TesterArmy procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “ Your data may be processed in the United States, European Union, and other countries where our service providers operate (including Vercel, Trigger.dev, Cloudflare, Google, Reddit, Stripe, Sentry, PostHog, and Loops). These transfers are necessary to provide the Service. We rely on Standard Contractual Clauses and other lawful transfer mechanisms where required by applicable data protection laws.” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ If you are in the European Economic Area or United Kingdom, you have the right to:” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ You may disconnect the GitHub integration at any time through your project settings or by uninstalling the GitHub App. Disconnection stops future webhook processing but does not delete historical test data, pull request context, or test outputs already generated by the Service.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Test run results - retained indefinitely while your account is active” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ Upon termination, your right to access the Service ceases. Account deletion is permanent and immediate - all associated data is deleted at the time of deletion, except where retention is required by law (e.g., billing records).” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ Account deletion is permanent and immediate. All associated personal data is deleted at the time of deletion, except where retention is required by law (e.g., billing records).” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Chat and message history - retained indefinitely while your account is active” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ We retain data for different periods depending on its type and purpose:” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Our Service uses AI models (via Vercel AI Gateway) to execute automated QA tests. This is a core part of the Service and requires sharing certain data with AI providers.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Each service processes data according to its own privacy policy. We encourage you to review their policies independently.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Google Ads (via Google Tag Manager) Advertising conversion measurement and campaign performance (consent-gated, production only) Reddit Ads (via Google Tag Manager) Advertising conversion measurement and campaign performance (consent-gated, production only) RB2B B2B website visitor identification for marketing (consent-gated, production only) Sentry Error tracking and performance monitoring (includes personal data in error reports) ” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ We do not sell your personal information. We share data only in the following circumstances:” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Send product updates, feature announcements, and marketing communications via Loops (you may unsubscribe at any time)” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Paid features are available through subscription plans managed via Stripe. By subscribing, you agree to:” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ RB2B - consent-gated B2B visitor identification used for marketing (production only)” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ From third-party integrations - GitHub webhooks and API calls deliver deployment, repository, pull request, commit, and changed-file data when you connect a repository and enable pull request testing. Code diffs or patches are collected when AI-generated or exploratory pull request testing needs them to plan tests.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Service providers - with the third-party services listed above, strictly to operate the platform” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ From OAuth providers - Google and GitHub provide profile information during sign-in” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ By connecting a GitHub repository, you authorize TesterArmy to:” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ The AI agent may perform web searches (via ExaLabs) to gather context relevant to your test queries. Search queries are derived from your test instructions.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Google Tag Manager (Google Ads, Reddit Pixel) - loads consent-gated advertising tags that measure conversions and campaign performance (production only); conversion events carry a pseudonymous workspace identifier used solely for deduplication” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ GitHub OAuth authentication + repository integration (webhooks, repository and PR metadata, changed files, PR diffs when needed for AI-generated or exploratory PR testing, PR comments, and check runs) ” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Credentials are transmitted to AI providers during test execution as necessary to perform the tests you request” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Payment processing is handled entirely by Stripe. We do not store credit card numbers or full payment details. We store only Stripe customer IDs, subscription IDs, plan names, and subscription status for account management.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Business transfers - in connection with a merger, acquisition, or sale of assets, with notice to affected users” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We use the following third-party services to operate the platform:” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ PostHog analytics and session recordings - first-party product usage analytics and session recordings (production only; consent banner shown in Europe)” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We select AI providers that offer commercially reasonable security and data handling practices. However, data sent to AI providers is processed on their infrastructure and subject to their respective privacy policies.” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ The Service supports team-based collaboration with role-based access:” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ Pay the applicable fees for your selected plan and seat count” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ We may offer trial periods at our discretion. Prices may change with 30 days' notice. Subscription downgrades or cancellations take effect at the end of the current billing period. No refunds are provided for partial billing periods or unused time.” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ Accept automatic renewal at the end of each billing cycle unless cancelled” | Captured 2026-09-25Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.