Privacy Policy

01Data we collect

• Account data: name, email address, hashed password, organization name and role.
• Billing data: plan, payment status and amounts. Card details are handled by our payment provider and never stored by us.
• Usage data: domains, campaigns, test results, API token metadata and an audit log of security-relevant actions.
• Technical data: IP address and user agent for sign-in, security and abuse prevention. Active sessions, with their user agent, are listed under Settings, Security, where you can end them.
• Integrations: if you connect Google Analytics, we store a read-only OAuth token, the Google account email and the chosen property ID. Disconnecting revokes the token at Google and deletes it.
• Messages: what you send through the contact form, including any target URL in an abuse report.

02Test results

Test events record response codes, timing, sizes and error codes from your own systems. Browser validation sessions also record the analytics event names and measurement IDs they observed, load times, and a count of console errors, not their text. We do not collect personal data about your site's visitors: our sessions are automated and never interact with real users.

03How we use data

• To provide, secure and bill for the Service.
• To detect and prevent abuse, including unauthorized targeting.
• To send transactional email: verification, password reset and billing notices.

04Cookies

We use a strictly necessary HTTP-only session cookie (ats_session) and a CSRF protection cookie (ats_csrf). We do not use advertising or analytics cookies.

05Retention

Account data is kept while your account is open. Billing and audit records are kept as long as the law requires.

Raw execution events, the detailed records behind a campaign's report and its CSV export, are kept for 90 days after the campaign settles, which happens once it has ended and its unused credits have been released. The period is set for the whole platform and is the same on every plan. After it, the raw events are deleted. The campaign keeps a frozen copy of its summary report and its daily totals, and the report notes that the raw events were removed.

When you close your account, your email address is removed from it, your sessions end and you leave every organization. If you were an organization's only owner, that organization is closed and its active campaigns are cancelled.

06Your rights

You can update your profile, download a copy of your data as JSON and close your account from Settings, Privacy. For anything else, including correction or deletion requests, write to us.