Legal
Privacy Policy
Last updated October 22, 2026
Blendra (“we”, “us”) provides a test-automation platform: the Blendra Recorder browser extension records a flow you perform on a website, and the Blendra web app turns it into automated end-to-end tests (Playwright in TypeScript or Python, or Cypress). This policy explains what we collect, how we use it and the choices you have. It covers the web app at blendra.app, the API at api.blendra.app and the Blendra Recorder extension.
Information we collect
- Account data: email, name, password hash, and email verification status.
- Product data: projects, recordings, scenarios, checks, evidence, test-run results, API tokens, and workspace membership. Values recorded into fields we classify as sensitive are not among them; see “Sensitive recorded values” below.
- Billing data: processed by Paddle as merchant of record. We store subscription status and Paddle customer and subscription identifiers, not card numbers.
- Technical logs: request IDs, IP-derived rate-limit signals, and error diagnostics.
The Blendra Recorder extension
What it collects during a recording
- The addresses (URLs) of the pages you visit during the recording.
- The actions you take: clicks, typing, selections, key presses, and page navigations, including inside embedded frames such as sign-in or payment forms.
- Details of the page elements you interact with, used to find them again when the test runs: their role, label, visible text, placeholder, and test or id attributes.
- The values you type into fields, except values in sensitive fields (see below).
- Short text the page shows in response to an action, such as a confirmation message or an error, and elements you point at in check mode, kept as evidence for the test’s checks.
The extension does not take screenshots, does not read cookies, and does not collect anything from pages you browse while no recording is active.
Where it is kept and when it is sent
- A recording in progress is kept on your device, in the extension’s local browser storage, until you save it to Blendra or clear it.
- It is sent to the Blendra API (api.blendra.app), over HTTPS and into your own Blendra account, only when you choose to save it.
- To connect to your account, the Blendra web app hands the extension a short-lived sign-in token. It is kept in session storage only and is gone when the browser closes.
How it is used
Recorded data is used only to provide Blendra’s single purpose: turning the flows you record into automated tests, and running and maintaining those tests for you. We do not sell it, do not use or transfer it for advertising, profiling, or creditworthiness or lending decisions, and do not transfer it to third parties except as described under “Sharing” and “AI features”. Our use of data received from the extension complies with the Chrome Web Store User Data Policy, including its Limited Use requirements.
How we use information
We use your data to operate the product, authenticate you, enforce plan entitlements, send transactional email (verification, password reset, invites, billing notices), improve reliability, and comply with law.
Sharing
We share data only with the processors needed to run Blendra: hosting, file storage, transactional email, Paddle for payments, and the AI providers described below. We do not sell personal data.
Sensitive recorded values
When you record a flow, the extension classifies each field it fills from the field’s
name, id, label, placeholder and autocomplete attribute. Fields identified as
a password, card number, card security code, national ID, one-time code, token or secret,
or bank detail have their value dropped in the browser: it is not sent to us, not stored,
and not written into the test source we generate. The generated test reads each such
value from an environment variable that you set, so the secret stays in your own
.env file or CI secret store. We also recognise a few unmistakable value
shapes (a Luhn-valid card number, a hyphenated national ID, a JSON Web Token, a PEM
private key, and vendor-reserved API key prefixes) in fields we do not already read as
ordinary contact, order or identifier fields. Before an export is written we scan the
generated source and refuse to produce it if a card number appears anywhere in it.
This detection is not exhaustive and is not a substitute for your own controls. A bare security code or short one-time code, an unhyphenated national ID, an opaque high-entropy string, or a secret typed into an ordinarily named field such as a notes box is not detected and will be stored and exported as an ordinary recorded value. Text that your application shows on the page may also be captured as evidence. Record against test data wherever you can, and review the detected fields of a recording before exporting it.
AI features
AI-assisted features (scenario suggestions, check suggestions, failure diagnosis, and QA documentation) send a reduced copy of the relevant recording or failure to a language-model provider: action types, field names, locator kinds, failure categories, and sanitized values. Values classified as sensitive are never sent, because they were never stored. Email addresses, phone numbers, tokens, API keys, and similar secrets are replaced with placeholders before a request is sent. Blendra’s hosted service sends these requests to Anthropic (Claude), which processes them as our subprocessor; it sends nothing to OpenAI. This policy does not describe Anthropic’s own retention. Do not put secrets into ordinary fields if you do not want them processed; Blendra cannot detect every arbitrary secret.
Retention and deletion
Run history is kept for a period that depends on your plan, as described on the pricing page. You can delete recordings and projects in the app at any time, clear a recording in progress from the extension, and remove the extension to delete everything it stores in your browser. To delete your account and its data, contact us at the address below.
Contact
Privacy requests and questions: info@blendra.app