Privacy Policy

1. Overview

This Privacy Policy explains how 13698491 Canada Inc, doing business as GoQA ("GoQA", "we", "us", or "our"), collects, uses, discloses, retains, and protects personal information when you use the GoQA platform, related websites, and APIs (collectively the "Service").

GoQA is an AI-powered quality-assurance platform that generates test cases from acceptance criteria, URLs, or screenshots; crawls websites; and runs accessibility, performance, and security audits. This policy applies to everyone who visits our website, creates an account, or uses the Service.

We process personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). Where the EU or UK General Data Protection Regulation applies to you, we also honour the rights described in section 9.

2. Information we collect

Account information. When you create an account we collect your name, email address, and — where you set one — a hashed password. If you sign in with a third-party identity provider, we receive the profile information described in section 3.

Workspace content. Acceptance criteria, URLs, screenshots, uploaded files, test cases, scan configurations, and audit results that you or your team members submit to the Service.

Usage data. Log entries, feature interactions, request metadata, IP address, browser and device type, and timestamps, used to operate, secure, and improve the Service.

Billing information. Plan, billing cadence, and transaction history. Card numbers and other payment credentials are collected and stored by Stripe, our payment processor; GoQA never receives or stores full card details.

Support communications. Messages you send us through the contact page, email, or in-product support, together with any attachments you choose to include.

3. Google user data

GoQA offers Google as an optional sign-in method. If you choose it, Google asks for your consent and then shares a limited profile with us under the openid, email, and profile scopes only.

The data we receive is: your Google account email address, your basic profile information (name and profile picture URL), and a stable Google account identifier. GoQA does not request, receive, or store access to Gmail, Google Drive, Google Calendar, Google Contacts, or any other restricted or sensitive Google API scope.

We use this data for one purpose: to create and authenticate your GoQA account and to display your name and avatar inside your workspace. We do not use Google user data for advertising, we do not sell it, we do not transfer it to third parties except to the subprocessors listed in section 5 acting on our behalf, and we do not use it to develop, improve, or train generalised AI or machine-learning models.

GoQA's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can revoke GoQA's access at any time from your Google account permissions page at myaccount.google.com/permissions. Revoking access disables Google sign-in for your account; it does not by itself delete your GoQA workspace. To delete the workspace and its data, follow section 9.

4. How we use information

We use personal information to provide and maintain the Service; authenticate you and secure your account; generate test cases, crawls, and audit reports at your instruction; process payments and manage subscriptions; respond to support requests; send transactional and service notices; detect, investigate, and prevent abuse, fraud, and security incidents; and comply with legal obligations.

We rely on your consent, on the performance of our contract with you, and on our legitimate interest in operating a secure and reliable service. Where consent is the basis, you may withdraw it at any time as described in section 9.

Your prompts, inputs, and workspace content are excluded by contract from any model training or fine-tuning pipeline operated by us or by our AI model providers.

We do not sell personal information, and we do not share it with third parties for their own independent marketing purposes.

5. Sharing and subprocessors

We share personal information only with service providers that process it on our behalf under written agreements, and only to the extent needed to deliver the Service. Our principal subprocessors are: Supabase (authentication and Postgres database hosting), Stripe (payment processing), our cloud infrastructure and hosting providers, our AI model providers (for generating test cases and audit summaries), and our transactional email provider.

We may also disclose information where required by law, court order, or a valid governmental request; where necessary to investigate suspected fraud or a security incident; or to establish, exercise, or defend legal claims.

If GoQA is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction. We will give notice before your information becomes subject to a materially different privacy policy.

6. Data retention

We retain account and workspace data for as long as your account is active. After you delete your account, we remove personal information and workspace content from production systems within 30 days, and from encrypted backups within 90 days, except where a longer period is required by law (for example, tax and accounting records).

Aggregated and de-identified data that can no longer be linked to you may be retained indefinitely for capacity planning and product analytics.

7. Security

All data is encrypted in transit using TLS and at rest using AES-256. Access to workspace data is scoped per user and per organisation through Postgres row-level security, so members of one workspace cannot read another workspace's data.

Internal administrative access is restricted to the smallest number of people who need it, protected by multi-factor authentication, and logged. We review dependencies and infrastructure configuration for known vulnerabilities on an ongoing basis.

No method of transmission or storage is completely secure. If we become aware of a breach of security safeguards that creates a real risk of significant harm, we will notify affected users and the Office of the Privacy Commissioner of Canada as required by PIPEDA.

8. Cookies and similar technologies

We use strictly necessary cookies to keep you signed in, maintain your session, and protect against cross-site request forgery. These cookies are required for the Service to function and cannot be switched off from within the product.

We use privacy-respecting product analytics to understand aggregate feature usage. We do not use third-party advertising cookies or cross-site tracking pixels. You can block or delete cookies through your browser settings, but doing so may prevent you from staying signed in.

9. Your rights and choices

You may access, correct, export, or delete your personal information at any time. Test cases and audit results can be exported directly from the product; for access, correction, or deletion requests, contact us using the details in section 14 and we will respond within 30 days.

Under PIPEDA you have the right to access the personal information we hold about you, to challenge its accuracy and completeness, and to withdraw consent (subject to legal or contractual restrictions). Where the GDPR applies, you additionally have rights to restriction, objection, data portability, and the right to lodge a complaint with your local supervisory authority.

To delete your GoQA account and all associated workspace data, email us via our contact page and we will action the request within 30 days. Deletion is permanent and cannot be undone.

10. International transfers

GoQA is based in Canada, and our service providers may process data in Canada, the United States, and the European Union. Where personal information is transferred outside your jurisdiction, we rely on contractual protections — including standard contractual clauses where applicable — to ensure it receives a comparable level of protection.

11. Data on the sites you scan

When you run a crawl, accessibility audit, performance audit, or security audit, GoQA fetches pages from the target site and stores the results in your workspace. Those results may incidentally contain personal information that appears on the pages you asked us to scan.

You are the controller of that data and you are responsible for having the right to scan the target property. GoQA acts as your processor for it, retains it under section 6, and deletes it when you delete the associated scan or your account.

12. Children's privacy

The Service is not directed at children. You must be at least 16 years old, or the age of digital consent in your jurisdiction, to create an account. We do not knowingly collect personal information from children; if we learn that we have, we will delete it promptly.

13. Changes to this policy

We may update this Privacy Policy from time to time. The current version will always be posted at this URL with an updated "Last updated" date below. Material changes will be communicated by email or an in-product notice at least 14 days before they take effect.

14. Contact us and privacy officer

Questions, access requests, or complaints about this policy or our handling of personal information can be directed to our privacy officer via our contact page or by post at the address below. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada.

Mailing address

Prefer email? Visit our contact page.