Privacy

Aback Inspect is operated by Aback Group. This policy covers the Aback Inspect website, app, API and MCP server.

What we store

• Account data: your name, email, a hash of your password, sessions with the browser user agent and a salted hash of the IP address, and workspace memberships.
• What you configure: projects, environments, test definitions and their versions, variables, encrypted secrets, schedules, alert channels (with encrypted URLs) and API key metadata.
• Run evidence: step results, console messages (shortened, with secrets masked), network request metadata (method, URL without query string, status) and screenshots of the pages you test. Request and response bodies are not stored, except inside a Playwright trace: on paid plans a trace records the page, its network traffic (including headers and cookies) and the values typed into it. Traces are not recorded for tests that use secrets or sensitive steps, and only members who can edit tests can download them.
• Billing: the plan, subscription status and Dodo Payments customer and subscription identifiers. Dodo Payments, the merchant of record, processes card details and billing addresses under its own privacy policy.
• Operational logs: request paths, request ids, timings and errors, with credentials, cookies and query strings removed. Cloudflare keeps these logs for up to 7 days.

We do not use advertising trackers, we do not sell data, and we do not use your tests, screenshots or target page content to train AI models.

Pages you test

Screenshots and logs can contain whatever your pages show. Test against staging data and test accounts where you can, and mask sensitive areas in visual steps. You are responsible for having the right to test the sites you point Aback Inspect at.

Retention

• Run results, logs, screenshots and traces are deleted automatically 7 days (Free), 30 days (Pro) or 90 days (Team) after the run, by a daily job.
• Visual baselines are kept until you delete them, the test or the project.
• Audit events are kept for about 400 days. Processed payment webhook records are kept for 180 days.
• Deleted data may remain in Cloudflare's database point-in-time recovery for up to 30 days before it is overwritten.

Your choices

• Delete runs, tests, projects and workspaces from the app at any time.
• Delete your account from your profile. Workspaces you own alone are deleted with all their data; workspaces you share pass to their longest-standing admin, member or viewer, in that order.
• Export a workspace as JSON from its settings: members, projects, environments, variables (without secret values), tests, schedules, alert channels (without their URLs) and the last 1,000 runs. A single test can also be copied from its JSON view.
• For access or correction requests, email support@aback.group.

Processors

• Cloudflare, for hosting, storage, browsers and network.
• Dodo Payments, for payments and invoices.

Cookies

We use one essential cookie to keep you signed in, and store your light or dark theme choice in your browser. There are no analytics or advertising cookies.