Privacy Policy

1. Introduction

Your privacy is important to us. This Privacy Policy explains how SolvionIT (OPC) Private Limited, operating under the brand TestKase, collects, uses, discloses, and protects your personal information when you use our software testing platform accessible at https://testkase.com.

By accessing or using TestKase, you acknowledge that you have read and understood this Privacy Policy and consent to the practices described herein.

2. Scope of Policy

This Privacy Policy applies to everyone who uses or visits TestKase. That covers all four of our products — Test Management, Accessibility Testing, Live (interactive testing on real browsers and mobile devices) and Automate (automated testing on real browsers and mobile devices) — together with our web application, our APIs, our browser extensions (including the TestKase Chrome Extension for GitHub), our Jira plugin, and the real devices and virtual machines your tests run on.

It does not apply to any third-party websites or services that may be linked from our application. Separately, our Device Terms explain what you must not place on a shared device and what happens to a device between sessions, and our Legal Requests policy explains how we respond to law enforcement and government requests.

3. Information We Collect

We collect only the information necessary to provide and improve our services:

3.1 Account Information

When you create an account, we collect:

• Full name (first name and last name)
• Email address
• Password (stored as a bcrypt hash — we never store plain-text passwords)
• Organization name (when creating an organization)
• Profile picture (when signing up via Google or Microsoft OAuth)

3.2 Payment Information

Payment processing is handled entirely by Razorpay. We never see or store your full card number, CVV, or bank account details. To issue a compliant tax invoice we do store the billing details you give us at checkout: company name, billing contact email and phone number, billing address, state and postal code, a purchase order number where you supply one, and your tax registration numbers (such as GSTIN and PAN) where applicable — together with your subscription status. Razorpay also returns the last four digits of the card used and its card network, which we store on the payment record so that you can identify a charge.

3.3 Usage Data

We automatically collect certain information when you use our service:

• Pages visited and actions performed within the application
• Browser type and version
• IP address
• Timestamps of interactions
• Device and operating system information

3.4 Cookies & Tracking Technologies

We use first-party cookies to maintain your authentication state, Google Analytics for usage analytics, Google Ads for measuring which advertisements led to a sign-up, and Google reCAPTCHA for bot prevention during signup and certain form submissions. Analytics and advertising cookies are set only if you accept them. Our Cookie Policy lists each one, together with the data we keep in your browser’s local and session storage.

3.5 AI Feature Data

If you opt in to our AI-powered features (with client approval required), your test-related data may be sent to third-party large language model (LLM) providers for processing. This data is not used for model training by us or our LLM providers. AI features are optional and clearly indicated in the application.

3.6 Integration Data

When you connect third-party integrations (such as Jira or GitHub), we access only the data you authorize. Integration data is used solely to provide the requested functionality and is not shared with other third parties.

3.7 Browser Extension & Plugin Data

3.7.1 Chrome Extension for GitHub

When you use the TestKase Chrome Extension for GitHub, the extension collects and processes the following data:

• Authentication token: Stored locally in your browser using Chrome's storage API to keep you logged in across sessions
• GitHub page context: The current GitHub issue URL, repository name, issue number, and title are read from the active tab to display relevant test cases
• Tab navigation: URL changes are detected to update the extension's side panel when you navigate between GitHub issues

All extension data is stored locally on your device or transmitted only to the TestKase API (api.testkase.com). The extension does not execute any remote code — all scripts are bundled locally within the extension package. No data collected by the extension is sold or shared with third parties.

3.7.2 Jira Plugin (Forge App)

When you use the TestKase Jira Plugin, the app collects and processes the following data:

• Jira user account ID: Used to identify you within the plugin and associate your configuration
• Personal Access Token (PAT): Your TestKase PAT is encrypted and stored securely using Atlassian Forge's built-in secret storage (KVS) to authenticate API requests to TestKase
• Jira project and issue data: Project IDs, issue keys, issue summaries, and descriptions are read to map Jira projects to TestKase projects and link test cases to Jira issues
• User timezone: Retrieved from your Jira profile to display dates and times correctly
• Project mapping: The association between your Jira projects and TestKase projects is stored in the plugin's database

The Jira Plugin communicates only with the TestKase API (api.testkase.com) and Atlassian's Jira APIs. All data is processed within Atlassian's Forge infrastructure and is not shared with any other third parties. Test case attachments are stored securely in Amazon S3.

3.8 Testing Session Data (Live, Automate and Accessibility)

When you run a testing session on one of our browsers or real devices, we collect:

• Session recordings — video of the session, and video of individual tests where you use our test framework integration
• Screenshots you capture during the session
• Logs — browser console output, driver logs, device logs and test output
• Network activity, where you enable network capture. This records the requests and responses made during your session, including headers and content.
• A record of the commands your test sent to the device
• Files you upload into or download from a session, and any application packages you upload for installation on a device
• Session metadata — which user ran the session, from which IP address, on which device, and when it started and ended

Session recordings, screenshots, logs, network captures and session file transfers are deleted automatically 30 days after the session, on every plan. Uploaded application packages are deleted after 90 days, or sooner if you delete them yourself.

Share links. For Automate browser sessions you can create a link that lets anyone holding it view the session recording and logs without signing in. You choose how long the link lasts, including an option for it not to expire. A share link is a credential — anyone who obtains it has access. You are responsible for who you share it with, and for revoking links you no longer need.

3.9 Product Usage Records

So that we can tell how much TestKase is actually being used, we keep one record per person per day on which you actively use the product, noting the organisation you were working in and roughly how much of that day you were active. We do not record which pages you visited or what you did in them, and the record is only made while you are genuinely using the application — a tab left open in the background does not create one. These records are retained for up to 12 months, and are deleted when your account is deleted or when the organisation you belong to is deleted.

4. How We Use Your Information

We use the information we collect for the following purposes:

• Provide, operate, and maintain the TestKase platform
• Personalize and improve your user experience
• Analyze usage patterns to enhance platform performance and features
• Process subscription payments and manage billing
• Send transactional emails (verification, password reset, account notifications)
• Detect and prevent fraud, abuse, or security threats
• Power optional AI features (with your explicit consent)
• Provide customer support

5. Data Sharing and Third-Party Services

We do not sell, rent, or trade your personal information. We do share data with third-party service providers who help us operate the platform. Broadly, these fall into the following categories:

• Hosting, storage and content delivery — the providers that run our application, databases, object storage and network.
• Payments and billing — our payment processor.
• Email delivery — verification emails, password resets, notifications and summaries.
• Sign-in providers — where you choose to sign in with a third-party account.
• AI providers — for AI-assisted features, and for generating the embeddings that power test-case search. Your data is not used to train their models.
• Analytics, advertising measurement and abuse prevention — subject to your cookie choices where consent applies.
• Error monitoring and operational tooling — diagnostics that may carry your account or organisation identifier, and an IP geolocation lookup used for tax and fraud checks.
• Integrations you connect yourself — issue trackers and chat platforms receive only the data the integration you enabled is designed to send.

The complete, current list of these providers, naming each one and what it does, is published on our Sub-processors page. That page is the authoritative list and is kept up to date there; where it and this section differ, the Sub-processors page is the one to rely on.

We may also disclose your information when required by law, regulation, or legal process, or in connection with a merger, acquisition, or sale of assets.

6. Data Retention

We retain your personal data as follows:

• Account data: Retained for as long as your account is active.
• When you delete your account: Your access is revoked immediately — organisation membership, product access and any API keys stop working at once. Your account is marked deleted rather than erased: we retain the account record, including your name, email address and the encrypted (hashed) form of your password, so that you can return to TestKase later using the same address and so that records referring to you remain complete. If you were invited to an organisation by someone else, work you created within it remains with that organisation, and your name remains attributed to it, so that your colleagues’ records stay complete. If you would rather the account record were erased entirely than marked deleted, ask us and we will do that.
• If you own an organisation: deleting your account also deletes the organisation you own, every project in it, and the work your colleagues created inside it. This cannot be undone. If the organisation is to continue without you, transfer ownership to a colleague before you delete your account.
• When an organisation is deleted: All of its product data is removed — Test Management projects, test cases and attachments; Accessibility Testing scans and reports; and Automate and Live session recordings, logs and uploaded applications. Identifying details are removed from usage records, and the associated subscription is cancelled.
• Billing records: Retained as required for financial and tax purposes, including invoices and billing contact details.
• Security and audit records: Session audit records are retained for five years, as required under India’s CERT-In directions. These include the acting user’s email address, IP address and browser details, and are retained even after an account or organisation is deleted.
• Usage logs: Retained for up to 12 months for analytics and security purposes, except where the audit retention above applies.
• When a subscription ends: your organisation and its data are not deleted automatically. Access to paid features stops at the end of the billing period and the organisation reverts to Free plan limits; the data itself remains until you or we delete the organisation. Session recordings, screenshots, logs and network captures are still deleted 30 days after the session that produced them, and uploaded application packages after 90 days, whether or not a subscription is active. See our Cancellation Policy for how to reactivate, or how to have the organisation removed.

7. Data Security

We implement industry-standard security measures to protect your data, including:

• TLS/SSL encryption for all data in transit
• Bcrypt hashing for password storage
• Role-based access controls within the application
• Regular security audits and monitoring

While we strive to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

8. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate or incomplete data
• Erasure: Request deletion of your personal data
• Restriction: Request that we limit the processing of your data
• Portability: Request your data in a structured, machine-readable format
• Objection: Object to the processing of your personal data

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days. These requests are handled by a person rather than by a self-service tool: there is no “download everything” button in the product, so a portability or access request is fulfilled by us assembling and sending you the data. While you can still sign in you can also export most of your own content directly — test cases, test cycles, test plans, requirements and defects as CSV from within each project, and accessibility reports as PDF or CSV.

You may withdraw any consent you have given at any time, without affecting processing carried out before you withdrew it, and you may complain to your local data protection authority. In India, you can also raise a complaint with our Grievance Officer.

9. International Data Transfers

TestKase is operated from India, and our providers process and store data in locations that may be outside your country of residence. Our application services and databases are hosted on Railway, our web front end on Vercel, and testing artifacts in object storage provided by Cloudflare and Amazon Web Services. Each transfer is made because it is necessary to provide the Services you have asked us for, and each provider is engaged under its own data protection terms. We are still finalising, with legal advice, the specific transfer mechanism and the published list of processing locations; until that is complete we would rather tell you that than describe safeguards we have not yet documented. If you need the current position in writing before you commit, ask us at [email protected].

10. Cookies Policy

We use the following types of cookies:

• Essential cookies: Required for authentication and core platform functionality
• Analytics cookies: Used by Google Analytics to understand usage patterns and improve the platform
• Security cookies: Used by Google reCAPTCHA to prevent automated abuse
• Advertising measurement cookies: Set by Google Ads on our public website, only if you accept them, so that we can see which advertisements led to a sign-up. They are not used inside the product.
• Preference cookies: Remember small interface choices, such as the product area you last used.

We also keep a small amount of data in your browser’s local and session storage — sign-in state, a short-lived handover to our browser extension if you install it, and interface preferences. Our Cookie Policy describes all of it.

You can control or disable cookies through your browser settings, or change your consent at any time. See our Cookie Policy for the full list of cookies and how to update your preferences. Please note that disabling essential cookies may prevent you from using certain features of the platform.

11. Children's Privacy

TestKase is intended for use by adults. Our Terms of Service require you to be at least 18 years old to use the Services, and we do not knowingly collect personal data from anyone under 18. If you believe that a child has provided us with personal data, please contact us immediately and we will take steps to remove that information.

12. Third-Party Links

Our website or application may contain links to external websites. We are not responsible for the content, privacy practices, or policies of any third-party sites. We encourage you to review the privacy policy of any external site you visit.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Updates will be posted on this page with a new effective date. For material changes, we will notify you via email or through a prominent notice on the platform.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your data, please contact us: