Privacy notice

ReplayWatch is the controller for the personal data described here and is established in Ireland. This notice is a working draft for the MVP. Have a solicitor review it before you rely on it. Contact: the contact address published in the site settings. You can complain to the Data Protection Commission (dataprotection.ie).

What we collect

• Account email and a password hash, if you create an account.
• The email and URL you submit for a public scan, the score, and the problem list.
• App URLs, verification tokens, flow descriptions, scripts, run logs, and failure screenshots of pages you asked us to open.
• Stripe customer and subscription ids, and billing notices such as a dispute or refund.
• A session cookie that keeps you logged in.

Why

We process account and billing data to provide the service you asked for (contract). We add every new account, and every scan email, to the ActiveCampaign list configured as ReplayWatch Signups. Scan emails are also tagged free-scan. That list is how we send the summary, the paid report, and account mail. You can unsubscribe from marketing mail without closing an account. The legal basis for that list is the steps you took to request the scan or open the account, and our legitimate interest in telling you the result. Security logs are kept for legitimate interests.

Processors

Depending on what you configure: Stripe (payments), Resend (email), ActiveCampaign (the signup list), the database host (Neon or Supabase), Vercel (the web app), Fly.io (the browser worker), and the LLM provider named in LLM_PROVIDER if you generate Playwright scripts. The public scan’s written report is templated and does not require an LLM.

Retention and transfers

Accounts and scans stay until you ask us to delete them or you delete the app in the dashboard. Screenshots are stored so you can see a failure. Some processors are outside the EEA. Where that happens, Stripe, the host, and the email tools rely on their standard contractual clauses or equivalent safeguards. Ask us if you want the current list.

Your rights

You can ask for access, correction, deletion, restriction, portability, and objection. You can also withdraw consent where processing was based on consent. We do not sell personal data. We do not knowingly offer the service to children.

Cookies

The session cookie is strictly necessary to keep a monitoring account logged in. The public scan does not set a tracking cookie.