Privacy Policy

1. Introduction

AtwalLabs ("we," "our," or "us") operates the atwallabs.com website and the AtwalLabs test automation platform (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

2. Information We Collect

Account Information

When you register, we collect your name, email address, and an encrypted password. If you join an organization, we associate your account with that organization.

Usage Data

We collect information about how you use the Service, including test cases uploaded, test executions performed, and features accessed. This data is used to improve the Service and provide support.

Test Data

You may upload test data files (CSV, Excel) containing information used for data-driven testing. This data is stored securely and associated with your account. We do not access, review, or use your test data for any purpose other than providing the Service.

Contact Information

When you submit our contact form, we collect your name, email, company name, and message content.

3. How We Use Your Information

• To provide, maintain, and improve the Service
• To authenticate your identity and manage your account
• To send transactional emails (test execution notifications, contact form replies)
• To respond to your inquiries and support requests
• To detect and prevent security incidents
• To comply with legal obligations

We do not sell your personal information. We do not send marketing emails. All emails are transactional and triggered by your actions.

4. Data Storage and Security

Your data is stored on secure servers hosted on Amazon Web Services (AWS) in the US East (Ohio) region. We implement industry-standard security measures including:

• SSL/TLS encryption for all data in transit
• Bcrypt password hashing (passwords are never stored in plain text)
• Organization-level data isolation (multi-tenant architecture)
• Session-based authentication with automatic timeout
• Rate limiting on authentication endpoints
• Security headers (CSP, HSTS, X-Frame-Options)

5. Data Retention

We retain your account data for as long as your account is active. Test execution artifacts (screenshots, videos, reports) are retained for a limited period and automatically cleaned up. You may request deletion of your account and associated data at any time by contacting us.

6. Third-Party Services

We use the following third-party services to operate the platform:

• Amazon Web Services (AWS) — cloud hosting and infrastructure
• Resend — transactional email delivery
• Google Analytics 4 — visitor measurement on our public pages only (property G-39ECZXPHXY). It is not loaded at all on any page inside the product, and not on our demo form. The data is processed by Google Ireland Limited if you are in the European Economic Area, the United Kingdom or Switzerland, and by Google LLC if you are anywhere else. In either case it may be stored on servers outside your country. See section 7 for exactly what it collects and how to opt out.
• Optional hosted translation service — disabled by default. The platform translates test steps locally with a rule-based parser and locates elements deterministically; no test content leaves the platform unless this optional service is explicitly enabled for your deployment. When it is enabled, what it receives is the test’s title and its steps exactly as written, together with the address of the application under test. Values from a data set are not sent — a step written with a {{column}} placeholder is sent with the placeholder unresolved. Anything typed directly into a step or a title does go with it, so a password or a personal detail written inline is sent too; keep those in a data set rather than in the step text if you enable this service.

7. Cookies and analytics

Our own cookie

We set one cookie, connect.sid, to keep you signed in — it is the only cookie our own servers set, on any page, in any part of the service. It is marked HttpOnly (no script on the page can read it), Secure (it is only ever sent over HTTPS), and SameSite=Strict (browsers will not attach it to requests that originate on another site). It expires four hours after it is issued, and that four hours is fixed: using the service does not extend it, so you will be asked to sign in again four hours after signing in. Signing out removes it from your browser immediately, and ends the session on our side at the same moment. It is not used for analytics and not shared with anyone.

Other things we store in your browser

None of these are cookies, none are sent to anyone, and all of them stay on your device:

• atwal.attribution — if you arrive from an advertisement or a campaign link, the campaign parameters in that link are kept for the rest of the browser session so that, if you then ask us for a demo, we can tell which campaign brought you. It is written only when the link you arrived on carries those parameters, and it is discarded when you close the tab.
• atwallabs_live_mode and lastUsedKbSlug — two interface preferences inside the product, remembering a toggle you set and the last application you worked on.

Analytics on our public pages

Our public pages — the home page, the feature and comparison pages, the FAQ, the sign-in and sign-up pages, and similar — load Google Analytics 4. These are the measurements it sends:

• When you open a page: the page address, the page title, the page you came from if you arrived by following a link, your browser's language setting, your screen resolution, your browser and its version, your operating system and its version, whether the device is a mobile one, its processor type, and a randomly generated visitor number. Google also receives your IP address, because your browser has to contact Google to send any of this, and derives an approximate location from it.
• When you scroll 90% of the way down a page: that it happened.
• When you click a link that leads to another website: the address of that link.
• When you leave a page: how long the page was open and in the foreground, in milliseconds.

It does not receive what you type into any form, and it does not record that you started or submitted one.

Two cookies, and what they are for

On those pages Google Analytics sets _ga and _ga_39ECZXPHXY in your browser. They hold the randomly generated visitor and session numbers that let us tell a returning visit from a new one and count a visit as one session rather than several. They are set on our own domain rather than Google's, but that does not keep them from Google: the Google Analytics script running on the page reads them and sends the visitor number to Google with every measurement it makes. They expire about 13 months after your most recent visit — each visit renews them, so they only begin to count down once you stop coming back.

It is not loaded inside the product at all

On every page under /dashboard, on the enrolment screen at /enrol, and on our demo form at /demo, the Google Analytics script is never requested. Your browser does not contact Google from those pages, so nothing you do while signed in — the suites you write, the tests you run, the run and report pages you open, your organisation, your email — reaches Google, and the two cookies above are not set there. If you move from a public page into the product without a page reload, analytics is switched off before anything further is sent. Our demo form is excluded for a second reason as well: it is the fixture our own automated tests drive.

No advertising

We set no advertising cookies and send no advertising signals. We decline Google's advertising features at the moment the page loads: advertising storage, advertising user data and ad personalisation are all set to denied. The consequence is that the request Google Analytics would otherwise make to its advertising domain is never made at all. We use no remarketing audiences and no cross-site tracking cookies.

How long Google keeps it

Two different limits apply, because Google stores two different things:

• The individual measurements — each page you opened, each scroll, each outbound click, and how long each page was open, tied to the random visitor number in the _ga cookie — are deleted after two months.
• The visitor-level record — the random visitor number itself and what is attached to it — is kept for 14 months after your most recent visit. Coming back restarts the 14 months; stop visiting and it is deleted 14 months later.

Aggregated statistics that cannot identify anyone — totals, such as how many people read a page in a given month — are not covered by either limit and may be kept indefinitely.

How to opt out

We do not currently show a cookie banner, so analytics is active on our public pages from your first visit. Any one of these stops it:

1. Install Google's official Analytics Opt-out Browser Add-on. It stops Google Analytics sending anything, on our site and on every other site that uses it.
2. Turn on your browser's tracking protection, or use an extension that blocks analytics scripts. This prevents the Google Analytics script from loading at all, so your browser never contacts Google.
3. Block cookies for this site in your browser settings. We have tested this: with cookies blocked, Google Analytics still loads but sends us no measurements at all — not the page you opened, not scrolling, not anything. Your browser does still fetch the Google Analytics script itself from Google when you open a public page, which tells Google your IP address and which browser you use; option 2 is the one that prevents even that.

None of these affects your ability to sign in or use the service — the session cookie is separate from analytics, and the signed-in product does not load analytics at all.

8. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and data
• Export your test cases and data
• Withdraw consent at any time

To exercise any of these rights, contact us at manpreet.atwal@atwallabs.com.

9. Children's Privacy

The Service is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at: