Privacy Policy

QA Lead is operated by Anchorly LTD, registered in England & Wales (“we”, “us”, “our”). For privacy enquiries contact support@anchorly.co. We are the data controller for the personal data described below.

There are no forms on this site and nothing to sign up for. We use Vercel Analytics for page views and performance metrics, which is aggregated and cookieless — it sets no cookies, builds no cross-site profile and does not track you between websites. That is why you are not being asked to accept anything.

• Enquiry and booking data — your name, work email, company and whatever you choose to tell us when you email us or book an intro call.
• Engagement data — during a pilot or a build, the material needed to do the work: your test cases, requirement documents, test data, repository access and the names and contact details of the people on your side we work with.
• System credentials — test-account and test-environment credentials, and read access to your test-management tools. See section 5.
• Site analytics — aggregated, cookieless page-view and Web Vitals data as described in section 2.

We do not collect special-category data, we do not buy contact lists, and we do not send marketing email to people who have not contacted us.

• Contract — to deliver the pilot, the build or the support hours you have engaged us for.
• Legitimate interest — to reply to enquiries, run and improve the practice, and keep basic aggregated analytics on this site.
• Legal obligation — to meet tax, accounting and regulatory duties.

The work requires access to a test environment and, usually, read access to wherever your test cases and requirements live. We ask for the narrowest access that makes the work possible: test accounts rather than production accounts, read-only scopes where reading is enough, and short-lived credentials where your tooling supports them.

Credentials are stored in a secrets manager, never committed to a repository and never written to logs in plaintext. Encryption of credentials at rest is built into the console we hand over. At the end of an engagement you should revoke everything you issued us — we will ask you to, and we will confirm in writing once our own copies are destroyed.

We never ask for, and do not want, production customer data. If your test environment contains real personal data, tell us before the work starts so it can be anonymised or so a data-processing agreement can be put in place — in that scenario we would be acting as your processor, not as a controller.

The platforms we build use AI agents to draft test cases and investigate failures. Those agents run in your own deployment, authenticated with a provider API key issued from your company’s own provider account, on the material you point them at — so that processing is yours, on your infrastructure and your provider account, not ours. We do not ask for, and the platform does not use, credentials tied to an individual’s personal AI subscription. During a pilot, before the deployment is in your account, AI usage runs against our own API key and only against the material you have given us for that pilot.

Engagement records are kept for the duration of the contract plus six years, the UK statutory minimum for accounting records. Credentials are destroyed at the end of the engagement. Notes about prospects who do not go ahead are deleted within twelve months. Test cases, requirement documents and other material belonging to you are deleted on request at any time.

We do not sell your data. We share it only with the providers needed to operate the practice — website hosting and analytics (Vercel), email, and accounting — each bound by its own data-processing terms. The current list is available on request. Some of these providers process data outside the UK; where they do, transfers rely on the UK International Data Transfer Agreement or an adequacy decision.

You can ask us to access, correct, delete, restrict or port your personal data, or object to processing. Email support@anchorly.co and we will respond within one month. You can also complain to the UK Information Commissioner’s Office (ico.org.uk).

We may update this policy as the practice evolves. Material changes affecting an active engagement will be sent to you by email.