Privacy Policy

QA Lead is operated by Anchorly LTD, registered in England & Wales (“we”, “us”, “our”). For privacy enquiries contact support@anchorly.co. We are the data controller for the personal data described below.

There are no forms on this site and nothing to sign up for. Page views and performance metrics come from Vercel Analytics, which is aggregated and cookieless — it sets no cookies, builds no cross-site profile and does not track you between websites. That runs whatever you choose below.

We advertise on Google. If you accept, we set Google Ads cookies so we can tell which advert led to a booking, and so Google can show our adverts to people who have visited this site. Those cookies are not set unless you accept them: the tag loads with every storage permission denied and only stores anything once you say yes. Reject is one click, exactly like accept, and nothing on the site behaves differently either way.

Your choice is kept in your browser’s local storage, not on our servers. To change it, clear this site’s data in your browser and the banner will ask again.

• Enquiry and booking data — your name, work email, company and whatever you choose to tell us when you email us or book a demo.
• Engagement data — during a pilot or a build, the material needed to do the work: your test cases, requirement documents, test data, repository access and the names and contact details of the people on your side we work with.
• System credentials — test-account and test-environment credentials, and read access to your test-management tools. See section 5.
• Site analytics — aggregated, cookieless page-view and Web Vitals data as described in section 2.
• Advertising data — only if you accepted cookies: a Google Ads identifier recording that a visit or a booking click followed one of our adverts, as described in section 2.

We do not collect special-category data, we do not buy contact lists, and we do not send marketing email to people who have not contacted us.

• Contract — to deliver the pilot, the build or the support hours you have engaged us for.
• Legitimate interest — to reply to enquiries, run and improve the practice, and keep basic aggregated analytics on this site.
• Consent — for the Google Ads cookies described in section 2, and nothing else. You can refuse, and refusing changes nothing about how the site works.
• Legal obligation — to meet tax, accounting and regulatory duties.

The work requires access to a test environment and, usually, read access to wherever your test cases and requirements live. We ask for the narrowest access that makes the work possible: test accounts rather than production accounts, read-only scopes where reading is enough, and short-lived credentials where your tooling supports them.

Credentials are stored in a secrets manager, never committed to a repository and never written to logs in plaintext. Encryption of credentials at rest is built into the console we hand over. At the end of an engagement you should revoke everything you issued us — we will ask you to, and we will confirm in writing once our own copies are destroyed.

We never ask for, and do not want, production customer data. If your test environment contains real personal data, tell us before the work starts so it can be anonymised or so a data-processing agreement can be put in place — in that scenario we would be acting as your processor, not as a controller.

The platforms we build use AI agents to draft test cases and investigate failures. Those agents run in your own deployment, authenticated with a provider API key issued from your company’s own provider account, on the material you point them at — so that processing is yours, on your infrastructure and your provider account, not ours. We do not ask for, and the platform does not use, credentials tied to an individual’s personal AI subscription. During a pilot, before the deployment is in your account, AI usage runs against our own API key and only against the material you have given us for that pilot.

Engagement records are kept for the duration of the contract plus six years, the UK statutory minimum for accounting records. Credentials are destroyed at the end of the engagement. Notes about prospects who do not go ahead are deleted within twelve months. Test cases, requirement documents and other material belonging to you are deleted on request at any time.

We do not sell your data. We share it only with the providers needed to operate the practice — website hosting and analytics (Vercel), advertising measurement (Google, only where you have accepted cookies), email, and accounting — each bound by its own data-processing terms. The current list is available on request. Some of these providers process data outside the UK; where they do, transfers rely on the UK International Data Transfer Agreement or an adequacy decision.

You can ask us to access, correct, delete, restrict or port your personal data, or object to processing. Email support@anchorly.co and we will respond within one month. You can also complain to the UK Information Commissioner’s Office (ico.org.uk).

We may update this policy as the practice evolves. Material changes affecting an active engagement will be sent to you by email.