Privacy policy

The controller of your personal data is Lucas Ezequiel Yoris, national ID 38.511.756 (“we” or “the controller”), in connection with the website https://performate.app, the associated user account, and the Performate desktop software (Windows application).

For privacy enquiries, contact us at: performate.app.sales@gmail.com.

This policy explains how we process personal data when you use our website, create or manage an account, subscribe or use a free trial, and when you use the Performate desktop application.

Data you enter into tests (e.g. URLs, headers, request bodies, variables, or load-test results) is your responsibility: you must have a lawful basis to process it and avoid including unnecessary personal data.

Website and account: account and authentication identifiers (e.g. email), profile data related to your subscription (plan, trial or subscription status, relevant dates), and usual technical data from your browser or device when you visit the site.

Desktop app: if you sign in, we use the same identity provider and backend as the website. The app stores workspaces, tests, variables and settings on your device. If your plan allows, encrypted copies of that data may be uploaded to cloud storage.

Google sign-in: if you choose this option, Google processes data under its own policy; we receive the information needed to authenticate you.

AI features (summaries / analysis): if you enable features that send content to an AI provider (e.g. Google Gemini), that content is transmitted to that provider under its policy. An API key, if you configure one, may be stored on your device.

Forms and support: if you contact us, we will keep your message content and contact details you provide.

Provide the service, manage your account and the contractual relationship (performance of a contract or pre-contractual steps).

Manage subscriptions, trials and feature access according to your plan (performance of a contract).

Maintenance, security, fraud prevention and service improvement (legitimate interests where applicable; in some cases legal obligation).

Comply with legal obligations (e.g. accounting retention or responses to authorities where required).

Aggregated website analytics to understand use of the site (legitimate interests; you can manage cookies as described in our cookie policy).

Service-related communications or, where required, marketing with your consent.

We use providers that process data on our behalf, including:

Supabase (authentication, database and, where applicable, object storage for encrypted sync of workspaces, variables, JS Library, datasets, test results, and AI reports on eligible plans).

Vercel (website hosting and hosting-provider analytics, as applicable).

Google (OAuth sign-in and, if you use it, the Gemini API for AI features).

These providers may process data outside the European Economic Area. Where required, we rely on appropriate safeguards (e.g. standard contractual clauses). See their policies for details.

We keep data for as long as needed for the purposes above and to meet legal obligations.

Account data is kept while your account is active; after closure, we delete or anonymise it subject to law and any need for claims or legal retention.

Technical or security logs may be kept for additional limited periods.

If you are in the EEA, UK or another jurisdiction with applicable law, you may have rights of access, rectification, erasure, restriction, objection and data portability where applicable.

Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

You may lodge a complaint with your local data protection authority (in Spain, the AEPD).

To exercise your rights, email performate.app.sales@gmail.com with your request and a reliable means of identification.

We implement reasonable technical and organisational measures to protect data. No system is 100% secure.

Cloud sync of workspaces, when available for your plan, is described in the product documentation as encrypted; key and device management is shared with you.

The service is not directed at children under 16 (or the minimum age in your jurisdiction). We do not knowingly collect data from children.

We may update this policy. We will publish the revised version on the website with a new update date. Continued use after material changes may constitute acceptance where permitted by law.