Privacy Policy

Introduction

TesterPayKit ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our crowd testing platform, mobile applications, websites, and related services (collectively, the "Services").

Please read this Privacy Policy carefully. By accessing or using our Services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy.

Information We Collect

Personal Information You Provide

We collect information you voluntarily provide when registering, using our Services, or communicating with us:

• Account information: name, email address, profile picture
• Payment information: bank account details or other payment method details for tester rewards
• Professional information: testing experience, device inventory, skills, and availability
• Communication data: support tickets, feedback, and correspondence with our team

Information Collected Automatically

When you access our Services, we automatically collect certain information:

• Device information: device type, operating system, browser type, screen resolution
• Usage data: pages visited, features used, testing session data, timestamps
• Log data: IP address, access times, referring URLs, error logs
• Location data: approximate location based on IP address (precise location only with consent)

Information from Third Parties

We may receive information from third parties, including:

• Payment processors for transaction verification

How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our Services
• Match testers with appropriate testing opportunities based on device, skills, and availability
• Process payments and distribute rewards to testers
• Communicate with you about your account, testing campaigns, and platform updates
• Respond to your inquiries and provide customer support
• Detect, prevent, and address fraud, security issues, and technical problems
• Analyze usage patterns to improve user experience and develop new features
• Comply with legal obligations and enforce our Terms of Service

Phone Number and Handle

Every account gets a system-generated handle made of two English words (for example "sad-banana"). Before your first report in an app, you confirm your mobile number once with a code we send by SMS. The same number in several apps leads to the same handle, so a developer can tell which reports come from the same person.

• What we store: your mobile number, the time it was confirmed and your handle.
• Who sees it: developers and coordinators only see your handle, never your number.
• SMS delivery: the code is sent and checked by Twilio Verify (Twilio Inc., USA) as our processor. Twilio receives your number for this purpose only.
• Retention: the number is kept while your tester account exists and deleted with it. Confirmation attempts (used to limit how many codes can be requested) are deleted after 30 days.
• Legal basis: our legitimate interest in assigning reports to a person reliably (Art. 6(1)(f) GDPR).

Phone app and push notifications

If you allow notifications in the TPK app, we register your device. Messages about your tests, retests and balance then arrive as push notifications.

• What we store: an identifier of the app installation, the device's push token, whether notifications are switched on and which notification was delivered.
• Who receives it: Expo (650 Industries, Inc., USA) forwards the notification and Apple delivers it. Both receive the push token plus the title and text of the notification.
• Retention: device details are kept while your tester account exists and deleted with it. If Expo reports a device as no longer reachable, we switch it off.
• Legal basis: your consent through your device's prompt (Art. 6(1)(a) GDPR). You can withdraw it at any time in your device settings.

How We Share Your Information

We may share your information in the following circumstances:

With App Developers (Clients)

When you participate in testing campaigns, developers may receive:

• Your tester profile (anonymized or identified based on campaign settings)
• Device information relevant to the test
• Bug reports and feedback you submit
• Testing session recordings (when explicitly consented)

With Service Providers

We work with trusted third parties who assist us in operating our Services:

• Hetzner Online GmbH (Germany): servers for the API, database and files
• Cloudflare, Inc. (USA): delivery of the website and console, connection to the API, and Web Analytics (visitor measurement without cookies)
• OpenAI (USA): for voice reports, the recording and text go to OpenAI for transcription and the AI draft; the same applies to questions to an app's knowledge base
• Resend, Inc. (USA): sending email
• Twilio Inc. (USA): SMS code to confirm your mobile number
• Expo (650 Industries, Inc., USA) and Apple: delivery of push notifications
• Stripe: payments and payouts for paid orders, once these are available

Legal and Safety

We may disclose your information when required by law, to protect rights and safety, or to prevent fraud.

Data Retention

We retain your personal information for as long as necessary to provide our Services and fulfill the purposes described in this Privacy Policy. Specific retention periods:

• Account data: retained while your account is active and for 3 years after account closure
• Payment records: retained for 7 years for tax and legal compliance
• Testing data: retained for 2 years after campaign completion
• Support communications: retained for 3 years

Your Rights and Choices

Depending on your location, you may have the following rights:

• Access: Request a copy of your personal data
• Correction: Update or correct inaccurate data
• Deletion: Request deletion of your personal data
• Portability: Receive your data in a structured, machine-readable format
• Opt-out: Unsubscribe from marketing communications
• Restriction: Limit how we process your data
• Objection: Object to certain processing activities

To exercise these rights, please contact us at [email protected].

Data Security

We implement industry-standard security measures to protect your data:

• Encrypted transfer (TLS)
• Access controls and authentication mechanisms
• Secure data centers with physical security measures

For more details, please visit our Security page.

International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses approved by the European Commission
• Data Processing Agreements with all service providers
• Compliance with applicable data protection frameworks

Children's Privacy

Our Services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If we learn that we have collected personal information from a child, we will take steps to delete that information promptly.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. We encourage you to review this Privacy Policy periodically.