The agreement behind the privacy page.
For teams whose contracts or regulators ask for one. Last updated 2026-10-13.
Not signed yet: this is the outline. The draft you sign is never narrower than this page. Write to privacy@qa.pro with your team's name and we send you the current draft to sign.
Roles and data
- Controller
- your team, for the sites it adds, the test accounts it enters and the people it invites
- Processor
- the operator of qa.pro, named in the draft we send you to sign, for the results it stores and the runs it executes on your instruction
- Data
- site addresses, a test account per site if you enter one, screenshots and logs of the pages the browser opened (which may show your site's content), verdicts and reasons, your members' e-mail addresses
- Purpose
- checking your sites the way you asked, keeping the reports, telling you when something changes; nothing else, and never to train a model
- Term
- while your team exists; deleting the team deletes its data, and an expired trial keeps its reports 90 days, then the Free plan's retention applies
Sub-processors and transfers
- Cloudflare (USA)
- every request to qa.pro passes its network (our address is behind it)
- Hetzner (Germany)
- the servers that run qa.pro and keep your account, sites, checks and reports
- DataPacket (USA)
- the browsers that open your site
- DeepInfra (USA)
- the AI judge: it sees screenshots and page text of your site while a check runs, never your account
- Google (USA)
- the mail relay: invitations, password resets and alerts (site names, check names, reasons)
- Transfers
- we make no EU-residency claim; transfers out of the EEA rest on the standard contractual clauses attached to the agreement, and the list of sub-processors is part of it, with 30 days' notice of a change
- Security
- the measures on the security page are the technical and organisational measures of the agreement
Your rights under it
Instruct, audit, export and delete. Export the team's data as one file from Settings at any time; delete the team yourself; ask us for the record of processing or to help with a data-subject request, and we answer within 30 days.