Data Subject FAQ Consent
| Field | Value |
|---|---|
| Version | 1.0 |
| Effective Date | April 2026 |
| Review Cycle | Annual |
| Document Owner | Chief Information Security Officer (CISO) |
| Classification | CONFIDENTIAL — Internal Use Only |
| Applicable Standard | SOC 2 Type II — Security, Availability, Confidentiality |
1. Purpose and Scope
This document provides the content framework for the Data Subject Privacy FAQ that QA Touch publishes on its Help Centre or Privacy FAQ page. It gives users and data subjects clear, accessible information about the consent process, their rights, and how to exercise them. Supports SOC 2 Privacy criterion P2.1 and ensures data subjects are meaningfully informed before and after consent is obtained.
2. FAQ Content — Privacy and Consent
Q1. What personal information does QA Touch collect about me?
When you create a QA Touch account, we collect your name, email address, and a securely stored password. As you use the platform, we collect information about your activities — such as the test cases you create, the test runs you execute, and the settings you configure. If you use our AI test generation feature, the text or files you provide are transmitted to our AI provider to generate the output. For security purposes, we also collect your IP address and session information when you log in.
Q2. Why does QA Touch need my data?
We collect data only for specific, necessary purposes. Your account information identifies you within your team and enables login. Your activity data saves your work and enables collaboration. Security data (IP address, login logs) protects your account from unauthorised access. We do not collect data we do not need to provide the service.
Q3. Do I need to give consent to use QA Touch?
For most processing necessary to deliver the QA Touch service, your consent is implied through your use of the platform — you agreed to our Terms of Service and Privacy Policy when you registered. Some optional activities (such as receiving marketing emails) require your explicit opt-in. You will always be asked to actively choose these before they apply to your account.
Q4. What requires my explicit opt-in consent?
| Activity | How to Opt In | Impact if You Don’t |
|---|---|---|
| Marketing emails and newsletters | Checkbox at registration (unchecked by default); or User Settings → Email Preferences | You won’t receive marketing emails. Service access and all platform features are unaffected. |
| Optional identifiable usage analytics | Toggle in User Settings → Privacy | No identifiable analytics collected from your account. |
| AI prompt data for model training [VERIFY] | Setting in AI Feature / Privacy Settings [VERIFY] | Your prompts are not used to train AI models. AI generation features remain fully available. |
Q5. Can I withdraw my consent?
Yes, at any time. Visit User Settings → Email Preferences or Privacy Settings to withdraw consent for any optional processing. Withdrawal takes effect immediately — for marketing emails, you will stop receiving them within 48 hours. Withdrawing consent does not affect the lawfulness of processing that took place before your withdrawal.
Q6. What if I don’t consent to essential processing?
Some processing is not based on consent but on contract performance — for example, sending a password reset email, or logging your login event for security. You cannot opt out of these activities while continuing to use QA Touch. If you wish to stop this processing, you may close your account and request deletion of your personal data.
Q7. What are cookies and do I need to consent?
QA Touch uses cookies (small data files stored in your browser) to manage your secure login session. Essential session cookies are strictly necessary for the platform to work and cannot be declined if you wish to use QA Touch. Optional cookies (e.g., analytics or marketing cookies) require your explicit consent, which you can manage via the Cookie Preferences link in our cookie banner.
Q8. Does QA Touch sell my personal data?
No. QA Touch does not sell, rent, or share your personal data with third parties for advertising or marketing purposes. We share data only with sub-processors who help us deliver our service (such as our cloud infrastructure provider and email delivery service), all under strict contractual data processing agreements.
Q9. What happens to my data when I use the AI test generation feature?
When you use QA Touch’s AI test generation feature, the text you type or the files you upload are transmitted securely (over TLS) to a third-party AI provider to generate test cases. Our Data Processing Agreement with the provider restricts their use of your data. Please check our Privacy Policy for the most current details about which provider we use and whether prompts are retained [VERIFY and update based on actual DPA terms].
Q10. How long does QA Touch keep my data?
We retain your account data for as long as your account is active. After account closure, personal data is deleted within 90 days. Your workspace test data is retained for 30 days after workspace subscription termination to allow export. Specific retention periods for each data type are published in our Privacy Policy. You may request earlier deletion by submitting a Data Deletion Request.
Q11. What privacy rights do I have?
Depending on your location, you may have the right to: access a copy of your personal data; correct inaccurate data; request deletion of your data; restrict or object to certain processing; receive your data in a portable format; and withdraw consent at any time. To exercise any right, contact us at privacy@qatouch.com [VERIFY].
Q12. What if my data was collected from a QA Touch customer (not directly from me)?
If your employer or another organisation uses QA Touch and created your account on your behalf, that organisation is the data controller for your account within their workspace. Please contact your organisation’s QA Touch administrator for privacy requests related to that account. You may also contact QA Touch directly at privacy@qatouch.com for further guidance.
Q13. How do I make a privacy complaint?
Contact us at privacy@qatouch.com [VERIFY]. We will acknowledge your complaint within 5 business days and respond fully within 30 days. If you are not satisfied with our response, you may lodge a complaint with your local data protection supervisory authority (for EU/EEA residents, this is the relevant national DPA; for UK residents, the ICO).