Privacy Policy

Rishabh Yadav (TestHive), of Mumbai, Maharashtra 400101, India, is the controller of the personal data described here. For privacy questions contact privacy@testhive.tech.

Account data

• Your name and email address, supplied at sign-up or through a magic-link sign-in.
• A hashed password, when you set one. We never store your password in readable form.
• Your organisation, plan and audit allowance.

Scan and test data

• The URLs you ask us to test, and the pages and endpoints discovered from them.
• Evidence captured while testing: screenshots, page snapshots, console output, and HTTP request and response metadata.
• Test credentials you choose to supply so the service can reach authenticated pages. These are stored encrypted and used only to sign in to the target you nominated.

Scan evidence can incidentally contain personal data if it appears in your application — for example a customer name visible on a page we screenshot. You control which environments you point the service at. We strongly recommend testing against staging data rather than live customer records.

Billing data

Subscriptions are sold by our Merchant of Record, Paddle.com Market Ltd. They collect and process your payment details directly. We never see or store your card number. We receive only a customer reference, subscription identifier and status so we can activate your plan.

Usage data

• Basic product analytics: pages visited within the application and features used.
• Server logs including IP address and user agent, kept for security and debugging.

• To provide the service — running the scans you request, storing their results, and showing them back to you. Basis: performance of our contract with you.
• To take payment and manage subscriptions. Basis: performance of our contract.
• To keep the service secure — detecting abuse, unauthorised scanning and fraud. Basis: our legitimate interests.
• To improve the product — aggregate usage patterns and reliability. Basis: our legitimate interests.
• To send service messages such as scan completion and billing notices. Basis: performance of our contract.

We do not sell personal data, and we do not use your scan evidence to train AI models.

We use a small number of processors, each only for the purpose listed:

• Paddle.com Market Ltd — payment processing, tax and invoicing as Merchant of Record.
• AI model providers — where AI-assisted planning or failure diagnosis is enabled, the relevant page structure and error text is sent to the configured provider to generate test plans and explanations. Only what is needed for that request is sent.
• Hosting and infrastructure providers — to run the application and store scan evidence.

We may also disclose data where required by law, or to protect our rights, users or the public.

Our providers may process data outside your country. Where data leaves the UK or EEA we rely on an adequacy decision or on standard contractual clauses with the provider.

• Account data: for as long as your account is open, and then up to 90 days after closure.
• Scan evidence such as screenshots and logs: retained so you can review past runs, and deleted when you delete the run or close your account.
• Billing records: kept as long as tax and accounting law requires, typically six to seven years.
• Server logs: typically 30 days.

• Traffic to the service is encrypted in transit over HTTPS.
• Passwords are stored hashed; stored target credentials are encrypted at rest.
• Access to production data is limited to those who need it to operate the service.

No system is perfectly secure. If a breach affects your personal data we will notify you and the relevant regulator where the law requires it.

Depending on where you live you may have the right to access, correct, delete, restrict or object to our use of your personal data, to receive a portable copy, and to withdraw consent. Exercise any of these by emailing privacy@testhive.tech. We respond within one month.

If you are in the UK or EEA and are unhappy with our response, you may complain to your local data protection authority.

We use a strictly necessary cookie to keep you signed in. We do not use advertising cookies. Blocking the session cookie will prevent you from signing in.

The service is intended for business use and is not directed at anyone under 16. We do not knowingly collect their data; if you believe we have, contact us and we will delete it.

We will post any update here and change the date above. Material changes will be notified by email or in the application.

Privacy enquiries: privacy@testhive.tech. General support is on the contact page.