The agreement behind the privacy page.
For teams whose contracts or regulators ask for one. Last updated 2026-09-29. The signed template is being finalised; this page says what it covers and how to get it. Written to be read, not scrolled past.
Not signed yet. The agreement below is the outline of the document we sign, not the document. Until the template is final, write to privacy@qa.pro with your team's name and we send you the current draft to review and sign; the terms on this page will not get narrower than what the draft says.
Roles and data
- Controller
- your team, for the sites it adds, the test accounts it enters and the people it invites
- Processor
- the operator of qa.pro, named on the privacy page, for the results it stores and the runs it executes on your instruction
- Data
- site addresses, a test account per site if you enter one, screenshots and logs of the pages the browser opened (which may show your site's content), verdicts and reasons, your members' e-mail addresses
- Purpose
- checking your sites the way you asked, keeping the reports, telling you when something changes; nothing else, and never to train a model
- Term
- while your team exists; deleting the team deletes its data, and an expired trial keeps its reports 90 days, then the Free plan's retention applies
Sub-processors and transfers
- Hosting
- Hetzner Online GmbH, Falkenstein (DE): the database and the stored results
- Browsers
- every check runs on machines qa.pro operates in the United States; the pages they open and the test accounts they use pass through there. The run's working files are deleted from the machine when the run ends, or when the service next starts after a run that was cut off. The machine's log keeps the site's address and the names and results of the checks; no page, no picture, no password.
- a mail relay for invitations, resets and alerts (site names, check names, reasons)
- Transfers
- we make no EU-residency claim; transfers out of the EEA rest on the standard contractual clauses attached to the agreement, and the list of sub-processors is part of it, with 30 days' notice of a change
- Security
- the measures on the security page are the technical and organisational measures of the agreement
Your rights under it
Instruct, audit, export and delete. Export the team's data as one file from the account page at any time; delete the team yourself; ask us for the record of processing or to help with a data-subject request, and we answer within 30 days.
Getting it signed
Write to privacy@qa.pro with your team's name; we send the current draft to sign.