SpinUI Privacy Policy

Effective date: 12 November 2026 Last updated: 12 November 2026

This policy explains how Digiport OÜ, registry code 14584252 ("SpinUI", "we", "us"), handles personal data when you use the SpinUI service, the SpinUI Recorder browser extension, the private runner agent, the command-line tool, the API and the MCP endpoint for AI agents (together, the "Service"), and our websites.

1. Who is responsible

1. SpinUI as controller. We decide how and why we process account and business data: your sign-up and profile details, organization membership, sign-in and security records, billing records, support messages, and service telemetry. For this data we are the controller.
2. SpinUI as processor. When you use the Service to build and run tests, the content you put in or cause us to collect is customer test content: test definitions, recordings, secrets, crawl results, screenshots, videos, traces, browser logs, received test emails and reports. This content can include personal data that appears on the websites you test. For this content, your organization is the controller and we process it on its behalf, under our Terms and, for business customers, our Data Processing Addendum (DPA).
3. If you are a member of someone else's organization and have a question about test content, contact that organization first. We will help them answer it.
4. Contact: support@spinui.com, Sepapaja 6, 15551 Tallinn, Estonia. We are established in the EU (Estonia), so no EU representative is needed. We have not appointed a data protection officer because we are not required to. For any privacy question, write to support@spinui.com.

2. Data we collect

2.1 Account and organization data (controller)

• Name, email address, password (stored only as a salted hash), and email verification status.
• Where we offer sign-in with Google or Microsoft and you link and use it: an account identifier from that provider, your name and email address. We request only the openid, profile and email scopes.
• A record that you accepted our Terms and this policy at sign-up: the versions, the time and your IP address.
• Two-step sign-in (TOTP) settings and recovery codes, stored protected.
• Organizations you belong to, your role in each, invitations you send or receive.
• Records of security events and administrative actions (audit log), for example sign-ins, token creation and revocation, membership changes, settings changes and billing actions.
• Tokens you create (API, CLI, CI, trigger URL, Recorder, AI agent). We store only a hash and a short prefix, plus last-use time and expiry.

2.2 Billing data (controller)

• Your Plan, billing interval, subscription status, trial status, period dates and usage (cloud minutes, test emails received, AI usage).
• Identifiers from our payment reseller (for example a customer ID and invoice references).
• We do not receive or store full payment card numbers. Card details go directly to the reseller (see Section 5).

2.3 Customer test content (processor)

• Test definitions: suites, environments, tests, steps, selectors, checks, variables, data tables, schedules and settings.
• Recordings from the SpinUI Recorder (see Section 9).
• Secrets you store for tests, for example test account passwords. They are encrypted at rest.
• Run artifacts: screenshots, videos (paid Plans), Playwright traces, browser console and network logs, step results, accessibility reports, visual comparison baselines.
• Crawl data: page addresses, titles, links and status codes found when crawling your sites.
• Test emails: messages sent to SpinUI test inbox addresses during a run (see Section 8).
• Notification settings: destinations you set up for alerts, such as email addresses, Slack, Microsoft Teams or webhook URLs. Webhook URLs are encrypted.

Test content may contain personal data if the pages you test show it. Please test with test data wherever possible.

2.4 Service and device data (controller)

• Web server and application logs: time, requested address (with secret-looking query values masked), response status, IP address, browser user agent, and the organization involved.
• Application performance telemetry (Microsoft Azure Application Insights): requests, errors and timings, tagged with an organization ID. Request bodies, sensitive headers and SQL parameters are not exported.
• Private runner health: runner name, version, last-seen time and status.
• Mail receiver connection records: sending server IP address, greeting name, TLS use and message counts. Addresses, subjects and bodies are not logged.

2.5 Support data (controller)

• What you send us when you contact support, by email or through the contact form on spinui.com. The form sends us your name, your email address, the topic you choose and your message. It is delivered to our support mailbox as an email and is not stored in a database. The form uses Cloudflare Turnstile to tell people from bots, as described in section 5. We keep these emails in our mailbox only as long as needed to handle your request.

3. Why we use data, and our legal bases

We do not sell personal data. We do not use personal data or customer test content for advertising. We do not use customer test content to train AI models.

3.1 United States residents (including California)

• In the last 12 months we collected the categories in Section 2: identifiers (name, email, IP address, account IDs), commercial information (plan and billing records), internet activity (logs and telemetry about your use of the Service), and professional information you provide (organization name and role).
• We collect them from you, from your organization's Admins, from your devices, and from the sign-in providers and payment reseller you use.
• We use them for the business purposes in Section 3. We disclose them to the service providers in Section 5.
• We do not sell or share personal information for cross-context behavioral advertising, and we do not use sensitive personal information to infer characteristics.
• You can ask to know, correct or delete your personal information, and you will not be discriminated against for doing so. See Section 12.
• We do not currently meet the thresholds that make a company a "business" under the California Consumer Privacy Act. We still honor the requests described in this section for all US users, and if we become subject to the CCPA or another US state privacy law, we will comply with it.

4. Where data is stored

1. We host the Service on Microsoft Azure in the Central US region. The database, file storage (artifacts and test emails), encryption keys, email sending, logs and our mail receiver are all there.
2. Database backups of the production database are geo-redundant, so backup copies are kept in Azure's paired region, East US 2 (United States).
3. Cloudflare serves our domains and sits in front of the Service. Traffic passes through Cloudflare's global network on its way to Azure.
4. Our AI provider and payment reseller process data in the locations listed in Section 5 and in our sub-processor list.
5. We do not offer EU data residency.

5. Who we share data with

1. Sub-processors and service providers. We use these providers to run the Service. The current list, with purposes, data and locations, is at https://spinui.com/subprocessors:
   • Microsoft Azure: hosting, database, file storage, key management, email sending, monitoring.
   • Cloudflare: DNS, TLS, web application firewall and DDoS protection, routing of some inbound email addresses, hosting of our public website and cookieless website analytics, and bot verification on account forms (sign-in, sign-up, password reset and email verification) and on the website contact form (Turnstile), and delivery of contact-form messages to our mailbox. Our account forms (sign-in, sign-up, password reset and email verification) and the contact form on spinui.com use Cloudflare Turnstile to tell people from bots; Turnstile processes your IP address, TLS fingerprint, browser User-Agent and similar device signals for that purpose, as described in Cloudflare's Turnstile Privacy Addendum (https://www.cloudflare.com/turnstile-privacy-policy/).
   • Anthropic: AI model for AI features, on plans that include them.
2. Payment reseller. Paid Plans are sold through Stripe Managed Payments. Stripe acts as our reseller and as the merchant of record, through its affiliate Link, LLC (shown as "Link" at checkout, on your receipts and on your card statement). It collects your payment details, billing address and tax information directly and processes them under its own privacy policy as an independent controller. It shares subscription and invoice status with us.
3. Sign-in providers. If you choose to sign in with Google or Microsoft, that provider processes your sign-in under its own privacy policy.
4. Destinations you choose. We send data where you or your Admins tell us to:
   • alerts to Slack, Microsoft Teams, email or webhooks;
   • results to your CI system;
   • jobs, including the secrets they need, to your own private runners;
   • test content to AI agents or coding assistants you connect through MCP or the CLI. Those recipients handle the data under your arrangements with them.
5. Your organization. Members of your organization can see its test content according to their role. Super Admins of SpinUI (our operators) can access organizations for support and operations. That access is audited.
6. Legal and safety. We may disclose data when law requires it, to protect rights, safety and security, or as part of a merger or sale of the business, under confidentiality.

6. International transfers

If you are outside the United States, your data is transferred to and stored in the United States. Where the GDPR, UK GDPR or Swiss law applies, we rely on the EU-US Data Privacy Framework (with its UK Extension and the Swiss-US framework) where the recipient is certified. Otherwise we rely on the European Commission's Standard Contractual Clauses, with the UK Addendum and Swiss amendments, included in our providers' data processing terms.

7. How long we keep data

8. Email testing

On Individual, Team and Business, a test can use its own inbox address under inbox.spinui.com. Emails sent to these addresses are received by SpinUI's own mail receiver and stored in SpinUI's own Azure environment in the United States. The full message is kept for up to 72 hours and then deleted. A summary line stays with the run's history and is deleted when the run's history is deleted. We use no new sub-processor for email testing. Received mail is never forwarded anywhere. Addresses accept mail only during a run and for 30 minutes after it. Codes read from emails are masked in logs, results and agent output. Test inboxes may be used only to test the customer's own applications (see the Acceptable Use Policy).

9. SpinUI Recorder (browser extension)

SpinUI Recorder is a Chrome extension that records the steps you take on a web page you choose and saves them as an automated test in SpinUI.

1. When it is active. It does nothing on a page until you start a recording there. Chrome asks you to grant access to one site at a time, when you start recording on it. You can remove that access in Chrome at any time. By default it records in a fresh private window so your own logins do not end up in the test.
2. What it sends. When you save a recording, the extension sends the following to the SpinUI server you signed in to, and to no other server:
   • the steps you performed (clicks, typed values in ordinary fields, selections, key presses);
   • the addresses you navigated to, and element selectors;
   • the page title before and after a step;
   • the text or value of the element you interacted with (at most 120 characters);
   • short snippets of visible page text such as headings, messages, changed text and list-item text (each at most 120 to 200 characters, a few per step). If the page shows personal data in those places, a snippet can contain it. During use it also sends the checks you add, your decisions on suggested checks, the suite and test name you choose, its version, and your sign-in token.
3. Redaction. Password and hidden fields, and fields whose autocomplete is a password, one-time-code or cc-* value, or whose name, id or placeholder matches pass, pwd, secret, otp, cvv, cvc, ssn or token, are redacted in your browser before anything is sent. You choose a stored secret in SpinUI instead. Other fields are recorded as typed. For example, a card-number field without autocomplete is not redacted, so do not record pages with real card data.
4. What it does not do. It takes no screenshots and captures no page HTML or video. It does not read your browsing history. It does not read back or upload your cookies or passwords. It contains no analytics, crash reporting, advertising or tracking code, and runs no remote code.
5. Prepared sign-ins. If you ask it to, the Recorder can apply a sign-in that SpinUI prepared: SpinUI runs your saved sign-in steps on its server and gives the extension that login's cookies and local storage items. The extension writes them into the recording tab only. It never reads them back or uploads them.
6. Stored on your device. The extension stores these in Chrome extension storage on your device:
   • the server address;
   • your sign-in token and its expiry;
   • your name and organization;
   • a random install ID;
   • your preferences. Chrome does not encrypt extension storage. The token works only for Recorder functions. It is tied to your account, organization and this installation. It expires after 90 days without use (and never lasts more than 365 days). You can revoke it under Account security in SpinUI or by signing out in the extension.
7. On the SpinUI server. A saved recording becomes a test in your organization. It is test content (Section 2.3) and follows the rest of this policy for storage, retention, access and deletion. If AI features are on for your organization's plan, short page-text observations from a recording (page titles, headings, messages and text snippets, never passwords, cookies or secrets) are sent from the SpinUI server to our AI provider, Anthropic, to suggest checks (Section 10). The server also uses the sub-processors in Section 5 to store and serve the recording. If you use a self-hosted SpinUI server, its operator, not SpinUI, controls the data.
8. Limited Use. The use of information received from Chrome APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. The Recorder uses the data only to provide its single purpose: building and saving your test recordings on your SpinUI server. We do not sell this data. We do not use or transfer it for advertising, or for creditworthiness or lending. We pass it to others only as needed for that single purpose: to the sub-processors that host the Service, and to Anthropic for suggested checks as point 7 describes. No human reads it unless:
   • you share it with your own team in SpinUI;
   • you ask for support;
   • we need to investigate abuse, keep the Service secure or comply with law.
9. Your choices. You can:
   • sign out in the extension;
   • remove the extension, which deletes everything it stored on your device;
   • delete a recording in SpinUI;
   • revoke the token under Account security.

10. AI features

1. Who gets them. AI features are available on the plans listed on our pricing page:
   • suggested checks;
   • failure explanations;
   • summary polish;
   • accessibility code-fix suggestions;
   • "Describe a test";
   • suggested selector fixes;
   • coverage suggestions. Each plan has a monthly AI allowance.
2. Provider. They use Anthropic's Claude models (Claude Haiku by default), called from our servers.
3. What we send. Each feature sends only a minimised extract, for example:
   • Suggested checks: step labels, page titles, headings, short visible text snippets, and the page path (never the host name or query string). Typed field values are sent only if an organization Admin turns on "Include typed field values"; this is off by default.
   • Failure explanations and suggested selector fixes: the step type and label, the failed selectors, the page path, and the run's own failure message, already masked.
   • Accessibility fix: the accessibility rule, its help text and up to a few masked HTML snippets of the affected elements.
   • Describe a test: the description you type.
   • Coverage suggestions: page paths and titles from a crawl.
   • Summary polish: the rules-based summary text.
4. What we never send. We do not send screenshots, videos, traces, secrets, password values, cookies or test emails to the AI provider.
5. Logging. We do not log request or response bodies.
6. Retention at the provider. Under Anthropic's commercial terms, Anthropic may not use the data we send to train its models. It deletes inputs and outputs within 30 days, unless it must keep them longer to enforce its usage policies (flagged content up to 2 years) or to comply with law. We have not arranged zero data retention.
7. AI agents you connect. If you connect your own AI agent or coding assistant through the MCP endpoint, the content your agent reads, including website text and test emails, goes to that agent and its provider under your arrangements, not ours.

11. Cookies and similar technologies

The SpinUI web app uses only cookies and storage needed to work. It uses no advertising or analytics cookies.

Our public website (spinui.com) uses Cloudflare Web Analytics, which counts page views without cookies and reports only aggregated statistics. It has no advertising or analytics cookies and no cookie banner.

Cloudflare may set strictly necessary security cookies on our domains, such as __cf_bm (bot detection, about 30 minutes) and cf_clearance (after a security check). Stripe Checkout and the billing portal run on Stripe's pages and set their own cookies under the reseller's policy. Because we use only necessary cookies, we do not show a cookie consent banner.

12. Your rights

1. Depending on where you live, you may have the right to:
   • access your personal data and get a copy;
   • correct it;
   • delete it;
   • restrict or object to processing;
   • receive it in a portable format;
   • withdraw consent where we rely on consent.
2. You can complain to your data protection authority.
3. You can update your profile and security settings in the app. For other requests, email support@spinui.com. We will verify your identity and respond within the time the law requires (usually one month, or 45 days under US state laws).
4. For test content we process for an organization, we will pass your request to that organization and help it respond.
5. Account and organization deletion and data export are handled on request: an organization Admin emails support@spinui.com from their account address. We provide an export file of the organization's test content and run history before deletion. A 7-day waiting period, in which the request can be withdrawn, comes before an organization is deleted, and deletion is completed within 30 days of the request. Admins can delete tests, recordings and other test content in the app at any time.

13. Security

We protect data with measures that include:

• encryption in transit (HTTPS through Cloudflare to Azure) and encryption at rest in Azure;
• customer secrets and webhook URLs encrypted with per-organization keys whose key ring is protected by Azure Key Vault;
• database sign-in without passwords (managed identities);
• passwords stored as salted hashes, tokens stored as hashes;
• optional two-step sign-in for customers, and mandatory two-step sign-in for our own Super Admins;
• strict separation between organizations, with automated tests that try to cross organization boundaries;
• cloud runners in isolated containers that cannot reach private network addresses;
• rate limits;
• audit logs of sensitive actions;
• masking of secrets and codes in logs and outputs;
• backups. No system is perfectly secure. Report security issues to support@spinui.com.

14. Children

The Service is for business and professional use and is not directed to children. You must be at least 18 years old to use it. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact support@spinui.com and we will delete it.

15. Changes to this policy

We may update this policy. If we make material changes we will tell you by email or in the Service before they take effect. If the Recorder starts collecting anything new, we will update this policy first and say so in the extension's release notes.

16. Contact

Digiport OÜ Sepapaja 6, 15551 Tallinn, Estonia Privacy: support@spinui.com Support: support@spinui.com