Who this policy covers
This policy describes information processed when you use TestPilot AI, including guests, account holders and people who contact support. You can contact the service operator through WhatsApp: +91 9019724050 for privacy questions or requests.
Information you provide
We process account details such as name, email address and an account identifier. Email/password accounts store a bcrypt password hash rather than a plaintext password. Google sign-in uses your Google account identifier and verified profile details needed to authenticate and link your account. We also process requirements, generated cases, saved project names and revisions, feedback and support messages you choose to provide.
Usage, browser storage and security
We keep trial counts, login and generation activity, payment/activation records and operational security data. The website uses browser local storage for login tokens, a browser identifier, usage/history preferences, recent generations, remembered email preferences and export templates. Clearing local storage can remove browser-only history or guest purchase context; it does not erase server-side records. Network requests expose technical data such as IP addresses to our hosting providers. Trial enforcement primarily links browser and account identities; a hashed IP fallback can apply when those identities are unavailable. Rate limiting also uses hashed email/IP identifiers.
Why we process information
We use information to authenticate users, recover accounts, generate requested results, save and restore work, maintain trial limits, activate paid access, connect authorized integrations, send essential account emails, respond to support, measure service use and protect the service. Depending on applicable law, the basis may be providing the service you request, legitimate operational/security interests, legal obligations, or consent for optional integrations. Permissions can be revoked at the relevant provider.
AI processing and sensitive inputs
Requirements and relevant issue content submitted for generation are sent to OpenAI through its API to produce results. Their handling is also governed by the applicable OpenAI API terms and data policies. Do not submit passwords, API keys, card details, sensitive personal data or confidential client material without the necessary authorization. Generated examples can resemble personal data; review results before use or sharing.
Service providers and optional integrations
Providers used to deliver the service include OpenAI for generation; Supabase for database hosting; Render for the backend; Vercel for website hosting and usage analytics; Resend for password-reset email; Google for optional sign-in and externally loaded fonts/sign-in resources; and Atlassian for optional Jira access. Paddle handles current checkout, receipts and payment events as Merchant of Record. Razorpay may process legacy transactions. These providers receive the information necessary for the selected feature and may process technical data under their own policies. Jira OAuth tokens are stored encrypted so authorized API requests can be made; disconnecting Jira removes the stored connection.
Payments
Paddle collects payment details in its checkout. TestPilot AI receives transaction references, purchase status, amounts/currency and receipt/account details needed to activate and reconcile access. We do not store full card numbers or card security codes in the application. Payment providers maintain their own legally required financial and fraud-prevention records. Refund and transaction questions may require communication with Paddle or the original payment provider.
Sharing and international processing
We use the providers described above to operate the service and may disclose relevant information when necessary to comply with law, protect security, address abuse or resolve a payment dispute. Processing and hosting may occur outside your country, including where those providers operate. Provider-specific safeguards and applicable privacy laws govern those transfers. This policy does not claim that data remains in a single country.
Retention and security
Account details, saved projects and revisions are retained while needed to provide the account and resolve operational, security or legal obligations. Payment records may need to be retained for accounting, fraud prevention or dispute handling after account closure. Browser-only history remains until it is removed from that browser or by the app. Reset links expire after 20 minutes, are stored as token hashes and work once. We use access controls, password hashing and encrypted connections, but no system can guarantee absolute security.
Your choices and requests
You can sign out, manage browser storage, disconnect Jira, revoke provider permissions, or request access, correction, export, account closure or deletion through WhatsApp: +91 9019724050. We may need to verify ownership before acting. Rights, exemptions and response periods depend on applicable law; some financial/security records may need to be retained. Saved account data and browser storage are separate: clearing your browser is not an account-deletion request. You may also have rights to object, restrict processing, withdraw consent or complain to a relevant authority.
Children and updates
The service is intended for people able to enter into these terms and is not directed to children under 18. Do not submit children’s personal information. We may update this policy as the service changes; the last-updated date identifies the current version. Material changes will be communicated as required by applicable law.