Copado Robotic Testing

GDPR overview

GDPR implementation is concrete and documented. The privacy policy, effective 5 August 2026, covers Copado, Inc. and its subsidiaries Copado Limited, Copado Netherlands B.V., Copado K.K. and Copado Australia Pty Ltd. It states explicitly that Copado is a processor when delivering its services and a controller for direct marketing, and it lists its legal bases: legitimate interests, contractual performance, consent and legal compliance. Data subject rights cover access, correction, deletion, portability, restriction, objection and withdrawal of consent, exercised through privacy@copado.com. Cross-border transfers rely on European Commission-approved Standard Contractual Clauses, and written notices go to Copado, Inc. in Chicago or Copado Netherlands B.V. in Amsterdam. The security framework is aligned to ISO 27001, SOC 2, FedRAMP and GDPR. No Article 27 representative is designated, the group having its own EU establishment.

Who owns the data?

Under its privacy policy, Copado generally acts as a processor of customer personal data, handling it only on the customer's instructions, and becomes a controller for its own direct marketing. Contracts signed directly with customers override the policy, and a public Data Processing Agreement is available among the company's legal agreements. The website and its content, including all intellectual property rights, belong to Copado or its licensors. Material a user posts to the site remains the user's to warrant, but the user grants Copado the rights needed to display, reproduce and disseminate it. Customer data is processed inside a dedicated Google Cloud environment, isolated from other customers and from the general public.

Reuse rights

The terms of use are restrictive about Copado's own content: it may not be copied, reproduced, modified, published, uploaded, transmitted or distributed without permission, and using the site or its content to train large language models, artificial intelligence systems or similar knowledge bases is expressly prohibited. Visitors receive no licence to Copado's trademarks, layout or design. Material a user posts is covered by a broad licence granted to Copado, and any suggestion or feedback provided may be used and incorporated without payment or condition. On customer data the commitment runs the other way: Copado states that neither it nor its third-party AI providers use personal data, prompts or output content to train foundational machine learning models, unless the customer explicitly opts in to such a programme.

Data retention & training

Hosting summary

Copado states that customer data is processed inside a Google Cloud Platform environment dedicated to Copado, isolated from other customers and from the general public. The AI features rely on Google Cloud Vertex AI within that same dedicated infrastructure, incorporating third-party models from Google Gemini and Anthropic Claude. The security pages describe third-party cloud data centres holding ISO 27001, SOC 2, FedRAMP, HIPAA and NIST certifications, with customer data encrypted in transit, at rest and inside the databases, regular backups and annually tested disaster recovery. What the site never does is name a country or a region: no hosting jurisdiction is published anywhere. The privacy policy notes only that Copado affiliates and the third parties it shares data with are located in the United States and elsewhere in the world, which describes transfers rather than a hosting location, and that those transfers rely on European Commission-approved Standard Contractual Clauses. Anyone with data residency requirements should therefore settle the question contractually rather than from the website.