TestOval Privacy Policy

This Privacy Policy explains how TestOval ("TestOval", "we", "us", or "our") collects, uses, discloses, and safeguards information when you use our QA and test-management platform (the "Service"), operated by [LEGAL_ENTITY_NAME], a business registered in Nigeria.

This document is a draft template prepared to reflect the features and data practices of TestOval as described to us. It is not a substitute for advice from a qualified lawyer, and should be reviewed by one — particularly to confirm registration details, finalize the legal entity name and domain, and confirm compliance obligations before this policy is published or relied upon.

1. Who We Are

TestOval is a QA record-keeping and test-management platform that helps testing teams log defects, author test cases, run test cycles, and generate test reports, with AI assistance throughout. TestOval is operated by [LEGAL_ENTITY_NAME] ("the Company"), based in Nigeria, reachable at admin@testoval.com.

2. Controller and Processor Roles

Where an organisation ("Customer Organisation") signs up for TestOval and its team members submit QA data — defects, test cases, screenshots, videos, reports, and related content ("Customer Content") — the Customer Organisation acts as the data controller for that Customer Content, and TestOval acts as a data processor, processing Customer Content only as instructed by the Customer Organisation and as necessary to provide the Service.

For account-level information (such as registration details, billing contact information, and usage data collected directly from individual users), TestOval acts as a data controller in its own right.

If you are a member of a Customer Organisation's TestOval workspace, questions about how your organisation's QA data is used should be directed to your organisation's administrator in the first instance, in addition to TestOval.

3. Information We Collect

3.1 Account and Registration Information

• Name, email address, and password (individual accounts).
• Organisation name, Super Admin name and email, and team member details (organisation accounts).
• Role assignments (Super Admin, Team Lead, Tester, Viewer).

3.2 Customer Content

• Defect reports: titles, descriptions, steps to reproduce, expected/actual results, severity, affected component, comments, and status history.
• Uploaded screenshots and videos (up to 100MB) attached to defects.
• Test cases, test runs, and test result history.
• Test reports, observations, and approval decisions.
• Reference materials uploaded by your organisation (e.g. product requirement documents, Figma links, BRD links, manuals).

3.3 Usage and Technical Data

• Log data such as IP address, browser type, device information, and timestamps.
• In-app activity captured in the audit log (actions taken, by whom, and when).
• Chatbot conversation history (retained temporarily; see Section 7).

3.4 Cookies

We use strictly necessary cookies to maintain your session and keep you signed in. We do not currently use advertising or third-party tracking cookies.

4. How We Use Information

• To provide, maintain, and operate the Service, including AI-assisted defect and test case generation.
• To authenticate users and enforce role-based access control.
• To generate test reports, dashboards, and audit trails from your organisation's data.
• To send transactional emails (e.g. account creation, temporary passwords, assignment and approval notifications).
• To respond to support requests sent to admin@testoval.com.
• To monitor, secure, and improve the Service, including diagnosing technical issues.
• To comply with legal obligations.

5. AI Processing (Google Gemini)

When you use AI-assisted defect logging or test case generation, the screenshot, video, or text description you provide is sent to Google's Gemini API for processing, and the resulting draft is returned to you for review before you save it. TestOval does not treat AI-generated output as final — a human reviewer is expected to check and edit AI drafts before they become part of your records.

We are working to enable API-level billing with Google to ensure Customer Content submitted for AI processing is not used to train Google's models. Until this is confirmed and enabled, you should avoid submitting highly sensitive or confidential information through AI-assisted features. We will update this section once billing and any applicable data-training opt-outs are confirmed.

6. Legal Basis for Processing

Where the Nigeria Data Protection Act 2023 ("NDPA") applies, we process personal data on the basis of: performance of a contract with you (providing the Service you signed up for), your consent (e.g. optional communications), our legitimate interests (e.g. securing the Service, preventing abuse), and compliance with legal obligations.

Where the EU/UK General Data Protection Regulation ("GDPR") applies — for example, where a Customer Organisation or its users are located in the EU or UK — we rely on the equivalent legal bases of contract, consent, legitimate interests, and legal obligation, and we support Customer Organisations acting as controllers in meeting their own GDPR obligations.

7. Data Retention

• Defects, test cases, test runs, and reports are retained for as long as your account or organisation's account remains active, and thereafter as required by the deletion or export instructions of the Customer Organisation.
• Finalized reports are retained as versioned, permanent records, consistent with TestOval's function as a system of record.
• The audit log is retained permanently and is read-only, recording state-changing actions for accountability purposes.
• Chatbot conversation history is retained per user and automatically cleared after 5 days of inactivity.
• Upon account or organisation deletion, we will delete or anonymise personal data within a reasonable period, except where retention is required by law or for legitimate record-keeping purposes agreed with the Customer Organisation.

8. How We Share Information

We do not sell personal data. We share information only as follows:

• Service providers who process data on our behalf, including Supabase (database, authentication, and file storage), Google (Gemini API for AI generation), Vercel (hosting), and our email delivery provider (for transactional emails).
• Within your organisation, according to the role-based permissions your organisation has configured.
• Where required by law, regulation, or valid legal process.
• In connection with a merger, acquisition, or sale of assets, subject to continued protection of your data under this Policy or a materially similar one.

9. International Data Transfers

Our infrastructure providers (including Supabase, Google, and Vercel) may process and store data outside Nigeria. Where personal data is transferred internationally, we take steps intended to ensure an appropriate level of protection, consistent with NDPA requirements and, where applicable, GDPR safeguards such as standard contractual clauses used by our providers.

10. Data Security

We use industry-standard measures to protect information, including encrypted connections, authenticated access, and role-based access control enforced server-side. No system is completely secure, and we cannot guarantee absolute security of information transmitted to or stored by the Service.

11. Your Rights

Subject to applicable law (including the NDPA and, where relevant, the GDPR), you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete personal data.
• Request deletion of your personal data, subject to legitimate retention needs.
• Object to or restrict certain processing.
• Request a copy of your data in a portable format.
• Withdraw consent where processing is based on consent.

To exercise these rights, contact us at admin@testoval.com. If you are a member of a Customer Organisation, some requests may need to be routed through your organisation's administrator, as they control the underlying data.

12. Children's Privacy

The Service is intended for professional use by software testing teams and is not directed at children. We do not knowingly collect personal data from individuals under the age of 18.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via the Service or by email. Continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

14. Contact Us

Questions, requests, or complaints regarding this Privacy Policy or your personal data can be sent to:
Email: admin@testoval.com
Operated by: [LEGAL_ENTITY_NAME], Nigeria