Who we are
QAtesting is a product of Freeflow, based in California, USA. This policy covers qatesting.ai and the QAtesting service. Questions, requests, or anything that looks wrong: support@qatesting.ai — a person reads it.
The short version
We store your account email, the domains you’ve verified, the results of your scans, and — only if you choose to save it — an encrypted copy of the login you give us for your own app. Scans and their evidence are kept until you delete them or close your account. Payments go through Stripe, so card numbers never reach us. There are no advertising or tracking cookies, and we do not sell or share your personal information.
What we collect
Your account. Your email address and when you signed up. You sign in with an email and password or with GitHub; if you use GitHub, we receive your email address from them.
Domains you claim. The domain name, the verification token and whether you proved ownership by meta tag or DNS record, and your per-domain scan settings.
The login for your app — only if you give us one. A credentialed scan needs a standard user login for your own site; an imported session works the same way. It is encrypted before it is stored and only ever decrypted inside the isolated crawl worker — never in your browser and never in the job queue. Every scan has a Remember choice: leave it unchecked and nothing is stored at all, and opting out also deletes a credential a previous scan saved rather than merely skipping the next one. You can also run a public-site scan and give us no login at all.
What the scan produces. The findings, the coverage sitemap, evidence screenshots, and a quality score. Screenshots are encrypted at rest in a private store, and personal data captured from your app — emails, card and account numbers, tokens — is redacted from text and masked in screenshots before any of it is stored.
Test email. Each scan is given a disposable receiving address of the form qa-…@inbox.qatesting.ai. If your app sends mail to it, we store the message’s details and an encrypted copy of its body, and both are deleted with the scan. The address contains a random token and never your scan or account id, so it reveals nothing in your app’s mail logs.
Billing. Your Stripe customer reference, your credit balance, your purchases and subscription status. Card numbers and payment details never reach our systems — Stripe handles them.
Analytics, error reporting, and cookies
Analytics. We use Vercel Web Analytics and Speed Insights to see which pages are used and how fast they load. Both are cookieless, collect no personal data, and do not track you across other sites.
Error reporting. We use Sentry to find crashes and bugs — in your browser and on our servers. It is configured for errors only: no performance tracing, no session replay, and no personal data attached to reports. On our servers we additionally strip request bodies before anything is sent, because those requests can carry the credentials you entrusted to us.
Cookies. Essential only. A session cookie keeps you signed in, and a short-lived cookie carries you through a GitHub sign-in and is then cleared. There are no advertising, profiling, or cross-site tracking cookies — which is why you have not been asked to accept any.
IP addresses. Our own application does not collect or store your IP address. Our hosting, authentication and email providers necessarily process it to deliver the service and to protect it from abuse.
Why we process it
To perform our contract with you — running the scans you ask for, showing you the reports, and billing you. Our legitimate interests — keeping the service working and secure, diagnosing failures, and understanding aggregate usage. Legal obligations — keeping the billing records tax and accounting rules require. Where the law requires consent, we ask for it first.
Who else processes it
We do not sell your personal information, and we do not share it for advertising. We use these service providers to run QAtesting, each handling only what its job needs:
Supabase — database, sign-in, and encrypted evidence storage · Vercel — hosting and analytics · Fly.io — the isolated worker that runs your crawl · Inngest — scheduling scan jobs · Stripe — payments · SendGrid — the sign-up confirmation and password-reset emails · Sentry — error reporting · Cloudflare — the emails we send about your scans, billing and account, and routing incoming mail: the disposable test-email address and our support address · Google — the inbox where mail to our support address is read · GitHub — only if you choose to sign in with it.
No AI or large-language-model provider is involved in a hosted scan. QAtesting’s checks are deterministic; the optional AI passes are developer tooling and are not part of the service you buy.
We may also disclose information if the law requires it, or to protect our rights or someone’s safety.
Where it is processed
In the United States. Our database is hosted in AWS us-west-2 (Oregon) and the crawl worker runs in iad (Virginia). If you are outside the US, using QAtesting means your information is transferred to and processed there.
How long we keep it
Scans: until you delete them or close your account. A scan, its findings, its coverage sitemap, its evidence screenshots and any test emails it received are kept so you can return to past reports and compare later scans against them. You can delete any finished scan yourself from its own page: it is then deleted from our database and our evidence storage — the screenshots included, not just the database rows — and its score leaves your score trend. Closing your account deletes all of them.
Kept after you delete a scan: your triage labels. So that your “not a bug” / “won’t fix” decisions keep applying to later scans, we keep the labels you gave findings, any note you added, and the page paths they apply to, after the scan they came from is deleted — no screenshots and no page content. Closing your account removes them.
Also kept longer, if you use write mode: the forms you promote. For each form you allow a scan to submit, we keep the page path, where the form submits, the names of its fields and the label of its submit button — never what was typed into it — text taken from your app, with personal details masked out — so a promotion keeps working across scans, and whether the form changes a record that already existed or needs you to allow destructive actions or sending. Each promotion, and each write-mode scan, also keeps a one-way fingerprint of the login it used — a keyed code, never the login itself — so a form you promote is submitted only by scans that sign in with that same login. Revoking one keeps the record, marked revoked. Closing your account removes them.
And a record of what write mode did, until you close your account. Each time you promote or revoke a form, and what it risks; for each write-mode scan, which forms you ticked, which were actually allowed to run, and whether you allowed destructive actions or sending; and for each form a scan submitted, the page path, the submit button’s label, what kind of write it was (a new record, an edit or a deletion, and whether it changed a record that already existed), the result and our QATEST test marker (so you can find the test record in your app) — plus the login fingerprint above, never anything typed into a form. It is not removed when you delete the scan, because it is the record of what we did to your site; closing your account removes it.
Until you close your account. Your email address, your domains, your scans and your billing history, which records the site each scan was for. Some billing records are kept for as long as tax and accounting rules require.
Your rights
Wherever you live, you can ask us to: give you a copy of your data, correct it, delete it, or stop or limit how we use it. Some of it you can do yourself right now — export any report as CSV or JSON, and delete any scan from its page.
To close your account and have its data deleted, email support@qatesting.ai — there is no self-serve button for this yet, so we do it by hand, and that includes the stored evidence. We aim to respond within 30 days.
If you are in the EU or UK, your rights of access, rectification, erasure, restriction, objection and portability apply, and you may complain to your local data protection authority. If you are in California, you have the right to know what we collect, to delete it, to correct it, and to opt out of the sale or sharing of personal information — we do neither, and we run no financial-incentive programs. We will never treat you differently for exercising any of these rights.
How we protect it
The login you give us and every evidence screenshot are encrypted at rest, and credentials are decrypted only inside the isolated worker that runs your crawl. Accounts are isolated from each other at the database level, not merely in application code. The crawl itself is read-only by default — the exception is write mode, which you turn on per scan: it submits only the create forms you have promoted (and, only if you also allow it for that scan, promoted forms that change or delete existing records or send messages), with obviously fake data, and edits each record it just created to check that saving works — and it is bounded to a domain you have proven you own — a cross-origin navigation is refused outright. One exception, and it matters because it is about where your login travels: if your app signs in through an external identity provider (SSO), the crawl follows that sign-in redirect so the login can complete, and only ever to a public host. Card details never touch our systems.
Being straight with you about the limits: no service is perfectly secure, and we hold no third-party security certification today.
Children
QAtesting is a tool for people building software, and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, email us and we will delete it.
Changes to this policy
If we change how we handle your information, we will update this page and the date at the top of it. The version you are reading is the current one.
Want the practical detail on how scans work? The FAQ covers what QAtesting does with your login and your data day to day.