Privacy Policy

1. Introduction

TestAngle (“we,” “our,” or “us”) is committed to protecting your privacy and securing the integrity of our platform. This Privacy Policy explains how we collect, use, process, disclose, and safeguard your information when you visit our website, register for an account, or utilize our visual browser automation platform, including multi-browser cloud execution instances (Chrome, Firefox, Safari), API runners, and reporting dispatchers.

Please read this policy carefully. By accessing or using our Platform, you acknowledge the data collection, monitoring, and disclosure practices described herein.

2. Information We Collect

We collect information in four categories: personal account data, test configurations, execution assets, and security, network, and system activity logs.

A. Personal & Workspace Account Data

• Contact Information: Names, email addresses, job titles, and workspace profiles created when signing up or inviting team members.
• Billing Information: Payment card details, billing addresses, tax IDs, and transaction histories processed securely via third-party payment gateways (e.g., Stripe). We do not store raw credit card numbers on our servers.
• Credentials & Tokens: Hashed passwords, encrypted environment secrets, and securely signed API tokens used for CI/CD runners and integrations.

B. Test Configurations & Metadata

• Test Step Definitions: Visual cards, target URLs, click actions, form inputs, selector hierarchies, and page assertions that comprise your test suites.
• Header Configurations: Custom request headers, basic authentication credentials, and session cookies defined for environment routing.

C. Test Run Artifacts & Execution Media

When a test executes on our cloud runners, our execution engine automatically captures:

• Trace Logs: Console errors, network request/response headers, status codes, and DOM event traces.
• Visual Media: Video recordings (MP4) and full-page screenshots (PNG) captured during test execution for failure debugging and visual regression diffing.
• Diagnostic Details: Unhandled exceptions, error details, and AI-assisted plain-language summaries explaining why an issue occurred.

D. Security, Network & Anti-Abuse Activity Logs

To safeguard our infrastructure, comply with legal requirements, and prevent unauthorized attacks against third-party servers, we automatically capture:

• Connection Data: Originating IP addresses, browser user-agents, device fingerprints, and geolocation data.
• Runner Activity Logs: Outbound destination IP addresses, target hostnames, request frequency, outbound bandwidth consumption, and proxy egress routing records.
• System Audit Trails: Immutable records of user logins, permission modifications, API token generations, and test deletion events.

3. How We Use Your Information

We process your data strictly for legitimate operational, security, and contractual purposes, including:

• Provisioning isolated cloud browser instances and executing scheduled or on-demand automated test runs.
• Generating test reports, visual comparisons, and translating trace errors into human-readable summaries.
• Dispatching test alerts via Slack, email, webhooks, or ticketing integrations.
• Enforcing our Terms of Service, rate limits, concurrent job quotas, and fair-use thresholds.
• Fraud Prevention & Abuse Detection: Analyzing traffic patterns to detect automated spam, Denial of Service (DoS) attacks, port scanning, credential stuffing, scraping, cryptocurrency mining, or unauthorized testing against third-party targets.

We never sell, rent, or monetize your personal information, test parameters, credentials, or visual recordings to third parties. We do not use your private test scripts, proprietary code, or visual media to train publicly accessible machine learning models.

4. Disclosure for Legal Compliance, Safety, and Abuse Enforcement

Notwithstanding anything to the contrary in this Privacy Policy, we reserve the express right to preserve and disclose any account information, audit logs, network connection logs, or test execution records if we believe in good faith that such disclosure is reasonably necessary to:

• Comply with applicable laws, regulations, judicial subpoenas, search warrants, court orders, or governmental requests;
• Investigate, prevent, or take action regarding suspected illegal activities, fraud, computer misuse, or violations of our Acceptable Use Policy;
• Respond to verified abuse reports or cease-and-desist notices from third-party hosting providers, network operators, or owners of target systems affected by unauthorized tests originating from your account;
• Protect the rights, property, safety, or infrastructure of TestAngle, our users, our infrastructure partners, or the general public; or
• Establish, exercise, or defend our legal rights in connection with ongoing or threatened litigation, arbitrations, or government investigations.

5. Data Retention & Automatic Expiry

We enforce automated retention and destruction schedules to minimize data exposure:

• Execution Media (Videos & Screenshots): Automatically deleted from our storage buckets upon expiration of your plan’s retention window (7 days for Free, up to 180 days for Team/Enterprise plans).
• Logs & Traces: Automatically purged or archived according to your workspace’s configured logs retention policies.
• Workspace Configurations: Persisted while your workspace remains active. When you delete a workspace, test definitions and encrypted secrets are permanently purged from primary databases within 30 days.
• Abuse & Security Records Exception: Where an account has been suspended or investigated for fraud, malicious attacks, or Terms of Service violations, we reserve the right to retain connection logs, audit trails, and payment records for as long as necessary to enforce bans, prevent re-registration, resolve disputes, and comply with statutory legal requirements.

6. Data Isolation & Subprocessors

We enforce strict multi-tenant isolation. Customer workspaces are logically separated at the database level, and test execution nodes run inside ephemeral, isolated sandboxes that are immediately destroyed upon run completion.

To deliver our services, we partner with trusted enterprise subprocessors operating under strict confidentiality and security commitments:

• Cloud Hosting & Database: Google Cloud Platform / Firebase for encrypted storage, secure databases, and serverless compute.
• Payment Processing: Stripe, for PCI-DSS compliant billing and fraud prevention.
• Notification Infrastructure: Resend / Amazon SES for transactional and operational alerts.
• AI Diagnostic Analysis: Trusted foundational AI model providers (e.g., Google Cloud Vertex AI / OpenAI API) strictly to generate human-readable explanations of runner logs and trace errors. Prompts and error snippets sent to AI providers are processed under zero-data-retention agreements where available and are never used to train foundational AI models.

7. Cookies, Local Storage & Tracking Technologies

We use essential cookies, secure session tokens, and browser local storage to operate the Platform, protect your workspace against cross-site attacks, and remember user preferences:

• Strictly Necessary Cookies & Storage: Required for secure authentication, token verification, CSRF mitigation, and maintaining your active workspace session.
• Functional & Preference Data: Used to persist theme preferences (dark/light mode), sidebar toggle states, and visual test editor configurations across sessions.
• Security & Performance Metrics: Anonymized operational metrics to detect broken UI components, monitor page load speeds, and identify DDoS or bot activity.

You may manage or disable cookies via your browser settings. However, disabling strictly necessary cookies will prevent you from signing in or operating cloud browser test sessions.

8. Your Rights & Control (GDPR / CCPA / Statutory Rights)

Depending on your location, you may have specific statutory rights regarding your personal information, including:

• Access & Portability: The right to request copies of your personal data and export your visual test suites in structured formats.
• Correction: The right to correct inaccurate or incomplete profile records.
• Deletion (Right to Erasure): The right to request deletion of your personal data, subject to our overriding legal obligations to retain transaction records, defend against legal claims, and preserve abuse investigation evidence.
• Objection & Restriction: The right to object to or restrict certain types of data processing where provided by law.

To exercise these rights, please email us at security@testangle.com.

9. Security Incident Protocol

We implement defense-in-depth security controls, including encryption at rest (AES-256) and in transit (TLS 1.3). In the event of a confirmed security incident impacting your workspace secrets or personal data, we will notify the primary workspace owner via email within 72 hours of confirmation, providing details of the incident scope and mitigation steps.

10. Contact Us

If you have any questions, concerns, or inquiries regarding this Privacy Policy or our security practices, please contact our privacy and security team: