Privacy Policy

1. Introduction

This Privacy Policy explains how ProITM Piotr Szczepaniuk("we", "our", "us"), trading as Lead QA, collects, uses, discloses, and protects personal data when you use the Lead QA monitoring service and related Lead QA websites (the "Services").

Lead QA monitors public web pages (forms, CTAs, page health, and related checks) on URLs you authorize. It is designed to avoid collecting visitor content from those pages.

2. Data controller

The data controller is:
ProITM Piotr Szczepaniuk
Indywidualna działalność gospodarcza (sole proprietorship)
al. Aleja Wilanowska 95 lok. 8, 02-765 Warszawa, Poland
NIP: 1132404367
REGON: 523963446
(No KRS — a JDG does not have one.)

Privacy contact: contact@leadqa.app or our contact form.

We have not appointed a Data Protection Officer (DPO). Under GDPR Art. 37, a DPO is required only in specific cases (public authority, large-scale systematic monitoring of data subjects, or large-scale processing of special categories of data). Lead QA does not meet those thresholds: we process account and monitoring metadata for agency customers, not large-scale profiling of end visitors. Privacy inquiries are handled by the controller at the contact above.

3. Categories of personal data

3.1 Account and billing data (you provide)

• Account: name, email address, authentication credentials (hashed by our auth provider), organization/team name
• Billing: billing email, tax identifiers you provide (e.g. VAT ID), subscription plan, invoices — payment card details are processed by Stripe; we do not store full card numbers
• Communications: messages you send via contact forms, email, or support
• Alert channels: email addresses (and, if enabled later, other channel targets) you configure for monitor alerts

3.2 Monitoring data the Service produces

• Monitor configuration: URLs you authorize, monitor type, check frequency, and related settings
• Check results: status (e.g. ok / failed / warning), reason, failure mode, duration, timestamps, and limited technical metadata needed to explain a result
• Incidents: titles, severity, and first/last failure timestamps
• Optional failure screenshots: disabled by default; when enabled, inputs are masked and retention is short (see §6)

3.3 Data we explicitly do not collect or store

• Form submissions or real lead / visitor content from monitored sites
• Field values entered by real visitors
• Cookies, passwords, or session tokens from monitored sites
• Playwright traces, video recordings, or full HTML page bodies
• Network request/response bodies beyond what is needed for a status finding

Dry-run form checks use synthetic test data only (for example name "Lead QA Monitor", email monitor@leadqa.app) and do not submit forms.

3.4 Data collected automatically

• Usage: pages and features used in the product UI, approximate timestamps
• Device / log: IP address, browser type, and similar technical data in server and security logs
• Cookies: see §12 (Cookies) below — essential cookies only; no consent banner for MVP

4. Purposes and legal bases (GDPR Art. 6)

We process personal data only where a legal basis applies:

• Art. 6(1)(b) — contract: create and manage your account, run authorized monitors, deliver check results and alerts, provide support, and process subscriptions
• Art. 6(1)(c) — legal obligation: tax, accounting, and other mandatory record-keeping
• Art. 6(1)(f) — legitimate interests: secure and improve the Services, prevent abuse/fraud, investigate incidents, and maintain product reliability, balanced against your rights
• Art. 6(1)(a) — consent: non-essential cookies / marketing communications where required; you may withdraw consent at any time without affecting prior lawful processing

We do not use your proprietary page content or check artifacts to train general-purpose AI models. Regular Playwright checks do not use AI. Optional self-healing or discovery features (if enabled) are scoped to that purpose and are not part of the default check hot path.

5. Recipients and sub-processors

We do not sell personal data. We share data with processors who help us operate the Services, under appropriate contracts:

Material additions will be reflected in this section. Where we act as your processor, see also our Data Processing Agreement (DPA). We may also disclose data when required by law or to protect rights, safety, or the integrity of the Services.

6. Retention

• Account data: for the life of the account; after deletion, residual backups may remain up to 30 days unless a longer legal hold applies
• Check run results: typically 90 days
• Resolved incidents: typically 12 months
• Failure screenshots (if enabled): maximum 24 hours
• Billing and tax records: retained for 5 years from the end of the tax year under Polish tax rules (not 7 years)
• Security / server logs: retained only as long as needed for security and operations, then deleted or anonymized

7. International transfers

Some processors may process data outside the EEA. Where we transfer personal data outside the EEA, we use an approved mechanism under GDPR Chapter V — typically the European Commission's Standard Contractual Clauses (SCCs), and where applicable the EU–US Data Privacy Framework for certified US providers — together with any required supplementary measures.

8. Your rights

If the GDPR applies to you, you may exercise the following rights (subject to legal limits):

• Access — Art. 15
• Rectification — Art. 16
• Erasure — Art. 17
• Restriction of processing — Art. 18
• Data portability — Art. 20
• Object to processing (including Art. 6(1)(f) legitimate interests) — Art. 21
• Withdraw consent where processing is based on Art. 6(1)(a) — Art. 7(3)

To exercise these rights, email contact@leadqa.app. We aim to respond within 30 days of a verified request (extendable as permitted by Art. 12(3) for complex requests).

You also have the right to lodge a complaint with a supervisory authority. In Poland that is the Urząd Ochrony Danych Osobowych (UODO):
ul. Stawki 2, 00-193 Warszawa
Tel. +48 22 531 03 00
Email: kancelaria@uodo.gov.pl

9. Security

We use industry-standard measures appropriate to the risk, including TLS in transit, access controls, and least-privilege access to production systems. No method of transmission or storage is 100% secure.

10. Personal data breaches

Where a personal data breach is likely to result in a risk to individuals' rights and freedoms, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it (GDPR Art. 33). Where required, we will also inform affected individuals (Art. 34).

11. Children

The Services are intended for business users and are not directed at individuals under 16. We do not knowingly collect personal data from children.

12. Cookies

We use strictly necessary / essential cookies and similar storage only (for example Supabase auth session, security tokens, and theme/locale preferences). We do not currently set analytics or advertising cookies, so we do not show a cookie consent banner.

Third parties such as Stripe may set their own cookies on their checkout surfaces. You can block cookies in your browser; blocking essential cookies may break sign-in.

If we later introduce non-essential cookies, we will update this section and request consent where required.

13. Changes

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-product notice where appropriate. The "Last updated" date at the top shows the latest revision.

14. Contact

Privacy inquiries: contact@leadqa.app · Website: leadqa.app · Product: Lead QA · Imprint · DPA