This Privacy Policy explains how QACrow ("QACrow," "we," "us," or "our") collects, uses, shares, and protects personal data when you visit our websites, create an account, or use our AI-powered QA testing services (collectively, the "Service"). By using the Service, you agree to the practices described here. If you do not agree, please do not use the Service.

1. Who We Are

QACrow is the controller of personal data we collect when you interact with our marketing site, sign up for an account, or use the Service. When you use the Service to process information about other people (for example, by testing an application that contains end-user data), you are the controller of that data and we act as your processor.

2. Data We Collect

2.1 Information you provide

  • Account information. Name, email address, organization, and authentication identifiers (such as a Google account ID when you use social sign-in).
  • Billing information. Plan and credit balances, transaction history, and the last four digits of payment cards. Full payment-card details are handled by our PCI-DSS-compliant payment processor and are not stored on our systems.
  • Customer Content. Test plans, target URLs, instructions, credentials you choose to provide for testing, screenshots, browser recordings, run results, bug reports, API keys, webhook configurations, and any messages you send to support.
  • Communications. Email correspondence, support tickets, and feedback.

2.2 Information we collect automatically

  • Device and log data. IP address, user-agent, browser and operating-system metadata, referring URLs, pages viewed, timestamps, and crash diagnostics.
  • Usage data. Feature interactions, run counts, credit consumption, and aggregated performance metrics.
  • Cookies and similar technologies. Session cookies for authentication, preference cookies, and limited first-party analytics. We do not use cross-site advertising trackers.

2.3 Information from third parties

When you sign in with a third-party identity provider, we receive your name, email, and a unique user identifier from that provider. When you make a purchase, our payment processor returns transaction metadata and limited card details (such as the last four digits and brand) so we can display receipts.

3. How We Use Data

We use personal data to:

  • provide, secure, maintain, and improve the Service;
  • execute the test runs and AI evaluations you request;
  • process payments, manage credits, and send transactional emails (receipts, run notifications, magic-link sign-in, password resets, alerts);
  • communicate with you about updates, security advisories, and (with your consent or where permitted) product news;
  • detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms;
  • comply with legal obligations and enforce our agreements; and
  • generate de-identified, aggregated insights that do not identify you or your end users.

We do not sell personal data, and we do not use Customer Content to train foundation models. We may use de-identified telemetry to monitor service health and improve features.

4. Legal Bases (EEA / UK)

If you are in the European Economic Area or the United Kingdom, our legal bases for processing personal data are: performance of a contract (to provide the Service), legitimate interests (to secure, improve, and market the Service in a way that does not override your rights), consent (where required, such as for certain cookies or marketing emails), and compliance with legal obligations.

5. How We Share Data

We share personal data only as described below:

  • Service providers (subprocessors). We use vetted third parties to host infrastructure, execute browser-automation runs, evaluate test plans with large language models, send transactional email, process payments, and provide customer support. These providers process data on our behalf under written contracts that require appropriate confidentiality, security, and data-protection commitments. The categories of subprocessors we use are listed in Section 6.
  • Targets you instruct us to test. When you submit a test, we transmit the instructions and credentials you provide to the URL or application you specify so that the test can run. You are responsible for ensuring you are authorized to test those targets.
  • Legal and safety. We may disclose data when we reasonably believe disclosure is required to comply with law, lawful process, or government request, to enforce our Terms, or to protect the rights, property, or safety of QACrow, our users, or others.
  • Business transfers. If QACrow is involved in a merger, acquisition, financing, or sale of assets, personal data may be transferred subject to standard confidentiality protections; we will notify you of any change in control of your personal data.
  • With your consent. We will share personal data with other parties when you direct us to do so.

6. Subprocessor Categories

To deliver the Service we rely on third-party providers in the following categories. We periodically review these providers and may add or change them; we will keep this list current.

  • Cloud hosting and database infrastructure
  • Object storage and content delivery
  • Browser-automation and headless-browser execution platforms
  • Large-language-model and AI inference providers
  • Transactional and notification email delivery
  • Payment processing and tax calculation
  • Error monitoring and application performance monitoring
  • Customer-support and ticketing tools
  • Identity providers used for social sign-in

A current named list of subprocessors is available on request to privacy@qacrow.com.

7. International Transfers

QACrow is based in the United States, and our subprocessors may operate in other countries. When we transfer personal data outside your jurisdiction, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, UK International Data Transfer Addenda, or equivalent mechanisms.

8. Data Retention

We retain account and billing data for as long as your account is active and for a reasonable period afterward to comply with legal obligations, resolve disputes, and enforce our agreements. Customer Content (including run results and recordings) is retained for the duration described in the Service or your plan, after which it is deleted or de-identified. You can delete most Customer Content from within the Service at any time. Backups containing residual data may persist for a limited period before being overwritten.

9. Security

We implement administrative, technical, and physical safeguards designed to protect personal data, including encryption in transit (TLS), encryption at rest for databases and object storage, strict access controls, audit logging, dependency scanning, and regular security reviews. No system is perfectly secure; if you believe your account has been compromised, contact us immediately at security@qacrow.com.

10. Your Rights

Depending on where you live, you may have the right to access, correct, delete, port, or restrict the processing of your personal data; to object to processing based on legitimate interests; and to withdraw consent. California residents have additional rights under the CCPA/CPRA, including the right to know what categories of personal information we collect and the right to opt out of "sales" or "sharing" (we do not engage in either). To exercise these rights, email privacy@qacrow.com. We will respond within the time required by applicable law and may need to verify your identity before fulfilling the request. You also have the right to lodge a complaint with your local data-protection authority.

11. Children

The Service is not directed to, and we do not knowingly collect personal data from, children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

12. Cookies and Tracking

We use first-party cookies and local storage to keep you signed in, remember preferences, and measure aggregate usage. You can control cookies through your browser settings; disabling cookies may impair the Service. We do not respond to "Do Not Track" signals because no industry standard exists, but we do not engage in cross-site behavioral advertising.

13. Marketing Communications

We may send service-related emails (such as receipts, sign-in links, and security notices) that you cannot opt out of while you have an active account. Where required, we will obtain your consent before sending marketing emails, and you can unsubscribe at any time using the link in those emails.

14. Automated Decision-Making

The Service uses AI to evaluate test plans and to summarize browser-test results. These outputs are generated by automated systems and may contain inaccuracies or omissions. They are intended to assist, not replace, human review. We do not use AI to make legal or similarly significant decisions about you.

15. Changes to This Policy

We may update this Privacy Policy from time to time. If changes are material we will provide notice (for example, by email or in-product notification) before they take effect. The "Effective date" at the top of this page indicates when this version was published.

16. Contact

For privacy questions or to exercise your rights, contact privacy@qacrow.com. For security disclosures, contact security@qacrow.com.