Privacy
What Cettara collects, who else it gets to, how long it’s kept for and what deletion actually does.
Last updated 15 October 2026
We hold your application’s data, not only your account
Most services you sign into hold facts about you. Cettara also holds evidence captured from your own app: a run drives your app in a real browser and records video, screenshots and execution trace of what happened.
So we are processor of your data as well as service you log into. You decide what to point a run at; we process it on your instructions and for no other reason. Use staging environment with representative rather than real data where possible.
What we collect
| What | Why | How long |
|---|---|---|
| Your email address and name (older accounts may also hold a country and job title given at signup) | To identify you and to address you | While the account exists |
| Password (hashed) and two-factor secrets | Sign-in | While the account exists |
| Sign-in sessions: IP address, browser and operating system, timestamps | To show you where you are signed in, and to let an owner end a session | Until the session expires or is ended |
| Evidence from your runs: video, screenshots, execution traces | To show what happened in a test, and to support a verdict | 30 days to 7 years, by plan |
| Test cases, runs, verdicts, comments and reports | They are the product | For the life of the organization |
| Audit events: who did what, from which IP address | A tamper-evident record of access and change | 12 months |
| Credentials you save for an environment | So a run can sign in to your application | Until you delete them — encrypted, and never shown again after saving |
| Support conversations | To answer you | For the life of the organization |
| Billing records: plan, seats, AI credits used, invoices | To charge you and to answer a question about a charge | For the life of the organization |
| Payment notifications from Polar, which include your billing email and billing details | To keep your plan and charges in step with payments | Not deleted automatically, including when the organization is deleted |
We don’t use advertising cookies and we don’t sell your data to anyone. The cookies we set are the session cookie and two that remember which project and organisation you were last in.
Subprocessors
These are the companies that process your data on our behalf and what exactly each one gets. We will publish a change here before we add another.
| Who | What for | What they receive | Where |
|---|---|---|---|
| Anthropic | Judging checkpoints and answering visual conditions | A PNG screenshot of your application at that moment, the text and controls visible on the page, the step text and the expectation written by your team. One call per checkpoint or visual condition, plus occasional re-runs of graded verdicts (text only, no screenshot) to measure how accurate the judge is. | United States |
| Polar | Merchant of record — checkout, invoicing and tax | Your billing email and whatever you enter at their checkout. Card details go to Polar and never reach us; we store an opaque customer id. | United States |
| Hosting provider | Hosting for the application, the worker and the database | Everything the product stores, as the infrastructure it runs on. | — |
| Object storage provider | Evidence files — video, traces and screenshots | The evidence a run captures from your application. | — |
| Resend | Transactional email | The recipient address and the message body: sign-in codes, invitations, password resets, email address change confirmations, and notifications about comments and support replies. | United States |
| Sentry | Error monitoring | Details of an error and its technical context, such as the page or request that failed and the browser, with personal data filtered out before it is sent: no cookies, no request bodies and no session recordings. | United States |
| Plausible | Website analytics, only if you allow analytics | Page views and anonymous events on our public pages, without cookies. | European Union |
How it is protected
- Passwords are stored as bcrypt hashes of the password plus a secret held outside the database so that a leaked database alone cannot be attacked offline.
- Sessions only store a hash of the token. A leaked database cannot be replayed as live session.
- Environment credentials are encrypted at rest with AES-256-GCM, scoped to one environment and never shown again after saving — not to your own team, not to our staff.
- The audit log is tamper-evident because the database role that the application connects as enforces it. Our code cannot rewrite it.
- Each audit event has the hash of the one before it so an edit or a delete in the middle breaks every hash after it. The chain is verified whenever the audit log page is opened.
- The evidence files are identified by their SHA-256 and the hash is in reports so an exported report can be checked against the files.
How long we keep things
Evidence retention is a plan feature. Verdicts, reasoning and hashes are all retained regardless so that a report is still verifiable after the video expires. When someone grades a verdict, a copy of the text it was judged on is kept with the grade for as long as the organization exists.
| Plan | Evidence kept |
|---|---|
| Free | 30 days |
| Team | 90 days |
| Business | Configurable, up to 7 years |
Audit events are kept for 12 months then pruned by age. Pruning is by age only (not selectively) so a verified chain can legitimately start above its first entry.
Deletion, and what it actually does
An owner can delete their organization from Settings. The subscription is cancelled at once, and after a 30-day grace period (any owner can cancel during this time and everything still works) its projects, test cases, runs, evidence and memberships are removed. Your personal account (email, name and sign-in details) is not removed by an owner’s deletion; ask us if you want it deleted. When we delete an organization ourselves it takes effect at once and also removes the accounts of members who belong to no other organization.
What remains is a record of actions: who did what when and from which address. It contains no evidence files nor test content. If you need something else deleted sooner or you want an export first ask us and we will tell you honestly what can be done rather than what’s convenient.
An owner can export the organization’s test cases, runs, verdicts, evidence index with hashes and audit log as a file at any time without asking us. The files themselves are not included, and a section longer than 50,000 rows is cut short with a note saying so. Taking an export is itself audited event.
Your rights
You can see what we hold, correct it, export it and delete it. Most of this you can do yourself from the product — your profile, your org settings and above export. To delete your personal account, or for anything else, write to us and we will answer.
Where you’re not our customer — your data was collected because somebody tested an application you use — then your relationship is with them. Ask them and we’ll help them answer you.
Contact
Signed-in customers can reach us from the support page inside the product (this is fastest route because it carries context).