Quail Platform · Legal

Privacy Policy

Last updated 24 September 2026

This privacy statement describes how we process your personal data via Quail Platform ("Quail"), owned and operated by spriteCloud B.V. ("sC"), accessible at app.spritecloud.com.

We process your personal data in accordance with applicable data protection laws and regulations, including the General Data Protection Regulation and the Dutch Telecommunications Act. This statement explains what we collect, why, and on what legal grounds.

When you use Quail directly, sC is the data controller for your personal data. If your company uses Quail to test its own applications, sC acts as data processor on that company's behalf for data relating to the sites/applications being tested. For general information about sC, see spritecloud.com.

We do not process your personal data for purposes beyond those stated here, and we do not retain it longer than necessary for those purposes, unless a legal obligation requires otherwise. Where processing is based on your consent, you may withdraw that consent at any time. This does not affect the lawfulness of processing that already took place.

Our legal basis

The legal basis for processing personal data in relation to Quail is our legitimate interest, and the legitimate interest of our users, in ensuring the security and integrity of our products and services. Specifically, to perform tasks our users need and in the exercise of our role as a trusted supplier of testing services.

Your account

Quail has no separate password of its own. You sign in exclusively via Google Sign-In. We receive your name, email address and profile picture from Google when you do. After your first sign-in, you either land in your company's existing Quail workspace (if colleagues from your email domain already use it) or can claim/create one. See our product for how that onboarding works in detail. Only email domains a spriteCloud contact has approved can sign up; everyone else can request access.

Cookies and local storage

Quail sets a small number of strictly functional cookies. No third-party tracking or advertising cookies of any kind:

• Session cookie. Keeps you signed in between visits.
• OAuth state cookie. Short-lived (10 minutes), used only during the Google sign-in redirect to prevent request forgery.
• Theme preference. Stored in your browser's local storage, not a cookie, to remember your light/dark mode choice.

Most browsers let you inspect or clear cookies and local storage through their settings; doing so will simply sign you out and reset your theme preference.

Your rights

You have the right to:

• obtain confirmation of whether we process your personal data, and access it;
• have inaccurate or incomplete personal data corrected;
• have your personal data erased where it's no longer necessary, you've withdrawn consent with no other legal ground remaining, or it was unlawfully processed;
• have processing restricted where accuracy is contested, processing is unlawful, or you've objected pending our review;
• receive your personal data in a structured, machine-readable format, and have it transmitted to another controller.

We respond to requests within four weeks. If you disagree with our response, you may lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Third parties

We share personal data with the following third-party service providers, only as needed to run Quail:

• Google. Your sign-in identity provider (name, email, profile picture). If your organization enables Google's Gemini as its AI provider, target-site content configured for that provider (page text, screenshots, extracted findings, not your personal account data) is sent to Google for analysis.
• Anthropic. An optional, org-configurable AI provider for the same target-site analysis described above, used only if your organization enables it.
• Stripe. If your company is on a paid plan, your card details, billing name/address and email are securely processed by Stripe. We can see limited billing metadata (card expiry, last four digits) but never your full card number or CVC.
• Slack. Entirely optional and configured by your own company's Company Admin, not by sC. If your company adds a Slack webhook, test-run and issue notifications are sent there. sC never sees or stores your Slack workspace's contents beyond the webhook URL itself.

We share personal data with a third party only where you've given explicit consent, where it's necessary for performance of a contract or legal obligation, for sC's legitimate interests, or where disclosure is required by a competent authority. Your data is retained until you delete your account.

Notifications

Quail sends operational emails tied to your account and the projects you're part of. These include company invitations, access-request outcomes, run-completion and new-issue alerts. They aren't a marketing mailing list; there's no newsletter or promotional email to opt out of. You can adjust which notification types you receive per project (Project → Settings), or stop receiving any of them entirely by leaving or deleting your account.

Data requests

To request access to or deletion of your data, contact our Data Protection Officer at dpo@spritecloud.com.

Security measures

We implement appropriate technical and organizational measures to process your personal data securely and in line with applicable data protection laws.

Changes to this policy

We may update this privacy statement from time to time. We only process your personal data under the version of this statement in force at the time it was collected. We recommend checking back periodically for the current version.

Contact

spriteCloud B.V.
Rijnlandlaan 199
1062 MX Amsterdam, The Netherlands
+31 (0)20 615 9155
info@spritecloud.com