unotest cloud

Privacy

Last updated 2026-09-15

What we store

• Account. Your Google account id, email and name, received when you sign in with Google. We do not see your Google password.
• Payments. Stripe processes your card; we never see the card number. We keep the Stripe customer id, the amount and date of each top-up and the invoice Stripe issues. Your VAT number and billing address, if you enter them, are stored by Stripe.
• Balance and usage. A ledger of top-ups and hourly charges per box, so you can see where the money went.
• Boxes. Name, size, status, timestamps and the initial admin password of each box you create. The password is shown to you once and can be reset on the box.
• API keys. A hash of each key; the key itself is shown once.
• Server logs. Request logs with IP addresses, kept for 30 days for security and debugging.
• Intent journal. The intent phrases the Picker was asked to resolve, kept for 30 days. See Grounding and the Picker.

What lives on your box

Test runs, screenshots, traces, pushed bundles and the secrets you configure for your environments are stored on your box only. They are deleted together with the box. We access a box only to operate the service (updates, health) or when you ask for help.

Why we process it

To provide the service you asked for (contract), to invoice and account for it (legal obligation), and to keep the service secure (legitimate interest). We do not sell data and do not use it for advertising.

Who else sees it

• Google — sign-in.
• Stripe — payments, invoices, tax calculation.
• Hosting providers in the EU — the virtual machines your boxes run on.
• Cloudflare — DNS for box.unotest.com names.
• Zoho — the email we send you (low balance, box removed).
• Google (Gemini API) — resolving intent locators in the external-provider mode. See Grounding and the Picker.

Grounding and the Picker

The Picker resolves an intent locator — “the checkout button” — by having a model read the page under test. It works in two steps. First the page is turned into a structured capture — the visible text, the roles and the accessible names of its elements — and indexed on hardware we operate; nothing from this step leaves us, in either mode. Then a shortlist of candidate elements is put to a model together with the intent phrase.

That model is one of two, chosen for the whole service and not per account: Our GPU, where the shortlist reaches no third party, and External provider (Gemini), where it goes to Google’s Gemini API. The Picker currently runs on External provider (Gemini); the rest of this section describes the provider mode.

Who. Google, as a subprocessor, under the Gemini API terms of service that apply to paid use, for the sole purpose of resolving an intent locator into an element. We use the paid tier of the API; on that tier Google states that prompts are not used to train its models. Google’s current terms and data-processing commitments for the Gemini API are published by Google and take precedence over our summary of them.

What is sent, and when. Only while a box has the Picker switched on and a test or your agent actually asks for an intent — never in the background, and never for a box without the Picker. Two things go: the intent phrase your agent wrote, and a shortlist of up to twenty candidate elements from the page — each as its role, accessible name and visible text. The full page capture stays on our hardware. Screenshots, cookies, request bodies and files from your repository are not sent.

What is hidden, and what is not. Values of password and hidden fields are dropped, and values the run was given as secrets are masked out of the capture the shortlist is drawn from, and out of the intent phrase, before anything leaves us. Masking works by value: it removes a secret we were told about, spelled the way we were told it. It does not remove a secret your own application draws on the page — a one-time code on screen, a token inside a link, a card number echoed back — because the run was never told that value.

Masking can also miss a secret written in another case, percent-encoded inside a URL, or split across neighbouring elements. We therefore do not tell you that secrets are never transmitted. If your application displays secrets, write to us before switching the Picker on.

Where and how long. The request to Google is made from our grounder host. Google’s answer and the shortlist we sent are not stored by us. What we do keep is a journal of intent phrases — the phrase, the box or account that asked, the host name of the page (never the URL), the outcome and the element chosen — for 30 days on the grounder host, to improve resolution quality; it is deleted on request. The page capture itself is never written to that journal and never leaves the host. How long Google retains prompt data on the paid tier is set by Google’s Gemini API terms.

Your own model. @unotest/web can also ground locally, against a model server you run or any endpoint you point it at with your own key. Nothing in that path passes through us, and this policy does not cover it: the terms of the endpoint you named do.

How long

Account and ledger data for as long as the account exists and afterwards as long as tax law requires invoices to be kept. Box data until the box is deleted. Logs for 30 days. Intent journal: 30 days, or sooner if you ask (see Grounding and the Picker).

Your rights

You can see and export your ledger in the dashboard at https://app.unotest.com. To correct or delete account data, or to object to processing, write to hello@unotest.com. EU residents may also complain to their data-protection authority.

Cookies

The dashboard uses one session cookie to keep you signed in. The marketing site at https://unotest.com sets no tracking cookies.