<!-- agents: TestFlows, a legal page. Index: https://testflows.com/llms.txt -->

# Privacy Policy

<p class="legal-updated">Last updated: 26 July 2026</p>

Katteli Inc. (“**Katteli**,” “**we**,” “**us**,” or “**our**”)

This Privacy Policy explains how we collect, use, share, and protect personal
information when you use TestFlows™ Machine websites, APIs, clients, and related
services (the “**Services**”). See also our [Terms of Service](/machine/legal/terms-of-service.md).

This Policy covers account, billing, and control-plane data. It does **not**
govern data inside your virtual machines or workloads (“**Customer Content**”).
You are the controller of Customer Content. For a processor relationship under
a Data Processing Addendum, contact `privacy@testflows.com`.

## 1. Information we collect

- **Account:** email (required), account identifiers and status, authentication
  tokens. Standard accounts do not require a legal name, postal address, or
  phone number.
- **Service use:** session and machine metadata, usage and credit events, API
  and control-plane logs (including IP addresses), and abuse-prevention signals.
- **Website / client:** IP address, user-agent, language, referral URLs, and
  cookies or similar technologies (see Section 6).
- **Communications:** support correspondence and transactional email; optional
  marketing email if you opt in (you may unsubscribe anytime).
- **Payments:** card numbers and payment credentials are collected by **Stripe**.
  When Managed Payments applies, Stripe (via Link) is merchant of record. We
  receive billing metadata (customer and order identifiers, amounts, tax,
  payment status), not your full card number. See
  [Stripe’s privacy policy](https://stripe.com/privacy).

The Services are for business use by adults and are not directed to minors. We
do not knowingly collect personal information from anyone under 18.

## 2. How we use information

We use personal information to provide, operate, secure, and improve the
Services; authenticate users; prevent abuse and fraud; meter usage and bill;
send transactional messages; respond to support; comply with law and enforce
our Agreement; and, with consent where required, send product updates or
marketing.

We do **not** sell personal information or share it for third-party marketing.

Where GDPR or UK GDPR applies, we process data under contract, legitimate
interests (security, fraud, product improvement), legal obligation, and consent
(optional marketing and non-essential cookies). You may object to processing
based on legitimate interests where that right applies.

## 3. How we share information

We share personal information with:

- **Service providers** that help us run the Services (payments, email delivery,
  hosting, observability), under confidentiality and data-protection terms;
- **Stripe / Link** for checkout, tax, receipts, disputes, and Managed Payments;
- **Authorities or others** when we believe disclosure is reasonably necessary
  to comply with law, enforce our Agreement, or protect rights and safety;
- **A buyer or successor** in a merger, acquisition, or asset sale, with notice
  where required;
- **Parties you direct** us to share with.

## 4. International transfers

We are a Canadian company. To operate the Services we may process and store
information outside your country, including in the European Union and other
places where we or our providers operate. Where required, we use appropriate
transfer mechanisms (such as Standard Contractual Clauses).

## 5. Retention

We retain personal information while your account is open and as needed to
provide the Services. After closure, we generally retain account and billing
history for legal, tax, accounting, fraud, and dispute purposes. Where law
requires erasure, we will anonymize the account email and revoke tokens after
verification, while retaining de-identified usage and billing records as
permitted. Logs and security data are kept for a limited operational period
unless needed longer for an investigation or legal hold.

## 6. Cookies

We use essential cookies and local storage for authentication, security, and
load balancing. Optional analytics on marketing pages, if enabled, are for
aggregate traffic only. Where required, we ask consent before non-essential
cookies. Browser controls may block cookies; blocking essential cookies may
break login.

## 7. Security

We use administrative, technical, and organizational measures designed to
protect personal information. No method of transmission or storage is
completely secure. If a personal-data breach requires notice under applicable
law, we will notify affected users and regulators as required.

## 8. Your rights

Depending on your location, you may have rights to access, correct, delete or
anonymize, object to or restrict processing, portability, withdraw consent, opt
out of marketing, and lodge a complaint with a supervisory authority. These
rights may be limited by law. We will not discriminate against you for
exercising privacy rights available to you.

To exercise rights, email `privacy@testflows.com` from the email on your
account. We may verify your identity and will respond as required by law.

## 9. Changes

We may update this Policy by posting a revised version and changing the “Last
updated” date. Material changes will be notified by email or prominent notice
where required.

## 10. Contact

Katteli Inc.

Privacy: `privacy@testflows.com`  
Legal: `legal@testflows.com`  
Website: `https://testflows.com`