This Privacy Policy explains how we process personal data when you use the REST&TEST desktop application ("App"), the restandtest.xyz website ("Website") and the server behind them (together the "Service"), as required by the EU General Data Protection Regulation (GDPR).
The controller of your personal data is [COMPANY NAME], registered office [REGISTERED ADDRESS], company ID (IČO) [IČO], VAT ID (DIČ) [DIČ], registered in [COMMERCIAL REGISTER ENTRY] ("we", "us").
Contact for all privacy matters: support@restandtest.xyz. We have not appointed a data protection officer, as the law does not require one for us.
Account data: username, email address (optional, needed for password resets and notices), password (stored only as a salted PBKDF2-SHA256 hash), sign-up and last sign-in time.
Purpose: providing your account. Legal basis: performance of the contract (Art. 6(1)(b) GDPR). Kept until you delete your account.
Consent records: that you accepted these documents and the Terms of Service, and, before each purchase, that you asked us to start the service immediately (see Terms, section 7), with the document version, time and IP address.
Purpose: proving what you agreed to. Legal basis: our legal obligations under consumer law and our legitimate interest in being able to prove it (Art. 6(1)(c) and (f)). Kept until you delete your account.
Subscription and billing data: plan, subscription status, Stripe customer and subscription IDs, purchased credits, usage counters (number of generations and repairs). Card details go directly to Stripe; we never see or store them.
Purpose: billing and enforcing plan limits. Legal basis: performance of the contract (Art. 6(1)(b)). Kept until you delete your account; invoices and payment records are kept by Stripe and in our accounting for 10 years as Czech tax and accounting law requires (Art. 6(1)(c)).
Your API documentation and generated tests: when you generate or repair tests, the App sends your API documentation (OpenAPI/Swagger) and, for repairs, the test code to our server, which forwards it to our AI provider Anthropic. When generating, the App sends only the names of your secrets (API keys, tokens), not their values; a secret typed directly into a test file is sent along with that file when you repair it. We store:
Please do not put personal data or secrets into the API documentation you upload. If you are a business and your documentation does contain personal data of others, we process it on your behalf under our Data Processing Agreement.
Technical logs: IP address, time, requested address, username and app/browser version of each request.
Purpose: security, preventing abuse, troubleshooting. Legal basis: legitimate interest (Art. 6(1)(f)). Deleted after 30 days.
Emails we send: password reset links, notices about a changed password or email address, sign-in alerts, order confirmations and account deletion confirmations. Legal basis: performance of the contract and, for sign-in alerts, our legitimate interest in protecting your account (Art. 6(1)(b) and (f)). We do not send marketing emails.
Providing account data is necessary to use the Service; without a username and password we cannot create your account. We do not make decisions about you based solely on automated processing (Art. 22 GDPR). The AI writes test code; it makes no decisions about you.
We use these processors, bound by data processing agreements:
We do not sell your data and do not use it for advertising.
Anthropic and Stripe, Inc. process data in the USA. These transfers rely on the EU–US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses (Art. 45 and 46(2)(c) GDPR). You can ask us for a copy of the safeguards.
You have the right to access your data, to have it corrected, to have it deleted, to restrict its processing, to receive it in a machine-readable format (portability), and to object to processing based on our legitimate interest. Where processing is based on consent, you can withdraw it at any time.
You can delete your account and its data yourself in the dashboard (Account settings → Delete account). For anything else, email support@restandtest.xyz. We answer within one month.
You also have the right to lodge a complaint with a supervisory authority, in the Czech Republic the Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz, or with the authority in the EU country where you live or work.
We protect data with encrypted connections (HTTPS/TLS), hashed passwords, access restricted to authorised staff, rate limiting, firewalling and least-privilege server accounts. If a breach is likely to put your rights at risk, we will tell you and the supervisory authority as the law requires.
The Website stores your sign-in token in your browser's local storage, and the App stores it on your device. This is strictly necessary for signing in, so no consent is needed. We use no analytics, tracking or advertising cookies, and the Website loads no third-party resources: fonts and icons are served from our own server.
The Service is not intended for anyone under 16, and we do not knowingly process their data. If you believe a child has given us personal data, contact us and we will delete it.
If we change this policy, we will publish the new version here with a new version date and, for material changes, notify you by email or in the App before they take effect.