Privacy Policy
Who we are
CertusQA (“we”) operates certusqa.com and delivers the DeployShield Suite and related QA services. The private console at app.certusqa.com is Access-gated (operators and invited client-readonly viewers only) and is not linked from this marketing site.
What we collect
- Site visitors: standard server/CDN logs (IP, user agent, path) via Cloudflare, plus Cloudflare Web Analytics, a cookieless, privacy-first page-view counter that does not fingerprint or track you across sites. We do not load ad trackers or any other third-party analytics.
- Intake & scheduling: every “book a demo” or “reserve a spot” button on this site opens our Tally intake form, which redirects to Calendly to pick a time. Those providers process the fields you submit (name, email, company, notes). The link also carries three non-personal parameters (
source,path,page) so we know which page and button you came from. - Billing: this site has no checkout. If you purchase DeployShield after a kickoff call, we send a Stripe Payment Link; if you upgrade a platform plan at app.certusqa.com, you are sent to Stripe Checkout. Either way Stripe processes your payment details and we never see your card number; we keep only Stripe's customer and subscription identifiers against your account.
- Sandbox showcase: the “Try the sandbox” panel and the walkthrough load recorded artifacts from this site only. Nothing you click there is sent anywhere, and downloading the sample report collects nothing.
- Client delivery: staging URLs, test credentials, CI logs, screenshots, and failure artifacts needed to run and maintain your suite — under your agreement and, where applicable, a DPA.
How we use information
To respond to inquiries, schedule kickoffs, bill for services, deliver and maintain automated regression coverage, and improve our service quality. We do not sell personal information.
AI tooling
When AI-assisted authoring or self-healing is in scope under your agreement, staging UI text and logs may be processed by AI tooling (including Cursor) as described in that agreement and our subprocessor list. We treat page content as untrusted and apply scrubbing controls where implemented. Agents target non-production environments unless a Production Rider is signed.
Retention
Marketing/lead records are kept as needed to respond to you. Evidence packs from delivery default to 90 days unless your agreement says otherwise, or you request earlier deletion.
Your choices
Email hello@certusqa.com to request access, correction, or deletion of personal data we hold about you as a prospect or client contact.
International & security
We use reputable subprocessors (see your agreement materials). The marketing site is static and served over HTTPS with HSTS. Client secrets must not be emailed in plaintext; use env/secret stores.
Changes
We may update this page; the “Last updated” date will change. Material changes for clients will be communicated as required by your agreement.