What we store, and why.
Last updated 2026-10-13. The company behind qa.pro and its address: ask privacy@qa.pro.
What we store
- Account
- your e-mail address and a salted hash of your password
- Team
- its name, settings, members and invitations
- Sites
- the URLs you add; a test account per site if you enter one, set by admins; its password is stored on our server so that the nightly checks can sign in, and is never shown again, never exported and never part of a report
- Results
- verdicts, reasons, a screenshot of each step of each check (full size where a check failed), and the logs of the run with the test account's password blanked out; the logs can hold text that was on a page, and a page's source is not stored
- A look without an account
- the address you typed and its report, readable by whoever holds its link, erased after 3 days unless an account keeps it
- Audit log
- changes made in your team and the address they came from, visible to admins
Where the checks run
- Our browsers
- open your site (signed in, if you gave a test account) and send each verdict with its screenshots to your report. Their working files are deleted once the run is over; their log keeps the site's address and the checks' names and verdicts, never a page, a picture or a password.
- The verdict
- the AI judge (DeepInfra, below) reads a check's screenshots and page text to reach it; it never sees your test account's password
- Your side
- nothing is installed and nothing of ours runs there
Who else sees data
- Cloudflare (USA)
- every request to qa.pro passes its network (our address is behind it)
- Hetzner (Germany)
- the servers that run qa.pro and keep your account, sites, checks and reports
- DataPacket (USA)
- the browsers that open your site
- DeepInfra (USA)
- the AI judge: it sees screenshots and page text of your site while a check runs, never your account
- Google (USA)
- the mail relay: invitations, password resets and alerts (site names, check names, reasons)
- Your webhook
- the same alert as JSON, to the address you set
- Share links
- a report's verdicts and screenshots, to anyone holding the link, until you revoke it
Nothing else sees your data. Nothing is sold or shared for advertising.
How long
- Runs
- a report with its screenshots and logs: the history period of your plan (Free 30, Solo 90, Plus 90, Team 365, Agency 365 days); 90 days after a trial ends or a subscription is cancelled; a shared report a year
- Account
- while it exists; the audit log keeps the e-mail on the actions it records for 730 days, also after deletion
- Deleting
- a run removes its results and screenshots at once; a site keeps its past results until they expire; a team removes everything it held and ends its subscription
- Disk
- when the data volume runs low, the oldest evidence past a week goes first, teams that never paid before paying ones
- Backups
- a nightly copy of the database and the stored results, kept at most a year (daily copies two weeks, weekly two months, monthly a year)
Where
Every run executes on machines we operate. Nothing runs on yours. Your account, your sites and every report are stored in Germany.
Cookies
A session cookie keeps you signed in; on the demo, a two-hour cookie for the demo team; after you send a form, a fifteen-minute cookie so the page can show its answer. Besides these, the page keeps two marks in your browser for the open tab only — which pictures of a running report you have seen, and whether a panel is open; they are never sent to us and go when the tab closes.
Your rights
Delete your account or a team you own yourself. Export your team's sites, checks and report verdicts as one file; screenshots stay on the report pages while the reports are kept. For anything else, write to us; we answer within 30 days.
The account page and the export need you to be signed in.