Privacy Policy

Effective: 2026-10-05

This Privacy Policy explains how we collect, use, store, and share information about you when you use the AIPoweredTesting desktop application, the website at ai-powered-testing.com, and related services (the "Service"). It applies to users in Mexico (LFPDPPP), visitors from the European Economic Area (GDPR), residents of California (CCPA), and the general public.

1. Introduction

This policy describes the personal data we process to operate the Service, including free Trials and paid Subscriptions. Capitalized terms such as Organization, Seat, Trial, and Subscription have the meanings given in our Terms of Service. Where our data practices differ by region (GDPR or CCPA), we note the difference explicitly. By using the Service you acknowledge that you have read and understood this policy. If you do not agree, please do not use the Service.

2. Data controller

The data controller under GDPR, the "responsable" under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), and the "business" under CCPA, is:

3. What we collect

3.1 From Google Sign-In or Sign in with Apple

• Email address.
• Display name.
• Unique Google account identifier (the sub claim).
• If you use Sign in with Apple: your unique Apple user identifier; your email address or, if you choose to hide it, an Apple private relay address (…@privaterelay.appleid.com); and your name, which Apple shares only on your first sign-in.

3.2 From the macOS application (product telemetry)

A non-exhaustive list of events we log to improve the Service:

• feature_used — which features you use (for example, starting a test run or exporting a report).
• trial_* — trial reminder screens shown and the choices made on them.
• feedback_submitted — that you sent feedback (category only).
• Each event carries the app version, macOS version, and release channel. Events contain no test content.

3.3 From crash reports (Sentry)

• Stack trace, exception class, and message.
• App version, macOS version, device locale.
• We do not intentionally collect personal data in crash reports.

3.4 Test content and run artifacts (synced by the desktop app)

Only while your Organization has a Trial or a Subscription; in free local mode nothing in this section is uploaded until you subscribe.

• Test content you author — test scripts, scenarios, presets, suites, and application catalog entries are stored on our backend so they can sync across your devices and be shared with your team.
• Run artifacts — screenshots, execution logs, device logs (logcat), and HTML reports produced by a test run are uploaded to our storage so you and your team can review sessions from any machine.
• Run history — per-session records: which test ran, on which device or emulator, pass/fail outcome, and timestamps.
• Run artifacts may incidentally capture personal data if the application under test displays it (for example, in a screenshot). You control what your tests display; retention limits for this data are described in section 6.

3.5 Subscriptions and payments

• Payments are processed by Stripe. You enter your card details directly on Stripe's checkout and customer-portal pages; we never receive or store your full card number or security code.
• From Stripe we receive and store the customer, subscription, and invoice identifiers linked to your Organization, the subscription status, the number of paid Seats, and billing dates.
• We keep a copy of the payment notifications Stripe sends us. They may include the billing name, billing email, billing country and postal code, invoice amounts, and the card brand and last four digits.

3.6 Feedback you send from the app

• Your message, optional rating and category, app and macOS version, and technical details the app attaches (preflight check results).

3.7 Technical data

• IP address and User-Agent in server logs, used for security and rate limiting.

4. What we don't collect

• Full card numbers, card security codes, or bank account details — card data is entered directly with Stripe and stays with Stripe (see 3.5).
• The binaries of the applications you test (.apk / .ipa) — builds are never uploaded to or stored on our servers; the Service references your own download URL or a locally attached build.
• Biometric data.
• Precise geolocation (GPS). We do not derive your location from your IP address; we use the IP address only for security and rate limiting (see 3.7). Your billing country comes from Stripe (see 3.5).
• Tracking or advertising cookies — we use none; see our Cookie Notice.

5. Legal basis (GDPR)

• Account, Trial, and Subscription — performance of a contract (Article 6(1)(b)).
• Billing and tax records — compliance with a legal obligation (Article 6(1)(c)).
• Product telemetry — legitimate interest in product improvement (Article 6(1)(f)).
• Crash reports — legitimate interest in debugging and reliability (Article 6(1)(f)).
• Future marketing emails — your consent (not currently in use).
• Automated decision-making — none: we do not make decisions based solely on automated processing that produce legal or similarly significant effects for you (Article 22).

6. Retention

• Account and profile data — for the duration of your access to the Service; personal data is removed within 30 days of account deletion, except the records listed below.
• Test content you author (test scripts, scenarios, presets, suites, application catalog) — for the life of your account; removed together with account data after account deletion.
• Run artifacts and run history (screenshots, logs, reports, session records) — guaranteed to remain available for 90 days after the run while your account is in good standing, then automatically deleted (deletion completes at approximately 104 days). See the Data Retention Policy for details.
• Billing records (Stripe identifiers, invoices, payment notifications) — as long as tax and accounting law requires (in Mexico, generally five years), then deleted.
• Audit logs — 12 months (compliance window).
• Product telemetry events — 24 months, then aggregated or deleted.
• Crash reports — 12 months.
• Backups — rolling 30 days (disaster recovery).

7. Third parties (sub-processors)

We use the following sub-processors. All transfers from the EEA rely on EU Standard Contractual Clauses (SCCs) included in each provider's data processing agreement (DPA).

8. Your rights (GDPR)

If you are located in the EEA, the United Kingdom, or Switzerland, you have the following rights with respect to your personal data:

• Right of access (Article 15) — obtain a copy of the data we hold about you.
• Right to rectification (Article 16) — ask us to correct inaccurate data.
• Right to erasure (Article 17) — ask us to delete data when there is no longer a valid reason to process it.
• Right to data portability (Article 20) — receive your data in a structured, machine-readable format.
• Right to restriction of processing (Article 18).
• Right to object (Article 21) — including to processing based on legitimate interest.
• Right to withdraw consent at any time, without affecting processing based on consent before its withdrawal.

You also have the right to lodge a complaint with a supervisory authority in the EU/EEA member state of your residence, with the UK Information Commissioner's Office (ICO), or with the Swiss Federal Data Protection and Information Commissioner (FDPIC), as applicable.

9. Your rights (CCPA)

If you are a California resident, you have the right to know what personal information we collect about you and why, the right to correct inaccurate information, the right to request deletion, and the right to opt out of the sale or sharing of personal information. We do not sell or share personal information, and we have not done so in the preceding 12 months. We will not discriminate against you for exercising any of these rights.

10. Your rights (Mexico — LFPDPPP)

If you are located in Mexico, the Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares — LFPDPPP) grants you the ARCO rights:

• Access — obtain the personal data we hold about you and the details of how we process it.
• Rectification — ask us to correct inaccurate or incomplete data.
• Cancellation — ask us to delete your personal data.
• Opposition — object to the processing of your data for specific purposes.

You may also revoke consent you have previously given, with effect for the future. This Privacy Policy serves as our privacy notice (aviso de privacidad) under the LFPDPPP. To exercise any ARCO right, follow the steps in "How to exercise your rights" below. If you believe your rights have been violated, you may file a complaint with the Secretaría Anticorrupción y Buen Gobierno, the federal supervisory authority for personal data protection in Mexico.

11. How to exercise your rights

To exercise any of the rights above, email support@ai-powered-testing.com from the address associated with your account. We respond within 20 days of receiving your request and, if we grant it, carry it out within 15 days after our response. Where the law allows, we may extend these periods and will tell you if so. We may ask you to verify your identity before acting on a request in order to protect your data from unauthorized disclosure.

12. Children

The Service is not directed to individuals under the age of 18 and we do not knowingly collect personal data from them. If you believe that we have collected data from a child under 18, please contact us at support@ai-powered-testing.com and we will delete it promptly.

13. Changes to this Policy

We may update this policy from time to time. The current version is always available at ai-powered-testing.com/legal/privacy. Material changes will be communicated by email to the email address associated with your account and/or by a banner on the Service at least 30 days before they take effect.

14. Contact

For privacy-related questions or to exercise any of the rights above, contact us at support@ai-powered-testing.com or by postal mail at the address listed under "Data controller."