Privacy Policy
Effective date: · Last updated:
1. Who we are and what this policy covers
NexGen QA is operated by Techtonic Innovations LLC, a Virginia limited liability company based in Reston, Virginia, USA (“Techtonic”, “we”, “us” or “our”). This policy explains what personal information we collect, why, who receives it, how long we keep it, and the choices and rights you have.
This policy covers:
- our website at qa-automation.com and its pages (the “Website”);
- the free Website Audit tool at /tools/website-audit;
- demo requests, sales and support communications;
- subscription purchases and the “Manage Your Subscription” billing portal; and
- the account, billing, security and usage information we hold about users of the NexGen QA platform at app.qa-automation.com (the “Platform”).
Customer Content is handled differently. The applications, URLs, source code, test cases, test data, scan results and other content that a customer organization puts into or generates with the Platform (“Customer Content”) are processed on that customer’s behalf and under its instructions, as described in our Terms of Service and any agreement we have with the customer. For Customer Content, the customer is the controller (or “business”) and we act as its processor (or “service provider”). If your personal information is in Customer Content, please contact that organization; we will help it respond.
Our services are designed for businesses and professionals. This policy does not cover third-party websites or services we link to, including Stripe, GitHub and the websites you ask the Website Audit tool to check.
2. What we collect and how
2.1 When you visit the Website
- Server request logs. The Website runs on Google Cloud Run in the United States. For every request, Google Cloud automatically records your IP address, the date and time, the page or file requested (including any query string in the address), the HTTP method and status, response size and time, your browser’s user-agent string and the referring page. Our application also writes operational log entries (for example, errors) to the same logging service.
- Cloudflare Web Analytics. Every page loads Cloudflare’s analytics script from static.cloudflareinsights.com, which reports page views, the referring page, browser and device type, and page-performance timings to Cloudflare. Cloudflare states that this service does not use cookies or local storage and does not fingerprint visitors. Because it stores nothing on your device, it is not controlled by the cookie banner.
- Google Analytics 4 (when enabled). We use Google Analytics to understand which pages are used. Section 5 explains exactly how it behaves with and without your consent. We have turned off Google signals and ad personalization, and all advertising-related consent types are set to “denied”. If you open the Website Audit tool from a shareable link, we remove the audited address (the
urlparameter) from the page address sent to Google. - Content delivery. Pages load fonts from Google Fonts (fonts.googleapis.com and fonts.gstatic.com), the Tailwind CSS runtime from cdn.tailwindcss.com and, on the home page, images from images.unsplash.com. Your browser connects to those providers directly, so they receive your IP address and browser information when serving the files.
2.2 When you request a demo
The demo form asks for your name, work email, company and a preferred date and time, and optionally what you need and a phone number. When you submit it:
- your details and your IP address are sent to our server, which writes them to a booking file on the server instance and writes a log entry containing your name, email, company, chosen date and time, the first 200 characters of what you need and, if given, your phone number and SMS consent;
- our server uses Mailjet to email you a confirmation and to email our team a notification with the same details; and
- your browser also sends the same details (not your IP address) to EmailJS, which emails a copy to our team.
We use this information to schedule and hold the demo and to follow up about your inquiry. The booking file lives on the server instance’s temporary storage and is discarded when that instance is replaced; the log entry and the emails are what we keep.
Text messages. If you give a phone number you must tick a box agreeing to receive SMS about your inquiry. We use your number only for that purpose. Message frequency varies and message and data rates may apply; reply STOP to opt out or HELP for help. We do not sell or share mobile phone numbers, or SMS opt-in data and consent, with third parties or affiliates for their marketing or promotional purposes. Numbers are disclosed only to service providers that deliver messages for us.
2.3 When you use the free Website Audit tool
- What you give us: the address (URL) of the website you want checked.
- What our server does with it: it fetches that page and a limited set of related resources on the same site: the http/https and www/non-www variants and their redirects, robots.txt, the sitemap and up to 10 of the URLs it lists, /favicon.ico, one deliberately non-existent path (to test 404 handling), a sample of scripts and stylesheets, and the page’s social-sharing image. It makes at most about 30 requests within about 25 seconds, identified by the user-agent “NexGenQA-SiteAudit/1.0 (+https://qa-automation.com/tools/website-audit)”, and it refuses private, local, link-local and cloud-metadata addresses. The requests come from our servers, not from your device, so the audited site sees our IP address, not yours.
- Reports are not stored. The report is built in memory for your request, returned to your browser and then discarded. We keep no copy of the report or of the page content we fetched.
- What we log: the audit tool’s own log entries record only the audited site’s hostname and the outcome (the score, number of findings and duration, or an error category with a short technical reason). They do not record the full URL, its path or query string, or your IP address. The standard Google Cloud request log described in section 2.1 still records your IP address for the request. The URL you submit travels in the request body and is not part of that log, but if you open a shareable link that contains
?url=, that page address (including the audited URL) is logged like any other page address. - Rate limiting: to keep the tool available and prevent abuse, each visitor may run 10 audits per 10 minutes. To enforce this, your IP address (for IPv6, its /56 network prefix) is held in server memory as a counter. The audit tool does not write it to disk or to logs, and it is discarded automatically no later than about 20 minutes after your last audit, or sooner if the server instance restarts.
2.4 When you buy or manage a subscription
- Payments are handled by Stripe on Stripe-hosted pages. Stripe collects your payment details; we never receive or store full card numbers.
- If you use “Manage Your Subscription”, our server sends the email address you enter to Stripe to find your customer record and open a Stripe billing-portal session. We do not store that email address.
- Stripe notifies our server of subscription events (new subscription, plan change, cancellation, payment success or failure). We use the email, name, plan, price and billing interval from those events to send you welcome, plan-change and cancellation emails through Mailjet. Our logs for these events contain a partially masked email address (the first two characters and the domain), Stripe customer identifiers, plan names and amounts.
2.5 When you use the Platform (app.qa-automation.com)
- Account information: name, email address, organization, role and, if you sign in through single sign-on, the identifiers your identity provider sends us. Passwords are stored only as bcrypt hashes.
- Security information: multi-factor authentication settings, session records, and the IP address, user-agent and actions recorded in audit and security logs.
- Billing and usage information: plan, subscription status, AI-credit consumption and which features are used.
- AI features: when you use AI-assisted features, the relevant prompts and content are sent to the AI model provider selected for your organization, or for the specific feature or model you choose, to generate the output. The Platform supports these AI model providers: OpenAI, Anthropic, Google (Gemini), DeepSeek, Mistral AI, Groq and Microsoft Azure OpenAI. DeepSeek processes data in the People’s Republic of China. An organization administrator can disable any provider in platform settings, and Government deployments are restricted to authorized providers. If your organization turns on the Bring-Your-Own-Key (BYOK) requirement, AI-invoking features are refused on our servers and AI calls run inside your own GitHub Actions workflow with your provider key, which is stored as a GitHub secret in your repository; we store only the secret’s name, not its value.
- Error monitoring: if enabled, application errors are reported to Sentry with authorization headers and cookies removed.
- Support and communications: the messages you send us and our replies.
Security controls for the Platform are described on our Security page.
3. Why we use it and our legal bases
| Purpose | Legal basis (EEA, UK, Switzerland) |
|---|---|
| Providing the Website, the Audit tool, demos, subscriptions and the Platform you ask for | Performance of a contract, or steps you ask us to take before one |
| Security, fraud and abuse prevention, rate limiting, debugging and server logs | Our legitimate interest in running a secure, reliable service |
| Google Analytics cookies in the EEA, UK and Switzerland | Your consent, which you can withdraw at any time |
| Website analytics elsewhere, and Cloudflare Web Analytics | Our legitimate interest in understanding and improving the Website |
| Following up on demo requests and business inquiries; SMS about your inquiry | Legitimate interest; for SMS, your consent |
| Service, billing and security notices | Performance of a contract |
| Tax, accounting, legal claims and complying with the law | Legal obligation; legitimate interest in defending legal claims |
We do not use personal information for targeted advertising, we do not sell it, and we do not make decisions based solely on automated processing that produce legal or similarly significant effects about you.
6. How long we keep it
| Information | Retention |
|---|---|
| Server and application logs (Google Cloud Logging) | Up to 30 days |
| Audit tool rate-limit counters (IP address, in memory only) | No more than about 20 minutes after your last audit |
| Audit reports and fetched page content | Not stored |
| Google Analytics event data | Up to 14 months |
| Demo requests and sales correspondence | Up to 24 months after our last contact, unless you become a customer |
| Consent choice (in your browser) | 12 months, or until you clear it |
| Platform account data | For the life of the account; deleted or de-identified within 90 days after the account is closed, except as below |
| Billing and tax records | As long as tax and accounting laws require (generally up to 7 years) |
We may keep information longer where needed to resolve disputes, enforce our agreements, or comply with a legal hold or other legal obligation. Backups are overwritten on their normal cycle.
7. Security
The Website is served only over HTTPS with HTTP Strict Transport Security, and credentials for our service providers are kept out of our source code. The Audit tool checks every address it fetches, including after each redirect, and refuses private and internal addresses. No system is perfectly secure; if you believe you have found a vulnerability, please see our Security page.
8. International transfers
We are based in the United States, and we and our service providers process information in the United States and other countries, including, if your organization uses DeepSeek models, the People’s Republic of China (section 2.5). When we transfer personal information from the EEA, the UK or Switzerland, we rely on the European Commission’s Standard Contractual Clauses (with the UK Addendum or Swiss amendments where applicable) or on the recipient’s certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, as applicable. You can ask us for more information about these safeguards.
9. Your privacy rights
EEA, UK and Switzerland
You have the right to access, correct, delete, restrict or object to our processing of your personal information, to data portability, and to withdraw consent at any time (without affecting earlier processing). You may also complain to your local data protection authority, the UK Information Commissioner’s Office or the Swiss Federal Data Protection and Information Commissioner.
California (CCPA, as amended by the CPRA)
California residents have the right to know about and access the personal information we collect, use and disclose; to correct it; to delete it; to opt out of its sale or sharing (we do neither); to limit the use of sensitive personal information (we use it only to provide the services); and not to be discriminated against for exercising these rights. In the past 12 months we collected the following categories, from you, your device and our service providers, for the purposes in section 3, and disclosed them for business purposes to the recipients in section 4:
| Category | Examples |
|---|---|
| Identifiers | Name, email address, phone number, IP address, account identifiers |
| Commercial information | Plans purchased, subscription and billing history |
| Internet or network activity | Pages viewed, referrer, browser and device data, Platform usage and security logs |
| Approximate geolocation | Country or region inferred from IP address |
| Professional information | Company, job role, what you told us you need |
| Sensitive personal information | Platform log-in credentials (passwords stored only as hashes) |
Virginia (VCDPA) and other U.S. states
Residents of Virginia, and of other states with comparable laws, have the right to confirm whether we process their personal data; to access, correct and delete it and obtain a portable copy; and to opt out of targeted advertising, the sale of personal data and profiling in furtherance of decisions that produce legal or similarly significant effects. We do not engage in any of those three activities.
Appeals. If we decline to act on your request, you may appeal by replying to our decision or emailing contact@qa-automation.com with the subject “Privacy appeal”. We will respond in writing within 60 days and explain our decision. If the appeal is denied, Virginia residents may contact the Office of the Attorney General of Virginia at www.oag.state.va.us/consumer-protection, and residents of other states may contact their state attorney general.
How to exercise your rights
Email contact@qa-automation.com with the subject “Privacy request”. We verify requests by confirming that you control the email address associated with the information (for Platform accounts, we may ask you to sign in). You may use an authorized agent; we may ask the agent for proof of authorization and ask you to verify your identity. We respond within 45 days (one month in the EEA, UK and Switzerland) and may extend that period where the law allows, in which case we will tell you. Requests about Customer Content should go to the organization that controls it (see section 1).
10. Children
Our services are intended for businesses and for individuals aged 18 or over acting in a professional capacity. They are not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, contact us and we will delete it.
11. Changes to this policy
We may update this policy. We will post the new version here with a new effective date and, for material changes, give notice on the Website or by email to account holders before the change takes effect.
12. Contact us
Techtonic Innovations LLC
Reston, Virginia, USA
Email: contact@qa-automation.com