Data Processing Agreement
Last updated 2026-10-17
This agreement applies when Vasyl Harastei (“processor”) processes personal data on behalf of a customer (“controller”) through TestWatch. It forms part of the Terms of Service and is accepted with them.
1. Subject and duration
The processor runs end-to-end tests against the controller’s apps. Doing so may involve personal data that appears in those apps, for the duration of the controller’s account.
2. Data and data subjects
- Data: whatever appears in the pages, network traffic and console of the apps under test, captured as screenshots, videos, traces, page snapshots and logs; and test-account credentials the controller provides.
- Kept with the test: generation transcripts, test data seen while a test is written, and records of the test data a run created stay with the generated test until it is deleted; they are not part of the evidence deletion.
- Data subjects: typically the controller’s test users. The controller should test with test accounts and test data, not real customers’ data, wherever possible.
3. Instructions
The processor processes the data only to provide TestWatch as configured by the controller, and as documented in the security page.
4. Confidentiality and security
People with access are bound to confidentiality. Security measures include encryption of stored credentials (AES-256-GCM), scrubbing of known secrets, authentication headers, cookies and tokens from the text we keep (page snapshots, console and network logs; screenshots and videos are stored as captured), network isolation of test browsers from private networks, access control by workspace and role, deletion of run evidence after 30, 90 or 180 days depending on the plan, an option per app to capture no screenshots or video, and AI processing only through providers with zero-data-retention terms.
5. Sub-processors
The controller authorises the sub-processors on the sub-processors page. The processor informs the controller at least 30 days before adding one; the controller may object, and if no solution is found may end the agreement.
6. Assistance
The processor helps the controller respond to data subjects’ requests and meet its security, breach-notification and impact-assessment duties, to the extent reasonable.
7. Breaches
The processor notifies the controller without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting the controller’s data.
8. End of processing
When the account ends, the processor deletes the controller’s data within 30 days, except where the law requires keeping it. A workspace the controller deletes itself is purged 7 days after the request. Backups expire on their normal cycle (30 days).
9. Audits
The processor makes available the information needed to show compliance with this agreement and allows reasonable audits, at most once a year and with reasonable notice.
10. Transfers
Where data is transferred outside the EU, the processor relies on an adequacy decision (including the EU–US Data Privacy Framework) or standard contractual clauses.
Contact: privacy@testwatch.dev