Privacy policy

01Who we are

[LEGAL ENTITY NAME] (“we”, “us”) runs ThousandTesters and is responsible for your personal data under India’s Digital Personal Data Protection Act, 2023 and, where it applies, the EU and UK GDPR. Our registered address is [REGISTERED ADDRESS].

02What we collect

We only collect what we need to run test cycles and pay people.

• Account details: name, email, password (stored hashed) or Google sign-in ID.
• Tester profile: country, timezone, languages, devices, browsers, skills and availability.
• Client details: company name, billing details, GSTIN and product information you give us.
• Session recordings: page activity, clicks, network calls and console logs captured by our extension during an active test cycle.
• Bug reports, screenshots, videos and comments.
• Payout details: UPI ID, bank account or PayPal/Wise email, plus PAN where tax law requires it.
• Usage data: IP address, browser type and pages visited, for security and to improve the Service.

03What the extension records

The recorder extension only records while a Tester has started a session for an active cycle, and only on the domains the Client listed for that cycle. It does not record other tabs, other websites or anything outside the browser. Password fields are masked in recordings.

04How we use your data

We use your data for these purposes only:

• To run test cycles: match Testers to cycles, deliver bug reports and recordings to Clients.
• To check quality: detect duplicate and fake reports, including with AI models.
• To pay Testers and bill Clients, and to meet tax and accounting rules.
• To send service emails such as verification, password resets and cycle updates.
• To keep the Service secure and prevent fraud.

05AI processing

We use AI models from OpenAI to compare bug reports for duplicates, suggest severity and category, and write cycle summaries. Bug report text and metadata are sent for this purpose. Recordings are not sent to AI models. [CONFIRM OPENAI DATA TERMS BEFORE PUBLISHING]

06Who we share data with

We share data only with the parties needed to run the Service:

• The Client running a cycle receives the bug reports and recordings from that cycle.
• Hosting and storage: MongoDB Atlas, Cloudflare R2, Vercel, Render.
• Email: Resend. AI: OpenAI.
• Payments and payouts: Razorpay, RazorpayX, PayPal, Wise.
• Authorities, when the law requires it.

07How long we keep data

Session recordings and bug attachments are kept for [N] days after a cycle ends, unless the Client deletes them sooner. Payment and tax records are kept for as long as Indian law requires. Account data is deleted within [N] days of closing your account.

08Your rights

You can ask to access, correct or delete your personal data, withdraw consent, or nominate someone to act for you. You can also complain to the Data Protection Board of India or your local regulator. To use these rights, contact our Grievance Officer below. We reply within [N] days.

09Cookies

We use essential cookies to keep you signed in and protect against fraud, and [optional analytics cookies] to understand how the site is used. You can turn optional cookies off in your browser.

10Security

Data is encrypted in transit and at rest. Access is limited to staff who need it. If a breach affects your data, we will tell you and the authorities as the law requires.

11International transfers

Some of our providers store data outside India. We only use providers with appropriate safeguards and transfer data only to countries the Indian government has not restricted.

12Grievance Officer

Name: [NAME]. Email: [EMAIL]. Address: [REGISTERED ADDRESS]. We acknowledge complaints within [48 hours].

13Changes to this policy

We will post any changes here and email you about material changes before they take effect.