive a portable copy of it; (c) correct inaccuracies; (d) delete it; and (e) opt out of its sale, its sharing for cross-context behavioral advertising, targeted advertising, and certain profiling. You also have the right not to receive discriminatory treatment for exercising these rights.

Notice at collection (California). In the preceding 12 months we have collected the following categories of personal information, for the business purposes described in Section 3, from the sources described in Section 2, and disclosed them only to the recipients described in Section 7:

We do not collect sensitive personal information for the purpose of inferring characteristics about you. We do not sell or share personal information and have not done so in the preceding 12 months, and we have no actual knowledge of selling or sharing the personal information of consumers under 16. To exercise your rights, email privacy@greentest.ai. You may use an authorized agent, and if we deny your request you may appeal by replying to our decision.

15. Children

The Services are intended for business use and are not directed to children. We do not knowingly collect personal information from anyone under 16 years of age (or under 13 in accordance with the U.S. Children's Online Privacy Protection Act). If you believe a child has provided us with personal information, contact us and we will delete it.

16. Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will notify you by email or through the Services before the changes take effect. The "Last updated" date above shows when this Policy was last revised.

17. Contact us

Licklider SpA
Santiago, Chile
Privacy inquiries: privacy@greentest.ai
Website: greentest.ai

This Policy is published in English and Spanish. For users residing in Chile the Spanish version prevails; in all other cases, the English version prevails in the event of any discrepancy.