Privacy policy
What Saram collects when you use it, what we do with it, who helps us, and how long recorded sessions are kept.
Last updated October 28, 20261. Who is responsible
Nullspace Studios, LLC, 221 Main St, Ste R, Nashua, NH 03060, USA, runs Saram and is responsible for the personal data in your account. For the content of the sites you test, including anything personal a persona sees or records there, you decide what is tested and we process it on your behalf. Write to support@saram.sh with any privacy question.
2. What we collect
Your account
Your name and email address, your organisation and your role in it, from signing in. If you sign in through another identity provider, we receive the basic profile it shares.
Billing
Your plan, balance, top-ups, invoices and the Stripe customer and subscription records that go with them. Stripe holds your card; we never see or store the full number.
What you give a run
The websites you test, the goals and personas you choose, files you upload, and any test-account credentials you provide. API keys are stored only as a one-way hash. Model provider keys are kept encrypted in a secrets store and are never shown back.
Recorded sessions
As personas work, Saram records the session: screenshots, video, a trace of every step, the persona's notes, and the browser state of the site under test (its cookies and local storage). If the pages a persona visits show personal data, that data is in the recording. Use test accounts and test data wherever you can.
Usage and logs
What runs you start and the Usage they spend, and service logs such as IP addresses, request times and errors, which we keep to run, secure and debug Saram.
3. Cookies
saram.sh sets no cookies and loads no analytics, advertising or other third-party scripts. The dashboard uses one sign-in cookie to keep you signed in. We do not use advertising or tracking cookies.
4. How we use it
- to run the Service: start runs, record them, report what happened, and show it to your organisation;
- to bill you and keep accurate records;
- to keep Saram and its users secure, and to prevent abuse;
- to answer you, and to tell you about changes to the Service or these policies;
- to meet legal obligations.
We do not sell your data, share it for advertising, or use your content to train AI models. Where the law asks for a legal basis, ours are the contract with you, our legitimate interest in running a secure service, and legal obligation.
5. Who processes it for us
These companies process data for Saram, each only to provide its part of the Service. We will update this list before adding a new one.
| Sub-processor | What for | Where |
|---|---|---|
| Amazon Web Services | Hosting, databases, file and recording storage, secrets | United States |
| Stripe | Payments, the Pro subscription, invoices and top-ups | United States |
| WorkOS | Sign-in, sessions and organisation membership | United States |
| The model provider you connect (for example Anthropic, OpenAI, Google or OpenRouter) | The model a persona thinks with: it receives the pages, screenshots and instructions of a run | Set by that provider |
| GitHub | Only if you turn on GitHub issue filing: the issues and comments Saram writes to your repository | United States |
We may also disclose data when the law requires it, or to a successor if Saram is sold or merged, under this policy.
6. How long we keep it
- Recorded sessions (videos, screenshots, step traces): up to 14 days after the run starts on Free, and up to 90 days on Pro. Then they are deleted.
- A run's record (its goal, personas, outcome and findings): until you delete the run or close your account.
- Uploaded files: 30 days after upload.
- Share links to a run expire, and never outlive the recording they show.
- Account data: while your account is open, then deleted, except what we must keep.
- Billing records: as long as tax and accounting law requires, even after a run or an account is deleted.
You can delete a run at any time through the API; its recordings go with it.
7. Where it is stored
Saram runs in Amazon Web Services in the United States. If you are outside the United States, your data is transferred there, with the safeguards the law requires for such transfers.
8. Security
Data travels encrypted. Keys and credentials are kept in a secrets store, API keys only as hashes, and access to production systems is limited to the people who run Saram. No system is perfectly secure; if a breach affects your data, we will tell you as the law requires.
9. Your rights
You can ask to see, correct, export or delete your personal data, or object to how we use it. Depending on where you live (for example the EU, the UK or California) you may have further rights, including to complain to your data protection authority. Write to support@saram.sh; we answer within 30 days. If your data is in a recording your own organisation made, we may refer you to that organisation.
10. Children
Saram is a tool for businesses and is not meant for anyone under 18.
11. Changes to this policy
When we change this policy we update the date above, and for a material change we tell you by email or in the dashboard before it takes effect.
12. Contact
Nullspace Studios, LLC, 221 Main St, Ste R, Nashua, NH 03060, USA, support@saram.sh. More ways to reach us are on the contact page.