Who we are
Testo ("we", "us") runs Testo at lightcyan-anteater-926483.hostingersite.com (the "Service"). For the personal data described here we are the "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), and the controller under other laws that use that term.
What we collect
- Account details: your name, email address, password (stored only as a secure hash), and, if you add them, your phone number, country and time zone.
- Billing details: if you add them, your business name, tax number (such as GSTIN) and billing address, which we print on your invoices.
- Payments: the amount, currency, date, what was bought, the payment method type and the processor's reference. Card, UPI and bank details are entered with the payment processor and never reach our servers.
- Your Content: what you submit to the Service and what it produces for you.
- Support: messages and files you send us through tickets or the contact form.
- Security and technical data: sign-in times, the devices and browsers you sign in from, IP addresses, security events (such as password changes and two-factor changes) and server logs.
- Cookies and similar technologies: see the Cookie Policy.
Why we use it
- To create and run your account, provide the Service you ask for, and keep it secure (performing our contract with you; your consent where the DPDP Act requires it).
- To take payments, issue invoices and keep accounting and tax records (legal obligation).
- To answer your questions and complaints, and to send you emails about your account, security and purchases.
- To prevent fraud and abuse, enforce our Terms and comply with the law, including lawful requests from authorities.
- With your permission, to send you news or offers. You can opt out at any time.
We do not sell your personal data, and we do not use it for automated decisions that have legal or similarly significant effects on you.
Who receives it
We share personal data only with the Providers that help us run the Service, under contracts that require them to protect it, and with authorities where the law requires.
| Service | What it does | What it receives | Provider and location |
|---|---|---|---|
| Payments | Takes and reconciles your payment, and handles refunds. | Your name, email, the amount and order reference. Card, UPI and bank details are entered with the processor and never reach our servers. | Payment processors, in India and abroad |
| Email delivery | Sends verification, receipt, security and support emails. | Your name, email address and the message. | Our email provider |
| Hosting and security | Runs the website and database; blocks automated abuse. | Everything you store with us, over encrypted connections; technical data such as your IP address. | Our hosting provider and a bot-protection service |
| Fonts | Our pages load typefaces from Google Fonts. | Your IP address and browser details, as with any web request. | Google (United States and other regions) |
Transfers outside India
Some Providers process data outside India. We transfer data only as the DPDP Act and other applicable laws allow, and choose Providers that protect it appropriately.
How long we keep it
| Data | How long |
|---|---|
| Account, profile and Your Content | While your account is open. Deleted when you delete your account. |
| Support tickets and their attachments | While your account is open. Deleted when you delete your account. |
| Payment records and invoices | 8 years from the end of the financial year, as Indian tax and accounting law requires. |
| Security logs | Up to 1 year, longer where needed for an investigation or a legal obligation. |
| Contact-form messages | Up to 2 years after the conversation ends. |
Security
We protect your information with encrypted connections, hashed passwords, optional two-factor sign-in, a list of signed-in devices you can sign out of, and restricted access to our systems. No system is perfectly secure, so please use a strong, unique password.
Your rights
- Access and portability: download a copy of your data from your profile (Download my data), or ask us.
- Correction: edit your profile and billing details at any time, or ask us to correct anything else.
- Erasure: delete your account from your profile. We then erase your personal data except what the law requires us to keep (see above).
- Withdraw consent: where we rely on consent, you can withdraw it at any time; this does not affect what we did before.
- Grievance and nomination: complain to our Grievance Officer (see Grievance Redressal), and nominate someone to exercise your rights if you die or become unable to, as the DPDP Act allows.
To make a request, use the contact form. We may verify your identity first. You may also complain to the Data Protection Board of India after using our grievance process.
Children
The Service is for people aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has given us data, contact us and we will delete it.
Changes
We may update this policy. We will post the new version here with a new date and tell you by email or in the Service if a change is significant.
Contact
For privacy questions or requests, use the contact form.