Testany Co., Ltd. Privacy Notice

This Privacy Notice describes how Testany Co., Ltd. ("Testany", "we", "us", or "our") collects and uses your personal information in relation to our websites, applications, products, services, events, and experiences that reference this Privacy Notice.

This Privacy Notice applies to all Testany Co., Ltd. products and services, including but not limited to:

• Testany Platform - Our SaaS automated testing platform (testany.io) • HephOS - AI-powered CLI tool for software development (hephos.ai) • Office to Markdown Converter - Visual Studio Code extension • SRS Writer - Visual Studio Code extension • Other products and services we may offer under the Testany Co., Ltd. brand

(Collectively referred to as "Our Offerings")

This Privacy Notice does not apply to the "content" processed, stored, or hosted by our customers using Our Offerings in connection with their accounts. See the agreement governing your access to your account and the Testany Data Privacy FAQ for more information about how we handle content and how our customers can control their content through Our Offerings. This Privacy Notice also does not apply to any products, services, websites, or content that are offered by third parties or have their own privacy notice.

This Privacy Notice also describes how we handle data when we analyze content on our own social media accounts and count clicks on links in our social media posts; see "Social Media Content Analytics and Link Tracking".

We collect your personal information in the course of providing Our Offerings to you. Here are the types of information we gather: • **Information You Give Us:** We collect any information you provide in relation to Our Offerings. This includes account registration information (such as email address, name, and password), profile information, payment information, and any other information you choose to provide. • **Automatic Information:** We automatically collect certain types of information when you interact with Our Offerings. This may include device information, IP addresses, browser type, operating system, usage data, and interaction logs. • **Information from Other Sources:** We might collect information about you from other sources, including service providers, partners, and publicly available sources. • **Authentication Information:** When you sign in using third-party identity providers (such as Microsoft Azure B2C), we receive identity tokens containing your basic profile information as permitted by your authentication settings.

We use your personal information to operate, provide, and improve Our Offerings. Our purposes for using personal information include: • **Provide Our Offerings:** We use your personal information to provide and deliver Our Offerings and process transactions, including registrations, subscriptions, purchases, and payments. • **Measure, Support, and Improve Our Offerings:** We use your personal information to measure use of, analyze performance of, fix errors in, provide support for, improve, and develop Our Offerings. • **Recommendations and Personalization:** We use your personal information to recommend features that might be of interest to you, identify your preferences, and personalize your experience with Our Offerings. • **Comply with Legal Obligations:** In certain cases, we have a legal obligation to collect, use, or retain your personal information. • **Communicate with You:** We use your personal information to communicate with you in relation to Our Offerings via different channels (e.g., by phone, email, chat) and to respond to your requests. • **Marketing:** We use your personal information to market and promote Our Offerings. You may opt out of marketing communications at any time. • **Fraud and Abuse Prevention and Credit Risks:** We use your personal information to prevent and detect fraud and abuse in order to protect the security of our customers, Testany, and others. • **Purposes for Which We Seek Your Consent:** We may also ask for your consent to use your personal information for a specific purpose that we communicate to you.

Testany operates a content-operations dashboard (mcn-content-dashboard.testany.io) for internal use by our employees only. It analyzes the performance of content that we publish on our own social media accounts. This section describes the data processing involved.

What we access. With authorization from the administrators of Testany's company accounts, the dashboard uses each platform's official APIs to read, on a read-only basis, statistics about content on Testany's own accounts, including:

• YouTube (Google): the dashboard uses YouTube API Services. It reads analytics for our channel through the YouTube Analytics API and the YouTube Reporting API, with the scope https://www.googleapis.com/auth/yt-analytics.readonly, and reads the list of videos on our channel (such as title, publish time, and privacy status) through the YouTube Data API, with the scope https://www.googleapis.com/auth/youtube.readonly, so that statistics can be matched to each video and videos deleted on YouTube can be identified. The dashboard does not modify, publish, or delete any content on YouTube. For how Google handles data, see the Google Privacy Policy. By using the dashboard, users agree to be bound by the YouTube Terms of Service. • LinkedIn: post and page statistics for our company page. • Other platforms: if we later connect platforms such as Douyin or Zhihu, the dashboard will likewise read only statistics about content on our own accounts.

These are aggregate statistics about our own content (for example, views, watch time, impressions, and click-through rate). We do not collect the identity or profile of the individual people who view, like, or comment on that content.

How we use it. We use this data only to analyze and improve the performance of our own content internally. We do not sell it, do not share it with third parties, do not use it for advertising, and do not use it to develop, improve, or train generalized artificial-intelligence or machine-learning models.

Testany's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Link click statistics. Links in our social media posts may begin with social.testany.io. When someone clicks such a link, we record the time of the click, the post it belongs to, the destination, the referring platform, and the country or region inferred from network information, and then forward the visitor to the destination. We do not use cookies for this, do not store IP addresses, and do not identify the person who clicked.

Storage and retention. This data is stored in Testany's Cloudflare account and is accessible only to authorized employees. Data from each platform is retained for the period permitted by that platform's terms:

• Statistics from YouTube are kept for historical comparison; we confirm every 30 days that our authorization is still valid, and we delete the statistics of a video after it is deleted on YouTube. Basic video information, such as titles, is refreshed on each collection run, and any that has not been refreshed for 30 days is deleted. • Data from LinkedIn is retained for the period LinkedIn permits and then deleted. • Other statistics are kept for historical comparison and deleted when no longer needed.

Employee sign-in and cookies. Employees sign in to the dashboard with their company Microsoft Entra ID account. We record the signed-in person's name, email address, assigned role, and actions in the dashboard for access control and auditing. The dashboard uses only a session cookie that is strictly necessary to keep employees signed in; it does not use tracking or advertising cookies.

Revoking access and deletion requests. In addition to our own deletion process, Testany's account administrators can revoke the dashboard's access to YouTube data at any time via the Google security settings page, and can revoke access in LinkedIn's or the other platforms' authorization settings. To request deletion of data obtained in this way, or for questions or complaints about the dashboard's privacy practices, contact us as described in "Contacts, Notices, and Revisions"; we will delete it within 7 days. Deleting data stored by the dashboard does not affect data stored by YouTube or the other platforms.

Certain products, including HephOS, allow you to select a data residency region during account setup. This choice determines where your data is stored and processed. **Available Regions:** • **China Mainland (CN):** Your data will be stored and processed in AWS cn-northwest-1 (Ningxia, China). Data processing is subject to the laws of the People's Republic of China, including the Personal Information Protection Law (PIPL). • **United States / Global (US):** Your data will be stored and processed in AWS us-west-2 (Oregon, USA). Data processing is subject to United States law. **Important Notes:** • **Permanence:** Your data residency choice is permanent and cannot be changed after account creation. To use a different region, you must create a new account. • **Regional Isolation:** Data stored in one region is not replicated to or accessible from other regions. • **Service Availability:** Some features may vary by region due to local regulations or infrastructure differences. For products that do not offer region selection, data residency is determined by the service terms applicable to your account.

To enable our systems to recognize your browser or device and to provide, market, and improve Our Offerings, we and approved third parties use cookies and other identifiers. Cookies are small text files stored on your device that help us: • Remember your preferences and settings • Understand how you use Our Offerings • Improve your experience • Provide relevant content and advertising You can manage your cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of Our Offerings.

Information about our customers is an important part of our business and we are not in the business of selling our customers' personal information to others. We share personal information only as described below and with Testany Co., Ltd. and the affiliates that Testany Co., Ltd. controls that are either subject to this Privacy Notice or follow practices at least as protective as those described in this Privacy Notice. • **Transactions Involving Third Parties:** We make available to you services, software, and content provided by third parties for use on or through Our Offerings. You can tell when a third party is involved in your transactions, and we share information related to those transactions with that third party. • **Third-Party Service Providers:** We employ other companies and individuals to perform functions on our behalf. Examples include: delivering communications, processing payments, assessing credit and compliance risks, analyzing data, providing marketing and sales assistance, conducting customer relationship management, providing cloud infrastructure services (such as Amazon Web Services and Cloudflare), and providing training. These third-party service providers have access to personal information needed to perform their functions, but may not use it for other purposes. • **Business Transfers:** As we continue to develop our business, we might sell or buy businesses or services. In such transactions, personal information generally is one of the transferred business assets but remains subject to the promises made in any pre-existing Privacy Notice. • **Protection of Us and Others:** We release account and other personal information when we believe release is appropriate to comply with the law, enforce or apply our terms and other agreements, or protect the rights, property, or security of Testany, our customers, or others. • **At Your Option:** Other than as set out above, you will receive notice when personal information about you might be shared with third parties, and you will have an opportunity to choose not to share the information.

Testany Co., Ltd. operates globally and may transfer your personal information across international borders in accordance with this Privacy Notice and applicable data protection laws. **For users who selected China Mainland (CN) as their data residency:** Your data is stored and processed within the People's Republic of China. Cross-border transfers, if any, are conducted in compliance with the Personal Information Protection Law (PIPL) and other applicable Chinese regulations. **For users who selected United States / Global (US) as their data residency:** Your data is stored and processed in the United States. If you are located outside the United States, your information may be transferred to, stored, and processed in the United States where our servers are located. **Transfer Safeguards:** Whenever we transfer personal information to other jurisdictions, we ensure that the information is transferred in accordance with this Privacy Notice and as permitted by applicable data protection laws. We implement appropriate safeguards, which may include standard contractual clauses or other mechanisms recognized by relevant authorities.

At Testany, security is our highest priority. We design our systems with your security and privacy in mind. • We maintain a wide variety of compliance programs that validate our security controls. • We protect the security of your information during transmission to or from our websites, applications, products, or services by using encryption protocols and software (TLS/SSL). • We follow the Payment Card Industry Data Security Standard (PCI DSS) when handling credit card data. • We maintain physical, electronic, and procedural safeguards in connection with the collection, storage, and disclosure of personal information. • We implement access controls to ensure that only authorized personnel can access your personal information. • We conduct regular security assessments and penetration testing of our systems.

We keep your personal information to enable your continued use of Our Offerings, for as long as it is required in order to fulfill the relevant purposes described in this Privacy Notice, as may be required by law (including for tax and accounting purposes), or as otherwise communicated to you.

How long we retain specific personal information varies depending on the purpose for its use, and we will delete your personal information in accordance with applicable law.

When you close your account, we will delete or anonymize your personal information within a reasonable timeframe, unless we are required to retain it for legal, regulatory, or legitimate business purposes.

Data obtained through third-party platform APIs is retained for the period permitted by that platform's terms; see "Social Media Content Analytics and Link Tracking".

Depending on your location and applicable laws, you may have certain rights regarding your personal information: • **Access:** You may request access to the personal information we hold about you. • **Correction:** You may request that we correct inaccurate or incomplete personal information. • **Deletion:** You may request that we delete your personal information, subject to certain exceptions. • **Data Portability:** You may request a copy of your personal information in a structured, commonly used, and machine-readable format. • **Withdraw Consent:** Where we rely on your consent to process your personal information, you may withdraw your consent at any time. • **Opt-Out of Marketing:** You may opt out of receiving marketing communications from us by following the unsubscribe instructions in our emails or contacting us directly. To exercise any of these rights, please contact us using the information provided in the "Contacts, Notices, and Revisions" section below. We will respond to your request within the timeframe required by applicable law.

Our Offerings are not directed to children under the age of 16 (or the applicable age of consent in your jurisdiction). We do not knowingly collect personal information from children under this age. If you are a parent or guardian and believe that your child has provided us with personal information, please contact us so that we can take appropriate action.

If you have any concerns about privacy at Testany, please contact us with a thorough description, and we will try to resolve the issue for you. **Contact Information:** Email: privacy@testany.io Our business changes constantly, and our Privacy Notice may also change. You should check our website frequently to see recent changes. Unless stated otherwise, our current Privacy Notice applies to all personal information we have about you and your account. We will notify you of material changes to this Privacy Notice by posting a notice on our website or by sending you an email. Your continued use of Our Offerings after such notification constitutes your acceptance of the updated Privacy Notice.