TestPulse Privacy Policy

Effective date: 3 November 2026 Last updated: 3 November 2026

This Privacy Policy explains what information TestPulse collects, why we collect it, who we share it with, how long we keep it, and the choices you have. It covers the TestPulse website and web app, the TestPulse Chrome extension, and any related services (together, the "Service").

TestPulse (test-pulse.in) is run by its founders, [Founder 1 full name] and [Founder 2 full name], based in [City, State], India ("TestPulse", "we", "us", "our"). TestPulse is not yet a registered company. When we register one, it will take over running TestPulse and the responsibilities in this policy, and we will tell you by email and update this page. If you have any question about this policy, write to support@test-pulse.in.

---

1. The short version

• TestPulse is a tool for software teams. It records and replays tests of websites, suggests fixes with AI when a test fails, and lets you raise bugs with a screenshot and technical details attached.
• The extension only captures a website when you start something: recording a test, running a test, or raising a bug. It does not track your general browsing.
• Passwords and card numbers you type during a recording are encrypted, and are masked in screenshots, page snapshots and network logs.
• We do not sell your data. We do not use it for advertising. We do not let AI providers train their models on it.
• Your team's tests, recordings, run results and bug reports belong to your company. We process them on your company's behalf.
• Videos, screenshots and network files from test runs are deleted after 30 days. Bug reports are deleted after 12 months.

The rest of this policy gives the detail.

---

2. Who is responsible for your data

TestPulse plays two different roles, depending on the data.

If you are a tester whose company uses TestPulse, or a person whose details appear on a website being tested, your company (or the website owner) is the main contact for questions about Workspace Content. We will help them answer you.

---

3. Information we collect

3.1 Account and workspace information

When you sign up or are invited, we collect:

• your name and email address;
• your company name (it becomes your workspace name) and the name of your first project;
• your password, which we never store in readable form. We store only a salted, one-way hash (scrypt);
• your role (admin, member or viewer) and which projects you belong to;
• the name, email address and role of anyone you invite.

We also store technical records needed to keep you signed in and secure: login session tokens (stored only as a hash), failed login attempts, temporary locks after repeated failed attempts, and one-time links for email verification, password reset and invitations (also stored only as a hash).

3.2 Test recordings

When you record a test, the extension saves the steps you take on the website you are testing. Each step can include:

• the page address (URL);
• what you clicked, typed, selected, scrolled or dragged, and how to find that element again (its selector, visible text and nearby labels);
• text you typed into fields;
• small sample files you uploaded during the recording (so the test can upload them again on replay).

We keep earlier versions of each test so your team can see its history and restore an older version.

Passwords and other secret fields. Text typed into password fields, card fields and one-time-code fields is treated as a secret. It is held only in the extension's temporary memory until the test is saved. On save it is encrypted (AES-256-GCM), tied to your workspace and to the exact website where it was typed. When a test is replayed, the password is decrypted only at the moment it is typed back into that same website, and is not shown to anyone.

Other text is stored as typed. Names, email addresses or other details you type into ordinary fields during a recording are saved as part of the test. We strongly recommend using test accounts and made-up data when you record tests, not real customer or personal data.

3.3 Test runs

When you run a test, the extension opens a private (incognito) Chrome window on your own computer and replays the steps. To show you what happened, especially when a test fails, the Service can capture:

• a video of the run;
• a screenshot at the point of failure;
• a snapshot of the page's structure (the HTML of the page);
• console messages and page errors from the website;
• a network log (the requests the page made, and for failed requests, their content);
• run details: browser version, operating system, window size, page address and page title.

Before anything is saved, we hide sensitive data we can recognise: passwords and card fields are masked in screenshots and page snapshots; authorization headers, cookies and any header that looks like a token, secret or key are blanked in network logs; and the passwords saved in your test are stripped out of all captured evidence. Other information that appears on the website you are testing (for example, names or emails shown on screen) is not automatically hidden, so again, please test with non-personal data.

The run window may share sign-in state with other private windows you have open. TestPulse never deletes your browser's cookies, cache or site storage.

3.4 Bug reports ("Raise bug")

When you raise a bug, the extension captures the tab you are looking at in your normal Chrome window. Depending on the features available in your plan and the options you choose, a bug report can include:

• a screenshot (visible area, a selected area, or the full page), with any markup you add;
• a screen or tab video you record;
• Rewind: a replay of the last couple of minutes on that tab (see below);
• console logs, network requests and page errors from the tab;
• device and browser details: browser and version, operating system, screen and window size, time zone, language and page address;
• the steps you took, if the bug is raised while recording a test or from a failed run;
• the title, description, expected and actual result, priority, assignee, tags and comments you enter.

Before you submit, you can black out any part of a screenshot. Query strings are removed from page addresses and bearer tokens are filtered out of report text automatically.

Rewind only works on websites where it is switched on. By default it is on for your project's own test servers and off everywhere else, and you can add or remove websites in settings. Rewind data stays in your browser and is uploaded only if you raise a bug with it attached. Password fields are never captured.

"Report a problem with TestPulse." If you send a report about TestPulse itself (rather than about your own website), it goes to the TestPulse team so we can fix the problem. It may include a screenshot, the same technical details listed above, and your contact details so we can reply.

3.5 AI features

TestPulse uses AI to explain why a test failed, suggest how to fix it, write bug report titles and reproduction steps, and suggest wording for some tickets. To do this, we send the AI provider only what it needs for that one task, for example:

• the test's name and step descriptions and which step failed;
• the error message;
• failing network requests (address, status, and up to a few kilobytes of the request and response);
• console errors and page errors;
• a trimmed copy of the page structure and the order of events;
• the failure screenshot.

Before sending, we remove tokens, passwords and similar secrets that we can detect, and we cap the size of what is sent. AI output is a suggestion and can be wrong. Your team can mark a suggestion as helpful or wrong, and we keep that feedback to improve TestPulse's prompts and checks.

We use AI providers under terms that do not allow them to use your data to train their models. AI features can be switched off for your workspace: ask your workspace admin, or contact us.

3.6 Integrations

If an admin connects a ticket or chat tool (for example GitHub, GitLab, Jira or Slack), TestPulse sends bug and failure details to that tool when your team asks it to, or automatically where your admin has set that up. This can include the report text, steps (never typed passwords), error, technical details, AI verdict, a screenshot or a link to it, and a link back to TestPulse. The access token for the integration is encrypted. Once data is in that tool, the tool's own privacy policy applies.

3.7 Sharing links

Your team can create links to a bug or recording. Unless your team chooses otherwise, these links open only for people signed in to TestPulse with access to that project. Links can be set to expire or be switched off at any time.

3.8 Website use, analytics and logs

• Server logs. Our servers log basic request details (IP address, time, page or API address requested, and response status) to keep the Service secure and working. Sign-in headers and cookies are removed from these logs.
• Product analytics. The web app may use PostHog to count a small number of product events (for example, "a report was sent"). It identifies you only by an internal user number, not your name or email. It does not record your screen, does not capture what you click or type, and is off if your browser sends a "Do Not Track" signal. The Chrome extension has no analytics.
• Support. If you email us, we keep the conversation and anything you attach.

3.9 Billing information

If you buy a paid plan, our payment provider collects your card or payment details directly. We receive only what we need for our records, such as the billing name, company, address, tax number, plan and the last digits of the card. We do not store full card numbers.

---

4. The Chrome extension and its permissions

The TestPulse extension asks Chrome for these permissions. Here is why:

Chrome Web Store Limited Use. The use of information received from Google APIs and the Chrome extension will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. In particular, we use extension data only to provide and improve TestPulse's single purpose (recording, replaying and reporting on website tests and bugs); we do not sell it; we do not use or transfer it for advertising, credit checks or lending; and our staff do not read it unless you ask us to (for example, in a support request), it is needed for security or abuse investigations, it is required by law, or it has been aggregated and anonymised.

---

5. How we use information

We use information to:

1. Provide the Service: create your account and workspace, save and replay tests, show run results, create and share bug reports, run AI analysis, and send data to integrations you connect.
2. Keep it secure: verify emails, protect against password guessing, detect abuse, and investigate problems.
3. Communicate with you: send service emails such as verification links, password resets, invitations and important notices about the Service or this policy. We do not send marketing emails unless you agree to receive them, and you can unsubscribe at any time.
4. Support you: answer questions and fix issues you report.
5. Improve TestPulse: understand which features are used and where the product fails, using limited analytics, AI feedback, and reports you send us. We do not use your Workspace Content to build products for other customers, and we do not use it to train AI models.
6. Bill you for paid plans and meet tax and accounting rules.
7. Meet legal obligations and enforce our Terms.

Legal bases (for people in the EU, UK and similar regions). We rely on: contract (to provide the Service you or your company signed up for); legitimate interests (security, product improvement and limited analytics, balanced against your rights); consent (where we ask for it, such as optional marketing, and you can withdraw it any time); and legal obligation (tax, accounting, lawful requests).

---

6. Who we share information with

We do not sell or rent personal data, and we do not share it for advertising.

We share it only with:

Service providers (sub-processors) that help us run TestPulse, under contracts that require them to protect it and use it only to provide their service to us:

We will keep this list up to date and, where our agreement with your company requires it, give notice before adding a new sub-processor.

Tools your team connects, such as GitHub, GitLab, Jira or Slack, when your team sends data there.

People in your workspace, according to their role and project access. For example, project members can see that project's tests, runs and bugs.

Authorities or others where the law requires it, or where needed to protect the rights, safety or property of TestPulse, our users or the public.

A company we set up to run TestPulse, or a buyer or successor if TestPulse is merged, acquired or sells its assets. The data would stay protected by this policy, and we will tell you before it becomes subject to a different policy.

---

7. International transfers

TestPulse and our providers may store and process data in countries other than yours, including India, the United States and the European Union. When we transfer personal data out of the EU, UK or another region with transfer rules, we use recognised safeguards such as the European Commission's Standard Contractual Clauses (and the UK addendum), or a provider's certification under the EU–US Data Privacy Framework.

---

8. How long we keep data

When a workspace is closed, or your company asks us to delete its data, we delete Workspace Content within [30] days, except where we must keep something by law. Copies in backups are removed when those backups expire.

---

9. Security

We protect data with measures that include:

• encryption in transit (HTTPS/TLS) for all traffic between the extension, the website and our servers;
• AES-256-GCM encryption for saved test passwords and integration tokens;
• salted one-way hashing for account passwords, session tokens and one-time links;
• private file storage that can only be opened through short-lived links (10 minutes);
• automatic masking of password and card fields, and removal of sign-in headers and cookies from captured network logs;
• login attempt limits and temporary account locks;
• role-based access, so people only see the projects they belong to.

No system is perfectly secure. If we learn of a breach that affects your personal data, we will notify you and the relevant authorities as the law requires.

You can help: use a strong password, keep your login private, use test accounts and test data on the websites you test, and black out anything sensitive in screenshots before you raise a bug.

---

10. Your rights and choices

Depending on where you live, you may have the right to:

• access the personal data we hold about you and get a copy;
• correct data that is wrong or incomplete;
• delete your data;
• restrict or object to certain processing;
• port your data to another service;
• withdraw consent where we rely on it;
• nominate someone to exercise your rights if you die or become unable to (India);
• complain to a data protection authority.

To use any of these rights, email support@test-pulse.in from the address on your account. We will reply within 30 days (or sooner if your local law requires). If your request is about Workspace Content that your company controls, we may pass it to your company's admin, who is responsible for deciding on it.

You can also:

• change your name and password in your account settings;
• log out of all devices at once;
• leave a workspace or project;
• ask your admin to remove you, or ask us to delete your account;
• switch off Rewind on any website, or turn on "Do Not Track" in your browser to switch off analytics.

India (Digital Personal Data Protection Act, 2023). You can contact our Grievance Officer, [Founder name], at support@test-pulse.in. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

California (CCPA/CPRA). We do not sell or share personal information for cross-context behavioural advertising, and we do not use sensitive personal information for purposes other than providing the Service. You have the right to know, delete and correct your information, and we will not treat you differently for using these rights.

EU / UK (GDPR). You can complain to the data protection authority where you live or work. [If required: our EU representative is [name, address]. Our UK representative is [name, address].]

---

11. Cookies and browser storage

TestPulse uses very few cookies and no advertising trackers.

The extension also keeps small items in Chrome's extension storage (your sign-in, device ID and the current run or recording). You can clear browser storage at any time, but you will be signed out.

---

12. Children

TestPulse is a business tool. It is not meant for anyone under 18, and we do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

---

13. Changes to this policy

We may update this policy as TestPulse grows. If a change is significant, we will tell you by email or with a notice in the app at least [14] days before it takes effect. The "Last updated" date at the top always shows the current version.

---

14. Contact us

TestPulse (test-pulse.in) Run by [Founder 1 full name] and [Founder 2 full name], [City, State], India Email: support@test-pulse.in Grievance Officer (India): [Founder name], support@test-pulse.in