Privacy Policy

1. Controller

The controller responsible for the processing of personal data on this website within the meaning of the GDPR is:

Marco Timme
Kurzekampstr. 16 Q
38104 Braunschweig
Email: support@testlabiq.com

2. Hosting and Server Logs

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Personal data collected on this website is processed on Vercel's servers. This may include IP addresses, contact requests, meta and communication data, contract data, contact details, names, website accesses, and other data generated via a website.

The host automatically stores so-called server log files with each access, which your browser transmits automatically. These are:

• Browser type and version
• Operating system used
• Referrer URL
• Hostname of the accessing computer
• Time of the server request
• IP address (anonymized or full, depending on configuration)

This data is not merged with other data sources. The legal basis for data processing is Art. 6(1)(f) GDPR (legitimate interest in the technically error-free presentation and optimization of the service). Logs are deleted after a maximum of 30 days.

We have concluded a data processing agreement with Vercel (Art. 28 GDPR). Where data is transferred to the US, this is based on the EU Commission’s adequacy decision for the EU-US Data Privacy Framework insofar as the provider is certified under it, and otherwise on the EU Commission’s Standard Contractual Clauses (Art. 46(2)(c) GDPR).

3. Cookies and Analytics

This marketing website (www.testlabiq.com) initially uses only technically necessary cookies required for the operation of the website. No consent is required for these under § 25(2) TDDDG.

Beyond that, we use the analytics service PostHogto understand how this website is used (e.g. pages visited, time on page, technical errors). PostHog uses cookies or comparable storage technologies for this and processes personal data such as your (possibly truncated) IP address, device and browser information, and your usage behavior on this website. The provider is PostHog Inc.; depending on configuration, processing may take place in the EU or the US — where data is transferred to the US, we rely on the EU Commission’s Standard Contractual Clauses as an appropriate safeguard.

PostHog is only loaded once you have given consent via the cookie banner on this website. The legal basis in that case is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Without your consent, no analytics cookie is set and no connection to PostHog is established. You can withdraw your consent at any time with future effect: Change cookie settings.

4. Contact Form and Email

When you contact us via the contact form or by email, we process the details you provide (name, email address, optionally your company, and your message) to answer your request. The legal basis is Art. 6(1)(b) GDPR where your request relates to a contract or pre-contractual steps (e.g. a demo), and otherwise Art. 6(1)(f) GDPR (legitimate interest in answering inquiries).

The contact form sends your message by email to support@testlabiq.com. To send it, we use the email service Resend (USA) as a processor. The safeguards described in section 2 apply accordingly to transfers to the US.

We delete your request once it has been fully dealt with, unless statutory retention obligations (e.g. for business correspondence) apply.

5. LinkedIn Company Page

We operate a company page on LinkedIn (linkedin.com/company/testlabiq). This website only links to LinkedIn; no LinkedIn plugins are embedded and no data is sent to LinkedIn before you click the link.

When you visit our LinkedIn page, LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland, processes your data under its own terms. For the statistics about our page (Page Insights), we are joint controllers with LinkedIn (Art. 26 GDPR); LinkedIn provides a joint controller agreement for this and takes primary responsibility for fulfilling your data subject rights. The legal basis is our legitimate interest in presenting our offering (Art. 6(1)(f) GDPR).

6. Use of the Application at app.testlabiq.com

The actual application is operated at app.testlabiq.com. It is available only to organizations (our customers) and their users.

Roles

For the data our customers record in the application (e.g. projects, test objects, measurement data, reports, documents, and details about staff, qualifications, and customer contacts), we process personal data as a processor on behalf of the respective customer (Art. 28 GDPR); the customer is the controller for that data. We are the controller for managing user accounts, application security, and support.

Data Processed

• Account data: email address, name, organization, and role.
• Content data: all data that users or connected test stations record or upload in the application.
• Log data: an audit log of which user (or AI agent) made which change and when, plus technical server logs (including IP address, time, and requested address).
• Support data: conversations from the in-app support chat.

Legal Basis

Art. 6(1)(b) GDPR (performance of the contract with your organization or provision of your user account) and Art. 6(1)(f) GDPR (legitimate interest in system security, abuse detection, and traceability of changes).

Cookies in the Application

The application only sets technically necessary cookies for the login session (§ 25(2) TDDDG). No analytics or advertising cookies are used in the application.

AI Support Assistant

In the support chat, an AI assistant answers questions. To do so, your messages, the previous course of the request, and the data of your organization that the assistant reads to answer are sent to the AI provider Anthropic. The assistant never receives access keys or tokens. Under Anthropic’s contractual terms, content sent via the API is not used to train AI models. If the assistant hands a request over to our team, the conversation is created as a ticket in our ticketing system Linear, together with your organization’s name and your email address.

Service Providers (Processors)

We use the following service providers to operate the application, each under a data processing agreement:

• Railway Corp. (USA) – hosting of the application and the database. The servers are located in a data center in the Netherlands (EU).
• WorkOS, Inc. (USA) – sign-in and authentication.
• Resend (USA) – sending email notifications from the application (e.g. about deadlines and status changes), if you have enabled them in your notification settings.
• Anthropic PBC (USA) – AI model for the support assistant.
• Linear Orbit, Inc. (USA) – ticketing system for support requests handed over to our team.
• Cloudflare, Inc. (USA) – Cloudflare R2 object storage for PDF reports and uploaded documents.

Where data is transferred to the US, the safeguards described in section 2 (EU-US Data Privacy Framework or Standard Contractual Clauses) apply accordingly.

Retention

Data is only stored for as long as necessary to provide the service or as required by law. After the contract ends or the account is deleted, personal data is deleted within 30 days unless a statutory retention obligation applies.

7. Your Rights

You have the following rights with regard to your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to withdraw consent at any time with future effect (Art. 7(3) GDPR)

You also have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data. The authority responsible for us is the State Commissioner for Data Protection of Lower Saxony (Die Landesbeauftragte für den Datenschutz Niedersachsen), Prinzenstraße 5, 30159 Hannover, Germany. To exercise your rights, please contact: support@testlabiq.com