1. Scope
This policy explains how QaCockpit handles personal information submitted through this public website, including the contact form, voluntary research, requested communication, and supported product evaluations.
2. Information we collect
When you contact us, we receive the name, email address, company name, and message you choose to provide. Our infrastructure may also process basic technical logs needed for security, reliability, and abuse prevention.
3. How we use information
We use contact details to answer your request, discuss product access, understand product interest, protect the service from abuse, and maintain the reliability of our website. We do not sell personal information.
4. Website analytics and consent
We use Google Analytics 4 (GA4) only after you select Accept analytics. Its purpose is aggregate website usage analytics, such as understanding which public pages are visited and how the site is used so we can improve it. The Google tag is not loaded, no analytics data is sent to Google, and no analytics cookies are stored before consent.
When enabled, GA4 receives a limited page view containing the public page path and title. The Release Visibility Check also records starts, completions, reviews, successful sharing and product-link clicks, with the assessment version only. Answers, scores and deletion keys are excluded. Query strings and URL fragments are excluded. We do not send names, email addresses, company names, contact-form values, messages, or other information that directly identifies you to GA4. Advertising storage, advertising user data, and advertising personalization remain disabled. Google processes analytics data under its Privacy Policy.
Your choice is saved in your browser so the banner does not appear on every page. You can change or revoke it at any time by selectingin this policy or in the footer, then choosing Reject. Revoking consent removes GA4 cookies available to this site and stops further analytics loading on subsequent page views.
5. Release Visibility Check and voluntary research
The check calculates results in your browser without requiring an account or email. Your answers remain in the current page until you leave or refresh it. They are not sent to us unless you separately review and select Share my answers. Optional written explanations are excluded from sharing unless you choose to include them.
If you share, we receive the displayed selections, any included explanations, the questionnaire versions, a submission ID, your consent record and the submission time. We calculate the score again on the server. We use these responses to understand release problems and improve QaCockpit. No email address is required or linked to a research response, and we do not send answers, scores or written explanations to GA4. Written explanations may contain information about you, so we do not describe these submissions as anonymous.
Research responses are stored in our protected PostgreSQL service in Frankfurt, with access restricted to authorized QaCockpit operators. We remove the answers from active research storage within 90 days. You receive a receipt and deletion key to remove your answers sooner. After deletion, an empty receipt with its deletion-key hash remains until the original expiry to prevent request retries from restoring the answers.
6. One-time Azure Marketplace launch notification
The optional launch-notification signup closed when QaCockpit for Azure DevOps became publicly available. A person who confirmed before the launch may receive the one Marketplace announcement they requested. We do not convert that consent into a newsletter or broader product marketing, and it does not share Release Visibility Check answers. Confirmation links expire after 24 hours. Unconfirmed requests are removed from active storage within seven days; confirmed requests expire within 12 months.
We retain the address, consent version, confirmation time and protected action-key hashes to operate this signup. Use the unsubscribe link in your email to remove the request or subscription from active storage at any time. Email providers process the address and message to deliver these requested emails.
7. Azure DevOps extension onboarding and evaluation
When an authenticated user first opens QaCockpit inside an Azure DevOps organization, we receive the immutable organization identifier and display name, extension version, observation time, and the current user's Azure identifier, display name and login when Azure DevOps supplies them. We treat the login as an email address only when it has a valid email format. Each unavailable value keeps an explicit reason instead of being presented as known. Azure DevOps does not give the extension a verified installer identity, so we describe this person as the first observed user, not the installer.
We use this minimum record to understand whether an organization reached the product after installation, notify authorized QaCockpit support, offer setup help, request product feedback, and avoid duplicate first-open notices. It is not a newsletter consent. You may object to direct follow-up or ask us to delete or correct the record by emailing support@qacockpit.app. This onboarding flow does not send project names, pipeline names, test names, results, saved workspace content, or interaction analytics.
When an authorized Azure DevOps user starts the QaCockpit extension evaluation, we receive the immutable Azure organization identifier and display name, the initiating Azure user identifier, the contact name and work email, an optional company name, the accepted Terms and Privacy versions, and the activation and expiry times. We use this information to issue and support organization access, prevent duplicate grants, respond to extension requests, and protect the service. We do not receive pipeline, project, test-result, campaign, or saved-view content through this licensing flow.
Product-update consent is optional and separate from the consent needed to start the evaluation. Onboarding, evaluation, and audit records are retained while needed to operate access, handle support, understand activation, and prevent repeated grants or notices, and then according to legal and business-record obligations. An expired evaluation does not delete personal Extension Data stored by Azure DevOps.
8. Service providers and retention
Hosting and email providers process information only as needed to deliver the website and correspondence. We retain inquiries for as long as needed to handle the conversation, maintain appropriate business records, and meet legal obligations.
Encrypted recovery backups are kept separately from active storage and are not used for research or marketing. Copies may remain until the applicable backup cycle expires, for up to 430 days. Access is restricted to recovery operators. Restoration requires reapplying expiry and deletion controls before research or notification processing resumes. Infrastructure also processes technical logs for security and reliability; we do not intentionally log questionnaire bodies, email bodies or confirmation/deletion keys.
9. Your choices
You may ask us to access, correct, or delete information associated with your inquiry, subject to applicable legal requirements. You may also stop a product conversation at any time.
10. Contact
For privacy questions or requests, emailsupport@qacockpit.app. Operator and legal-entity details will be published before commercial self-service availability.