Privacy policy

The controller of personal data processed through the Tiora service at tiora.cz is the operator of Tiora. You can contact us at info@tiora.cz.

If you use Tiora in a company or team workspace, your workspace owner may also act as an independent controller for the QA content that team members enter.

Account data includes your email address and display name. We also store your language and theme preferences, sign-in timestamps and any profile photo you upload. If you sign in with Google, we may use the profile photo provided by Google.

Workspace data: workspace and project names, memberships, roles, invitations, tests, test runs, results, defects, comments, labels and failure screenshots you upload.

Billing data: Stripe customer and subscription identifiers, plan, payment status and invoices. Card details are handled by Stripe and are not stored by Tiora.

Technical data: IP address, browser and device information, request identifiers and security logs needed to run and protect the service.

We process account, workspace and service data to perform the contract when you create an account and use Tiora (GDPR Art. 6(1)(b)).

We process security logs, fraud prevention and product usage measurements that never include QA content on the basis of legitimate interests in running a reliable product (Art. 6(1)(f)).

We keep the minimum billing records required by tax and accounting law (Art. 6(1)(c)).

We use processors under written contracts: Vercel (hosting, delivery and optional first-party analytics/speed insights), Supabase (database and private object storage for screenshots), Stripe (payments and tax collection), Resend (transactional email such as sign-in codes and invitations), Google (optional Google sign-in) and PostHog Cloud EU (operator product analytics of allowlisted usage events, never QA content).

These providers only receive the data needed to provide their service.

We use a session cookie to keep you signed in. A language cookie stores your choice of English or Czech. Your theme preference is stored in local storage. These are necessary or functional.

If Vercel Analytics or Speed Insights is enabled, it may collect aggregated, cookieless or first-party usage measurements. If PostHog exception capture is enabled in production, it may store a first-party analytics cookie tied only to your account ID, not your email. It does not use autocapture, session replay or advertising cookies. We do not sell personal data.

We keep account and workspace data while your account or workspace is active. When an owner deletes a project or workspace, it first enters a thirty-day recovery window, then domain content and private screenshots are permanently removed.

We keep the minimum billing and invoice records required by law after a subscription ends. Security logs are kept only as long as needed to investigate incidents.

We do not sell personal data. We share data with processors listed above and teammates you invite to a workspace. We may also share it when required by law or to protect the service.

Public API and MCP connectors only expose workspace data to applications you authorize, within the scopes you grant.

Some processors may process data outside the Czech Republic or the EEA, including the United States. Where that happens, we rely on an adequacy decision or Standard Contractual Clauses and complementary safeguards.

You may request access, rectification, erasure, restriction, portability or objection. You may also withdraw consent where processing is based on consent. Use info@tiora.cz or the in-product account and workspace deletion flows where they apply.

You may lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ) or another EU supervisory authority where you live or work.

We restrict access by workspace membership, store failure screenshots in a private bucket, redact customer content from operational logs and use HTTPS in production. No method of transmission or storage is completely secure.

Tiora is a professional QA tool. It is not directed at children under 16, and we do not knowingly collect their personal data.

We will update this page when our practices change in a material way and revise the date above. Continued use after the update means you have had the chance to review the new policy.

Email info@tiora.cz. If you have a Tiora account, include the email address you use to sign in so we can identify your request.