Privacy policy

This Privacy Policy explains how Useful Collective s.r.o. ("we", "us", or "our") collects and uses personal data in connection with UserLimit, including our website, load testing application, and related features (the "Service").

We are the data controller for account, billing, communication, and service usage data. Where we process personal data in a customer's tests solely on their behalf, we act as a processor under applicable data protection law.

Information We Collect

• Account information: your name, email address, password hash, time zone, sign-in activity, and account settings. If you sign in with Google, we receive profile information such as your name, email address, profile image, and account identifier.
• Billing and communications: purchase and subscription records, usage charges, billing information received from our payment provider, and messages you exchange with us. Payment-card details are handled by our payment provider; UserLimit does not store full card numbers.
• Device and usage information: IP address, browser and device details, approximate location, referring pages, pages visited, interactions with the Service, and diagnostic logs. This information may be linked to your account identifier and email address.
• Test and integration data: target URLs, scenarios, scripts, input values, test settings, results, page titles, request information, and errors, together with access tokens and connection details for integrations you enable.

Do not include personal data in test scenarios or inputs. Tested systems may nevertheless return personal data in URLs, page content, or errors. Contact us if personal data has been included unintentionally.

How and Why We Use Your Information

We use personal data to provide the Service, manage accounts and payments, run tests, deliver results and notifications, and respond to support requests. We rely on performance of our contract where you are a party to it, or our legitimate interests in providing the Service to the business you represent.

We also rely on legitimate interests to secure the Service, prevent abuse and fraud, diagnose problems, understand usage, and improve its operation, where those interests are not overridden by your rights. We process records as necessary to meet legal obligations and establish, exercise, or defend legal claims. Where required by law, we rely on consent, including for certain analytics or marketing activities.

Some information is necessary to create an account, take payment, or run a test. Without it, we may be unable to provide the relevant feature.

Cookies and Analytics

We use cookies and similar technologies, such as browser storage, in three categories. Essential ones keep the Service working and secure and need no consent; we rely on our legitimate interest in providing the Service you asked for. Analytics and advertising are optional: in the European Economic Area, the United Kingdom, and Switzerland, they stay off until you allow them. Elsewhere they are on until you turn them off, and if your browser sends a Global Privacy Control signal, we treat it as an opt-out of analytics and advertising.

You can accept, reject, or choose categories when we first ask, and change or withdraw your choice at any time under Cookie settings , at the bottom of every page and in the account menu. Withdrawing doesn't affect processing before it; when you withdraw, we delete the cookies those tools set on our domain. We ask again if the cookies we use change materially.

Google Analytics and Google Ads run through Google Tag Manager, which loads only once you allow one of them; Google's consent mode tells them what you allowed. PostHog processes data in the European Union. Google may process data in the United States under the EU-US Data Privacy Framework. We also keep first-party records of visits and errors on our servers, which store nothing on your device.

To show that consent was given, we keep a record of each choice: what you chose, when, the version of this policy, the page, your IP address, country, and browser. We keep these records for three years and then delete them.

Sharing Your Information

We share information as necessary with hosting, storage, email, payment, security, and analytics providers. Depending on the features in use, these include Amazon Web Services for test infrastructure, Paddle for payments, Cloudflare for security, PostHog and Google Analytics for analytics, Google Ads for ad measurement, and Sentry for error reporting. Providers acting on our behalf are subject to data protection obligations. Some, including Paddle as merchant of record for purchases, also act as independent controllers under their own privacy policies.

Google supports sign-in and, where enabled, security and tag management. Profile images are loaded from Google or Gravatar, which receive browser request information; Gravatar also receives an email-derived identifier.

When you enable an integration, we exchange the information needed to operate it, including sending test notifications to your chosen Slack channel or webhook. We may also disclose information where required by law, to protect legal rights, or in connection with a merger, acquisition, or sale of the business, subject to applicable data protection requirements.

International Processing

Information may be stored or processed in countries where we and our providers operate, including outside the European Economic Area. Test scenarios are processed in the regions used to run your tests. Selecting a test region does not determine where all account information, results, or supporting services are processed.

Where personal data is transferred outside the European Economic Area, we rely on an applicable adequacy decision or appropriate safeguards, such as the European Commission's Standard Contractual Clauses and additional measures where required. You may contact us for information about the safeguards applicable to your data and how to obtain a copy.

Data Retention

We retain personal data only for as long as necessary for the purposes described in this policy. Retention depends on the nature of the data, whether it is needed to provide your account and test history, settle outstanding payments, investigate security or technical issues, resolve disputes or legal claims, or meet legal, accounting, and reporting obligations.

Account deletion is scheduled seven days after you confirm the emailed request. These limits also apply after account closure and to logs and backups. When personal data is no longer needed, it is deleted or anonymized.

Your Rights

Subject to applicable law, you may request access to, correction or erasure of your personal data, restriction of processing, or a portable copy. You may object to processing based on legitimate interests and to direct marketing. Where processing is based on consent, you may withdraw it without affecting the lawfulness of earlier processing. Contact us to exercise these rights; we may need to verify your identity.

Where we hold data solely on behalf of a customer, we will refer the request to that customer and assist as required. You may lodge a complaint with the Czech Office for Personal Data Protection or another competent supervisory authority, including in the country where you live or work.

Changes and Contact

We may update this policy to reflect changes to the Service, our practices, or legal requirements. We will update the date above and provide any notice required by law.

Useful Collective s.r.o., Tusarova 1179/37, 170 00 Praha 7, Czech Republic. For privacy questions or requests, contact support@userlimit.com.