Privacy Policy

The short version

• We collect what we need to run EveryRole for you, and nothing to sell. We don’t sell or rent personal data, and we don’t use it for advertising.
• Your test accounts’ passwords are encrypted, and your own password is stored only as a one-way hash.
• Analytics that set cookies run only if you accept them.
• You can ask for a copy of your data, or delete it, at any time.

1. Who is responsible

Build Beyond Hightech LLC is the controller of the personal data described here (for the EU and UK GDPR) and the “business” (for the California Consumer Privacy Act).

For the apps you test, you decide what EveryRole looks at; for any personal data that appears in them, we process it on your behalf, as your processor.

2. What we collect

You give us

• Account: your email address, your name if you add it, and your password (stored as an Argon2id hash we can’t reverse).
• Workspace: its name, the people you invite and their roles.
• Your apps: their addresses, the kinds of user you describe, the test accounts you give EveryRole (their passwords are encrypted at rest) and your settings.
• Messages: what you write to us.

Made while EveryRole works for you

• Results: screenshots and videos of your app, the pages’ text and buttons, logs and test results. If your app shows personal data to a test account, it can appear in these.
• Usage: the jobs you run and the credits they used.
• Security records: sign-in attempts, sessions and the IP addresses they came from, to protect accounts.

From payments

Our payment provider collects your payment details; we receive only what we need to know about your plan: its status, your billing email and country, and invoices. We never see your full card number.

From our website

We don’t run analytics on our site today. If we add any, this page will say which, and tools that set cookies will run only if you accept them. The Cookie Policy has the details.

3. Why we use it (and on what legal basis)

• To run the Service you asked for: your account, exploring and testing your apps, results, alerts and billing (performance of a contract).
• To keep it safe: preventing abuse and unauthorised access (legitimate interests).
• To improve it: understanding which pages and steps confuse people, from anonymous measurements (legitimate interests) and, if you accept, analytics cookies (consent).
• To tell you what matters: emails about your account, your apps’ results and important changes (contract). Product news only if you ask for it (consent), with a way out in every email.
• To follow the law: accounting, tax and answering lawful requests (legal obligation).

4. AI processing

To explore your app and write tests, EveryRole sends what it sees of your app’s pages (text, button labels and page structure) to AI model providers. They process it only to answer our request. We don’t use your apps’ content to train AI models. The providers are listed on Sub-processors.

5. Who we share it with

Only with the companies that help us run the Service, under contracts that bind them to protect it and use it only for us. They are listed on Sub-processors. We also disclose data when the law requires it, or to a buyer if the business is sold (you would be told first). The people in your workspace see your workspace’s apps and results.

6. How long we keep it

• Run results, screenshots and videos are kept for your plan’s history (7 days or 30 days or 90 days or 180 days, depending on the plan), then removed.
• Your account, apps and tests are kept while your account exists, and deleted when you delete them (see Data Deletion).
• Billing records are kept as long as tax law requires.

7. Security

Traffic is encrypted in transit. Test-account passwords and other secrets are encrypted at rest, each kind with its own key. Each test runs in its own private browser session. No system is perfectly secure; if a breach affects your data, we tell you and the authorities as the law requires.

8. Your rights

Wherever you live, you can ask us to: show you the data we have about you and give you a copy; correct it; delete it; or stop using it for a purpose. You can withdraw a consent at any time, as easily as you gave it (for cookies: on the Cookie Policy).

In the EU, EEA and UK

You also have the rights to restrict processing, to data portability and to object to processing based on legitimate interests. You may complain to your data protection authority.

In California (CCPA/CPRA)

You have the right to know what personal information we collect, use and disclose; to delete and correct it; and not to be treated differently for using these rights. We do not sell personal information and do not share it for cross-context behavioural advertising. In the last 12 months we collected the categories listed in section 2 (identifiers, commercial information, internet activity) for the purposes in section 3. You may use an authorised agent.

To use any of these rights: Write to us at the postal address above. We answer within 30 days (45 days for California requests when needed), and may ask you to confirm it’s you.

9. International transfers

We are based in United States, and some of our providers are elsewhere. When personal data leaves the EU, EEA or UK, we rely on an adequacy decision (such as the EU–US Data Privacy Framework, for certified companies) or the European Commission’s Standard Contractual Clauses.

10. Children

EveryRole is a tool for professionals and is not meant for anyone under 16. We don’t knowingly collect their data; if you think we have, tell us and we delete it.

11. Changes

When this policy changes, the date at the top changes too. If a change matters, we tell you by email or in the app before it applies.

12. Contact

Write to us at the postal address above.