Privacy Policy

Last updated: 7 October 2026

Testaro is an Azure DevOps extension for test management. Your test data stays inside your own Azure DevOps organisation. Testaro does not run a server that stores your content, does not sell or share your data, and AI features are opt-in and use your API key to call your AI provider directly.

What data Testaro handles

• Test-management content you create — test cases, steps, suites, runs, results, configurations, shared steps, and exploratory sessions. This is stored in the Azure DevOps Extension Data Service within your own organisation/project. Testaro never receives a copy.
• Work items — Testaro reads the Azure DevOps work items you link, using your existing Azure DevOps session, to show titles and states for traceability. It writes to work items only when someone acts: filing a bug from a failed test, publishing an approved test case, creating the Features/Stories an admin approves from a regression suggestion, or — when the project setting “Also attach evidence to linked work items” is on (admin-only in Testaro, off by default) — adding uploaded screenshots/videos to the linked work items' attachments.
• Screenshots and videos you upload — stored in your own Azure DevOps organisation (its work item attachment store), never on a Testaro server. They can contain whatever was on screen, so treat them like any other project attachment. Removing a file in Testaro removes Testaro's reference to it; Testaro cannot delete the file itself from Azure DevOps (that needs a permission Testaro does not request), so delete it there if needed.
• Who did what — Testaro records the Azure DevOps display name of the person who marked a test result or uploaded a file, so a team can see who ran what. It is stored with your test data in your own organisation.
• AI provider key (optional, bring-your-own-key) — if you use the AI features, your key is held in browser memory for the session only. It is never persisted, never logged, and never sent to Testaro. AI requests go from your browser directly to the provider you configure.
• Company-managed AI (optional) — if your admin configures a shared company key, it is stored server-side and never returned to the browser; requests are proxied with a per-user cap. Users never see or enter the key.

Optional usage statistics (off by default)

Testaro can send anonymous, aggregate usage statistics so we know which features are worth improving. It is off unless a project administrator turns it on in Testaro's Settings, and turning it off stops the sending immediately.

• What is sent, if you turn it on: the Testaro version; a one-way SHA-256 hash of your Azure DevOps organisation id and project id (computed in your browser — the hash cannot be reversed back to an id or a name, and we never receive the id itself); the date the counts are for; and counters of how many times anonymous feature keys were used that day (for example “the overview screen was opened 3 times”).
• What is never sent: organisation or project names, user names or emails, test cases, steps, results, comments or any other test content, work items, AI keys or prompts, and no free text of any kind. We do not retain your IP address or user agent with the statistics.
• What it is used for: only to decide what to build and improve next. It is never sold, shared, or used to identify a person, a team, or a customer, and it is not accurate enough to try.
• Retention: the raw daily counter records are kept for 13 months and then deleted.

What Testaro does not do

• No Testaro-operated database holds your test content.
• No analytics or telemetry is sent to third parties. The optional usage statistics above go only to Testaro, and only if an administrator switches them on.
• No selling, renting, or sharing of customer data.

Data location, retention, and deletion

• Location: your Azure DevOps organisation (Extension Data Service), governed by your Microsoft / Azure DevOps data-residency settings.
• Retention: for as long as you keep it; Testaro adds no separate retention. Uploaded files that are not attached to any work item follow Azure DevOps' own attachment retention, which Microsoft does not document; attaching them to the work item (the setting above) keeps them like any other attachment. The only exception is the optional usage statistics above (if switched on), whose daily counter records are kept for 13 months.
• Deletion / export: you can delete any Testaro item in-app (uploaded files are deleted in Azure DevOps, see above), and read or export everything via the Testaro API client or Azure DevOps' own Extension Data REST API. Uninstalling the extension leaves the data in your org — you control its removal.

Sub-processors

• Microsoft Azure DevOps — hosts the extension and stores your data (your existing relationship).
• Your chosen AI provider (only if you enable AI) — receives the prompts you send, under your own agreement with that provider.

Contact

Questions about this policy or your data? Email support@baytekdev.com.