Privacy Policy
Last updated: February 26, 2026
Questions? Email privacy@testiflow.io
1. Who We Are
TestiFlow ("we," "us," "our") operates the video testimonial collection platform at testiflow.io. For the purposes of applicable data protection law, TestiFlow is the data controller for account and usage data, and acts as a data processor on behalf of our customers (space owners) for testimonial videos collected from their customers.
Privacy inquiries: privacy@testiflow.io
2. Who This Policy Applies To
This policy covers two distinct groups:
- Space owners — businesses and individuals who create a TestiFlow account and collect testimonials from their customers.
- Testimonial givers — the customers of space owners who submit video testimonials through a collection link. If you recorded a testimonial for a business that uses TestiFlow, this policy describes how we handle your recording.
3. Data We Collect
3.1 Account data (space owners)
- Name and email address (provided at signup via Clerk)
- Profile picture (optional, from OAuth provider if used)
- Billing name and last four digits of card (payment records; full card data is handled by Stripe and never touches our servers)
- Space configuration: branding, colors, logo, collection questions, settings
3.2 Testimonial content (collected on behalf of space owners)
- Video recordings (including face and voice of the testimonial giver)
- AI-generated transcriptions of video audio (via OpenAI Whisper)
- Name and any other information voluntarily provided by the testimonial giver during submission
Important: We do not use facial recognition, voice identification, or any biometric analysis technology. Videos are processed solely for storage, playback, and transcription of spoken content. Your video is not used to identify you uniquely beyond the context of the specific testimonial submission.
3.3 Usage and technical data
- Pages visited, features used, session duration
- IP address, browser type, device type, operating system
- Referrer URL
- Error logs and crash reports (via Sentry, where enabled)
4. Legal Bases for Processing (GDPR)
For users in the European Economic Area (EEA) and UK, we rely on the following legal bases under GDPR Article 6:
| Processing activity | Legal basis |
|---|---|
| Creating and managing your account | Contract performance (Art. 6(1)(b)) |
| Storing and delivering testimonial videos | Contract performance (Art. 6(1)(b)) |
| AI transcription of testimonial audio | Contract performance (Art. 6(1)(b)) |
| Payment processing | Contract performance (Art. 6(1)(b)) |
| Analytics and product improvement | Legitimate interests (Art. 6(1)(f)) |
| Security and fraud prevention | Legitimate interests (Art. 6(1)(f)) |
| Transactional emails (receipts, alerts) | Contract performance (Art. 6(1)(b)) |
| Marketing communications | Consent (Art. 6(1)(a)) — opt-in only |
5. Sub-Processors and Data Sharing
We do not sell your personal data. We work with the following sub-processors to operate the Service. Each has a Data Processing Agreement (DPA) in place:
| Sub-Processor | Purpose | Data processed | Location |
|---|---|---|---|
| Clerk | Authentication, user management | Name, email, auth tokens | US (GCP) |
| Cloudflare R2 | Video file storage | Video files | US |
| Neon | Database hosting (PostgreSQL) | All structured account and testimonial data | US (AWS) |
| OpenAI | AI transcription (Whisper API) | Audio content from testimonial videos | US |
| Vercel | Application hosting, edge functions | Web traffic, server logs | US / Global edge |
| Upstash | Rate limiting (Redis) | IP addresses, request metadata | US |
| Sentry | Error monitoring | Error logs, stack traces | US |
Note on OpenAI: Audio submitted to OpenAI via the API is not used to train OpenAI models, per OpenAI's Data Processing Addendum and API usage policies.
We may also disclose your information if required by law, court order, or government authority, or to protect the rights and safety of TestiFlow and its users.
6. International Data Transfers
TestiFlow operates primarily from the United States. If you are located in the EEA, UK, or Switzerland, your personal data will be transferred to and processed in the US. These transfers are made under Standard Contractual Clauses (SCCs) approved by the European Commission, which all our major sub-processors have adopted in their DPAs.
7. Data Retention
We retain data for the following periods:
| Data type | Retention period |
|---|---|
| Account data (name, email) | Duration of account + 30 days after deletion |
| Video files (Cloudflare R2) | Until deleted by space owner, or 30 days after account closure |
| AI transcriptions | Same as associated video file |
| Payment records | 7 years (legal and tax obligation — overrides deletion right) |
| Server logs / IP addresses | 90 days (rolling) |
| Encrypted backups | 30 days (rolling backup cycle) |
| Support communications | 3 years |
When you delete your account, your personal data is removed from active systems within 30 days. Encrypted backups may retain the data for up to an additional 30 days before being overwritten. Payment records are retained for 7 years as required by applicable financial and tax law, even after account deletion.
8. Cookies and Tracking
We use the following cookies and tracking technologies:
- Strictly necessary cookies (Clerk session cookies): Required for authentication and security. No consent required.
- Analytics (Vercel Analytics, Plausible): First-party, privacy-preserving analytics that do not use cross-site tracking cookies, do not fingerprint users, and do not share data with advertising networks. No personal data is collected. No cookie consent banner is required for these tools.
We do not use advertising cookies, third-party tracking pixels, or any technology that shares your data with advertising platforms.
9. Your Rights
9.1 Rights under GDPR (EEA and UK residents)
You have the right to:
- Access (Art. 15): Obtain a copy of your personal data we hold
- Rectification (Art. 16): Correct inaccurate or incomplete data
- Erasure (Art. 17): Request deletion of your data ("right to be forgotten")
- Restriction (Art. 18): Limit how we process your data in certain circumstances
- Portability (Art. 20): Receive your data in a machine-readable format
- Object (Art. 21): Object to processing based on legitimate interests
- Lodge a complaint: File a complaint with your local Data Protection Authority (e.g., CNIL in France, ICO in the UK, BfDI in Germany)
9.2 Rights under CCPA/CPRA (California residents)
You have the right to:
- Know: What personal information we collect and how it is used
- Delete: Request deletion of your personal information
- Correct: Correct inaccurate personal information
- Opt out of sale or sharing: We do not sell or share personal data for cross-context behavioral advertising
- Non-discrimination: We will not discriminate against you for exercising your rights
To exercise any of these rights, email privacy@testiflow.io. We will respond within 30 days. We may need to verify your identity before fulfilling your request.
10. Responsibilities of Space Owners
If you use TestiFlow to collect testimonials from your customers, you are acting as an independent data controller for the personal data of testimonial givers. This means:
- You are responsible for obtaining informed consent from testimonial givers before directing them to a TestiFlow collection page.
- You must disclose TestiFlow as a data processor in your own privacy policy.
- You must handle data subject requests from your customers relating to their testimonial data (we will assist you as your processor).
11. Children's Privacy
TestiFlow is not directed to persons under 16 years of age. We do not knowingly collect personal data from children. If you believe a child under 16 has submitted data through our Service, please contact us at privacy@testiflow.io and we will delete it promptly.
12. Security
We implement industry-standard security measures including HTTPS/TLS encryption for all data in transit, AES-256 encryption for data at rest on Cloudflare R2, access controls and least-privilege principles for database access, and secure authentication via Clerk. No method of transmission over the internet is 100% secure. In the event of a data breach affecting your rights and freedoms, we will notify you and relevant authorities as required by applicable law.
13. Changes to This Policy
We may update this Privacy Policy from time to time. For material changes, we will notify you by email at least 30 days before the change takes effect. The "Last Updated" date at the top of this page reflects the most recent revision. Your continued use of TestiFlow after the effective date of a change constitutes acceptance of the updated policy.
14. Contact
For all privacy-related questions, data subject requests, or concerns, contact us at: privacy@testiflow.io
We aim to respond to all inquiries within 5 business days and to fulfill data subject requests within 30 days.