Privacy Policy

Operio AI Inc. (“Operio,” “we,” “us”) provides AI-assisted testing of web and mobile applications through www.operio.run and app.operio.run, including APIs, CLI, MCP connections and integrations. This Policy explains what personal information we handle, why we use it, and how to exercise privacy rights.

For accounts, billing, website analytics and support, Operio generally acts as a data controller or equivalent. For personal information inside systems, environments or test data that business customers choose to test, the customer generally determines the purposes and Operio acts as a processor or service provider. Roles depend on applicable law; an agreed DPA governs processing within its scope.

Account and commercial data: business names, contact details, team members and permissions, login identifiers, selected plans, invoices, subscription status, Included Credits, usage counters, On-Demand activation, spending caps and charges; and electronic agreement records identifying the accepting user and organization, acceptance date and time, Terms version, and Privacy Policy acknowledgment and version where presented. Payment processors handle full payment-card information; Operio generally receives billing references and limited card details such as brand and last four digits.

Customer testing data: URLs, test instructions and prompts, test cases, dedicated test credentials, API and integration tokens, uploaded mobile builds, application interactions, screenshots, video, logs, diagnostic messages, reports and AI-generated findings. This material may contain personal or confidential information shown by the application under test.

Operational data: IP address, browser and device data, approximate IP-derived location, authentication and audit logs, feature usage, security events, support requests, cookies and information supplied through customer-authorized integrations.

We process data to provide and secure accounts; perform automated testing; operate AI agents, browsers and mobile test environments; preserve test evidence; deliver reports and integrations; administer monthly plans, Included Credits and authorized On-Demand charges; provide support; document agreement acceptance and policy acknowledgments; prevent abuse; comply with law; and improve Service reliability. We may use aggregated, non-identifying telemetry to maintain and improve the platform. We do not sell Customer Data or personal information.

Where a legal basis is required, we rely on a basis appropriate to the purpose and law, such as contractual necessity, legal obligations, legitimate interests in service security and improvement, or consent when required. Where marketing communications are sent, applicable opt-out rights are provided.

To perform a requested test, AI services may process prompts, screen content, test instructions, logs and other context needed to navigate the application and generate findings. Approved providers may receive relevant context to provide those functions, under appropriate safeguards. This operational processing is not, by itself, training.

Neither Operio nor its AI service providers use Customer Data or Customer-specific outputs—including prompts, credentials, screenshots, recordings, logs and test evidence—to train, fine-tune or otherwise update AI or machine-learning models under any circumstances, including with Customer consent. We may use aggregated, non-identifying operational analytics for service reliability, security and product improvement, but not for training AI models.

Test reports may contain screenshots, recordings, application responses, logs and other potentially sensitive information from the test environment. When a Customer chooses to share a test report through a public link, anyone holding the active link may access the shared report and related evidence without signing in until access is revoked.

Customers should review the content they choose to share, use masked or synthetic data when practical and revoke access when sharing is no longer needed. Operio remains responsible for its own applicable privacy and security obligations.

Information may be disclosed to authorized users in the Customer’s team; providers supporting cloud hosting, remote browser and mobile testing, AI inference, payments, analytics, communications and support; Customer-enabled integrations; and recipients holding active links to reports the Customer has chosen to share. We may also disclose information to professional advisers under confidentiality duties, to authorities where legally required or as part of a business sale or restructuring subject to applicable safeguards and notices.

Customers may ask support@operio.run for information about relevant subprocessors. We require appropriate protections for service providers and limit disclosures to legitimate Service needs.

Information may be processed or accessed in the United States and other countries in which Operio or its providers operate. When applicable law requires protections for international transfers, we use appropriate contractual or other lawful safeguards, potentially including an applicable DPA or standard clauses. Customers subject to specific residency or transfer restrictions should contact us before submitting regulated data.

We apply reasonable technical and organizational measures intended to protect information, including access controls, protections for credentials and secrets, security monitoring and suitable safeguards for data in transit and storage. No system can be guaranteed perfectly secure. Customers should use dedicated test credentials, appropriate backups and synthetic or masked data where possible.

If we become aware of a security incident reasonably believed to materially affect Customer Data, we will notify affected customers without undue delay as appropriate under applicable law and any DPA. Suspected incidents can be reported to support@operio.run.

We keep account, billing, usage, security and agreement-acceptance records as reasonably necessary to provide the Service, comply with accounting and legal duties, prevent abuse and resolve disputes. Canceling paid subscription renewal does not automatically close the account or remove stored tests.

After account closure, Customer Data in active systems is deleted or anonymized within 90 days unless law or an agreed DPA requires a different period. Backup copies may remain protected until their scheduled rotation or expiry; the 90-day period is not a promise that all backups are erased within 90 days. Limited financial, legal or security records may be retained longer where justified. Customers needing specific deletion periods for backups should agree these before uploading affected data.

We use essential cookies for sign-in and security and may use preference and analytics technologies to understand Service use. We request consent for non-essential technologies where required by applicable law; browser controls may also limit them.

Subject to applicable law, individuals may request access, correction, deletion, portability, restriction or objection, or withdraw consent where it is the legal basis. Contact support@operio.run. We may verify identity and respond within the legally required period. For personal data Operio processes on behalf of a business customer, that customer is usually the first contact; we provide assistance required by law or a DPA.

The Service is not directed to children under 18. Customers are responsible for ensuring that any children's personal data submitted for testing is processed in compliance with applicable laws.

We may update this Policy from time to time and revise the Last Updated date. We will notify Customers of material changes by email or through the Service, with advance notice where required by applicable law, and obtain renewed consent when legally required. Changes do not override a signed DPA or mandatory privacy rights. Privacy inquiries, DPA and subprocessor requests, international-transfer questions and security reports: support@operio.run. Operio AI Inc. | https://www.operio.run.