Privacy Policy for PaloQA Chrome Extension

1. Executive Summary & Core Principles

• Local-First Sandbox Architecture: PaloQA processes and stores all recorded tests, scripts, visual regression baselines, and API logs 100% locally inside your Chrome browser sandbox (chrome.storage.local and IndexedDB).
• No Central Analytics or Trackers: We do NOT run tracking scripts, Google Analytics SDKs, or third-party telemetry inside the extension.
• No Data Monetization: We NEVER sell, rent, trade, or monetize any user data, network traffic, website content, or keystrokes to any third party under any circumstances.
• Zero AI Training on Private Code: Your test scripts, DOM trees, internal URLs, and application payloads are never used to train public or commercial AI foundational models.

2. Categories of Data Processed, Purpose, and Handling

A. User Activity Data (Keystrokes, Clicks, Hover Events)

• Data Collected: Clicks, typing actions, scroll position, and form field interactions.
• How It Is Collected: Captured temporarily only when you explicitly click "Record Flow".
• Purpose & Usage: To assemble reproducible, automated end-to-end browser test plans.
• Sensitive Inputs Exclusion: Password fields, CVVs, and sensitive input fields are automatically redacted at capture time. Passwords are never logged or stored on disk.
• Sharing: Processed locally and NEVER shared with external third parties.

B. Website Content & DOM Data (HTML Elements, Text Nodes, Screenshots)

• Data Collected: Visible text nodes, DOM element selectors, CSS class names, and webpage viewport screenshots.
• Purpose & Usage: To execute test steps, locate interactive elements during playback, assert expected page states, and generate visual regression diff reports.
• Sharing: Saved locally in browser storage. When using optional AI Test Plan Generation or AI Self-Healing features, sanitized DOM element maps and screenshots are sent to your chosen third-party AI LLM provider as detailed in Section 4.

C. Network Traffic & API Metadata (XHR / Fetch Interception)

• Data Collected: HTTP request/response methods, headers, status codes, query parameters, latency durations, and JSON payload bodies.
• How It Is Collected: Intercepted strictly via Chrome's secure Developer Tools Protocol (chrome.debugger API) during active audit sessions.
• Purpose & Usage: To validate live API contract schema drifts against OpenAPI/Swagger specifications and Postman Collections.
• Sharing: Processed 100% locally. API traffic and authentication headers are NEVER transmitted to external analytics servers or third-party databases.

D. User Settings & API Credentials

• Data Collected: User preferences, target test URLs, execution concurrency limits, and user-provided LLM API Keys (Google Gemini API Key, Anthropic API Key, NVIDIA NIM API Key).
• Storage & Handling: API keys and preferences are stored exclusively inside Chrome's secure, sandboxed storage (chrome.storage.local). They are encrypted by browser security and never stored on any remote cloud server maintained by PaloQA.

3. Data Storage, Security, and Retention

• Storage Mechanism: All saved test plans, recordings, visual baselines, and configuration templates are stored locally on your device within Chrome's isolated Extension Storage Sandbox (chrome.storage.local) and browser IndexedDB.
• Data Retention: Data remains stored locally on your device for as long as you use the Extension.
• How Users Can Delete Their Data:
  1. Click "Reset Data" inside the PaloQA Extension Settings screen.
  2. Clear extension data via chrome://extensions > PaloQA > Storage > Clear Data.
  3. Uninstalling the PaloQA Chrome Extension instantly and permanently purges 100% of stored local data and databases from your computer.

4. Disclosure of Data Sharing & Third-Party Service Providers

PaloQA adheres to a strict zero-advertising disclosure policy. We do not sell, rent, or lease personal information or test data. Third-party data interactions are strictly limited to the following essential infrastructure and optional user-initiated features:

4.1. Core Infrastructure & Cloud Sub-Processors

4.2. Optional AI LLM Providers (User-Initiated Only)

When you explicitly trigger the Natural Language AI Test Composer or AI Self-Healing Selectors, natural language instructions and sanitized DOM element maps are dispatched directly from your browser to your selected AI provider:

Important AI Data Protection Safeguards:

• Automatic Secret & Auth Sanitization: Bearer tokens, cookies, authorization headers, passwords, and credit card patterns are automatically stripped and masked before DOM context is sent to any AI provider.
• Direct Browser-to-API Calls: AI requests travel directly from your local browser to the provider's official HTTPS endpoint. PaloQA operates zero intermediary man-in-the-middle proxy servers.
• Zero Model Training: Under commercial enterprise API agreements with Google, Anthropic, and NVIDIA, data sent via API is NOT used to train or fine-tune public foundation models.
• No Ad Networks or Data Brokers: User data is NEVER shared with advertising networks, data brokers, data resellers, or credit scoring agencies.

5. User Rights & Regulatory Compliance (GDPR & CCPA)

Regardless of your geographic location, PaloQA affords all users comprehensive data rights:

• Right to Access & Portability: You can export 100% of your recorded tests, network audit logs, and visual regression benchmarks at any time into standard Playwright, Cypress, or JSON files.
• Right to Erasure (“Right to be Forgotten”): You can permanently delete all local data by clicking “Reset Data” in the extension or uninstalling the extension. For cloud accounts, you can permanently delete your user profile and all cloud test records from the Web Dashboard or by emailing hello@palosite.com.
• Right to Rectification: You may update your profile details and API keys at any time directly through the user interface.
• Non-Discrimination: We will not deny services, charge different prices, or provide a different quality of service if you exercise your privacy rights.

6. Compliance with Chrome Web Store User Data Policies

PaloQA strictly adheres to the Google Chrome Web Store Developer Program Policies, including the Limited Use requirements:

• Single Purpose: All requested permissions (activeTab, storage, sidePanel, tabs, debugger, scripting) are strictly necessary to deliver local browser automation and QA testing features.
• Limited Use: PaloQA's use and transfer of information received from Google APIs to any other app adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.
• No Advertising Use: We do not use or transfer user data for personalized, targeted, retargeted, or behavioral advertising.
• No Human Inspection: We do not allow human staff or contractors to read user data unless required for security incidents or legally compelled under applicable law.

7. Children's Privacy Compliance (COPPA & GDPR-K)

PaloQA is a professional software developer and QA engineering tool. Our services are not directed at, intended for, or designed to attract children under 13 years of age (or under 16 in the EEA/UK). We do not knowingly collect, store, or solicit personal data from children.

8. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect new features or legal requirements. Any updates will be published with an updated "Last Updated" date at the top of this policy document and made accessible at https://paloqa.palosite.com/privacy.html.

9. Contact Information & Official Support Channels

If you have any questions, concerns, feedback, or GDPR/CCPA data erasure requests regarding this Privacy Policy, please contact our dedicated team:

• Official Support Email: hello@palosite.com (Direct human support team; response SLA: 24–48 hours)
• Web Platform & Help Desk: https://paloqa.palosite.com
• Parent & Technology Partner: https://palosite.com
• Privacy & Security Inquiries: hello@palosite.com (Subject: PaloQA Privacy Inquiry)