Data Processing Addendum

Last updated: April 2026

Overview

This Data Processing Addendum ("DPA") supplements the QACrow Terms of Service for customers who are controllers of personal data subject to the GDPR, UK GDPR, or similar data protection regimes. By using QACrow you accept this DPA where applicable.

Roles

You are the data controller. QACrow acts as a processor for personal data you submit to the service in the course of running tests.

Subject matter and duration

QACrow processes personal data only to provide the service: storing your test plans, executing browser runs, surfacing results in your dashboard, and supporting your account. Processing continues for the duration of your subscription and any post-termination retention period described below.

Categories of data

• Account data: name, email, login credentials.
• Usage data: API calls, run history, billing records.
• Test artifacts: anything captured during a run, including screenshots and DOM snapshots.

Sub-processors

Our current sub-processors are listed on the sub-processors page. We will give 30 days' notice before adding a new sub-processor.

International transfers

Where personal data is transferred outside the EEA or UK, we rely on the EU Standard Contractual Clauses or the UK International Data Transfer Addendum.

Security

We maintain appropriate technical and organizational measures as outlined on the security page.

Data subject rights

We will assist you in fulfilling data subject access, deletion, and portability requests within the timelines required by applicable law.

Deletion

Upon termination you may export your data within 30 days. After that, we delete or anonymize personal data unless retention is required by law.

Signing the DPA

This DPA is incorporated into your Terms of Service automatically. If your procurement process requires a countersigned copy, email legal@qacrow.com.