Privacy policy
Effective 17 October 2026
This policy explains what personal data Carrier Grade Inc. (2665 S Bayshore Dr, Miami, FL 33133, United States, "we", "us") processes when you use Testlie (the "Service") and its website at https://testlie.com, why, for how long, who we share it with, and your rights. Contact us about privacy at hello@testlie.com.
Two kinds of data
- Account data, for which we are the controller: information about you as a user of Testlie, such as your name, email address, sign-ins, team memberships and billing details, and how you use our website.
- Customer Data, for which we are a processor acting on behalf of your organisation: everything your applications and team send to or store in the Service, described below. Your organisation decides what it contains and is its controller. We process it under our data processing addendum and only to provide the Service.
If you are a person whose data appears in Customer Data (for example, your email address is in a message an application sent to a sandbox), please contact the organisation that sent it. We will help them answer your request.
Account data we collect
| Data | Why | Legal basis |
|---|---|---|
| Name, email address, password hash, team memberships and roles | To create and secure your account and teams | Contract |
| Sign-in data from Microsoft, other social sign-in providers or your company's single sign-on, if you use them (name, email, provider account ID) | To sign you in | Contract |
| Two-factor authentication secrets (encrypted) and backup codes | To protect your account | Contract, legitimate interest |
| IP address, user agent and session records | Security, abuse prevention and rate limiting | Legitimate interest |
| Audit log entries of actions in your team | Accountability for your team's admins | Contract, legitimate interest |
| Billing name, email and address, plan and subscription history. Card details are collected and stored by Stripe, never by us | To charge for paid plans and keep tax records | Contract, legal obligation |
| Messages you send us (support, sales, security reports) | To answer you | Legitimate interest, contract |
| Usage counters per team (for example messages captured this month) | To enforce plan limits and show usage | Contract |
Emails we send you
- Account emails: email address verification, password resets, invitations, forwarding address confirmations, and notices about your account, security or these policies. These are part of the Service and you cannot opt out of them while you have an account.
- Welcome and trial emails: a one-time welcome email with setup instructions when you create a team, and a reminder to team owners before a free trial ends. These are transactional.
- Product tips: up to two short emails to team owners in the first days after a team is created, if it has not captured anything yet, with the next setup step. Every product tip includes an unsubscribe link (one click, no sign-in needed), and you can turn them off at any time on your Account page. We send them on the basis of our legitimate interest in helping you set up the Service.
We send these emails through our email provider (see subprocessors).
Cookies
The website and app use only cookies that are strictly necessary: session cookies that keep you signed in and protect sign-in, and short-lived cookies that mock identity providers set during test sign-ins. We do not use advertising or third-party tracking cookies, so we do not show a cookie banner.
Product analytics
To understand how Testlie is used and where sign-up and setup get stuck, we run our own analytics software (Umami) on our own server. It is not a third-party service, so analytics data stays on our infrastructure and is not shared with anyone; it is not a subprocessor.
- No cookies. The analytics set no cookies, store nothing on your device and do not follow you across other websites.
- What we count: aggregated page views of our public pages and of the app's navigation pages (the page path, the referring website, and your country or region, browser, operating system, device type, screen size and language), and a small set of events: a sign-up started or completed, an email address verified, a checkout started or completed (with the plan and billing period), a team's first captured message or request (with its channel), a sandbox created (with its type) and the quickstart code copied in our documentation.
- What we never collect: events never contain your email address, name, team or inbox names, or any identifier of you, your team or your records. Pages that show captured messages, texts, requests or calls, and pages with secret links (invitations, password resets), are never tracked, and neither is the content you capture.
- How: your browser sends page views to our analytics server, which sees your IP address and browser user agent as part of the request. It uses them to derive the approximate location and browser details above and an anonymous visitor code that changes every day; it does not store your IP address or user agent. Events sent by our own servers include no IP address or browser details at all.
- Your choice: if your browser sends a Do Not Track or Global Privacy Control signal, the analytics do not run.
We do this on the basis of our legitimate interest in improving the Service. Analytics records cannot be linked to you, so they are not deleted with your account.
Customer Data
Customer Data can contain any content your applications put in it. The Service never delivers it to the people, phone numbers or devices it is addressed to. Depending on the features your team uses, it includes:
| Feature | Customer Data processed |
|---|---|
| Email capture | Messages sent to your inboxes over SMTP or to their inbound addresses (which anyone who knows the address can write to): headers, sender and recipient addresses, subject, body, attachments, and the reports of HTML, link, accessibility, authentication and spam checks |
| SMS and SMPP | Text messages sent through the Twilio-compatible API or SMPP: sender and recipient numbers, message text, segments, delivery statuses and receipts; SMPP and API credentials |
| Messages, templates, uploaded media, simulated users and their replies, statuses, and the webhook (callback) URL and tokens you configure | |
| Push notifications | Notifications sent to the APNs- and FCM-compatible endpoints: device tokens, titles, bodies and data payloads; test devices you register. If you upload an APNs authentication key (.p8), we read it only to derive its public key and do not keep the private key. FCM service accounts and generated APNs keys are test credentials created by the Service |
| Voice and OTP calls | Calls placed through the Twilio Voice-compatible API: phone numbers, the TwiML your application returns and the URLs it is fetched from, simulated keypresses, and a transcript of what would have been said (including one-time codes) |
| Inbound deliveries to your application | Simulated text messages and emails you send to your application, and your application's responses, with the endpoint URLs and signing secrets you configure |
| Mock identity providers | Test users you define (names, email addresses, groups, claims), client configuration, sign-in activity logs with requests and tokens, and SCIM provisioning runs against your application with the endpoint you configure (the SCIM bearer token is stored encrypted and never shown in logs) |
| Request bins | HTTP requests sent to your bins by any client: method, path, query, headers (which may include IP addresses and credentials sent by the caller) and bodies, and the responses you configure |
| Configuration | Inboxes, projects, webhooks and integrations (such as Slack or Microsoft Teams URLs), forwarding addresses and rules, failure scenarios and API keys (stored as hashes) |
When you open a message, remote images may be loaded through our image proxy so the sender does not learn your IP address.
Checks that contact third parties
Some checks you run on captured email look things up on the internet. They run on our servers, so third parties see our server's IP address, never yours:
- Spam checks (when you open a message's spam report, call the spam report API, or turn on automatic spam checks for an inbox) use SpamAssassin. Its network tests send DNS queries from our own resolver to public DNS blocklist and reputation services, chiefly Spamhaus and URIBL, and others included in SpamAssassin's standard rules (such as SURBL, DNSWL, SpamCop and Mailspike). The queries contain the IP addresses found in the message's
Receivedheaders and the domain names of the sender and of links in the message, in plain form; some rules may send a hash of an email address instead. No message content, and nothing that identifies you or your team, is sent. See subprocessors. - Authentication checks look up the SPF, DKIM, DMARC and BIMI DNS records of the sending domain.
- Link checks make HTTP requests to the links and images in the message, without cookies or credentials, to find broken links.
Where Customer Data goes on your instructions
Customer Data leaves the Service only where your team configures it: forwards to email addresses that confirmed they want them, webhook and integration deliveries, inbound deliveries, voice callbacks and SCIM requests to URLs you provide. Those recipients are chosen by you and are not our subprocessors.
Retention
- Captured content (email, text and WhatsApp messages, push notifications, calls, inbound deliveries and requests captured by bins): until you delete it, until the inbox's or sandbox's message limit removes it, or until your plan's retention period ends, whichever comes first. Retention is 3 days on Free, 30 days on Team, 90 days on Business, and as agreed in writing on Enterprise. If a team moves to a plan with shorter retention (for example after cancelling or a failed payment), older content is deleted within minutes. Inbound deliveries are kept for at most 30 days.
- Logs: webhook delivery logs, identity provider activity logs, SCIM runs and WhatsApp media are kept for up to 30 days, on every plan. Security logs are kept for up to 90 days.
- Account data: while your account exists. When you delete your account or a team, its data is deleted from the live database at once and from backups within 30 days.
- Audit log: for as long as the team exists.
- Billing records: as long as tax and accounting law requires.
- Product analytics: aggregated records that cannot identify you, kept on our own server for as long as they are useful.
Sharing
We share personal data only with the subprocessors that help us run the Service, with your team (for data you add to it), with the destinations your team configures (described above), when required by law or to protect the rights and safety of users and the public, or with a successor in a merger, acquisition or sale of our business, subject to this policy. We do not sell personal data, do not share it for cross-context behavioural advertising, and do not use Customer Data to train machine learning models.
International transfers
The Service runs on Amazon Web Services in the EU (Ireland, eu-west-1), where account data and Customer Data are stored. Carrier Grade Inc. is based in the United States, and some subprocessors, such as our payment processor, process data in the United States or globally. Where personal data from the EEA, UK or Switzerland is transferred to a country without an adequacy decision, we rely on the EU Standard Contractual Clauses and the UK Addendum, or on the recipient's certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions.
Your rights
Depending on where you live (for example in the EEA, the UK, or US states such as California), you may have the right to know what personal data we hold about you and to access, correct, delete or export it, to object to or restrict its processing, to withdraw consent, and to complain to a data protection authority. We do not sell or share personal data as those terms are defined in US state laws, and we will not discriminate against you for exercising your rights.
You can update your profile and delete your account under Account in the app, and turn off product tips there. For other requests, email hello@testlie.com from the address on your account. We may need to verify your identity, and we will answer within the time the law requires (normally one month). For personal data inside Customer Data, contact the organisation that sent it to the Service; we will assist them.
Children
The Service is for professional use and is not directed at children. We do not knowingly collect personal data from anyone under 16 as account data. If you believe a child has given us personal data, contact us and we will delete it.
Security
We protect personal data with technical and organisational measures appropriate to the risk, described on our security page and in the data processing addendum.
Changes
We may update this policy. We will post the new version here with a new effective date and notify account owners of material changes by email before they take effect.
Contact
Carrier Grade Inc., 2665 S Bayshore Dr, Miami, FL 33133, United States. Email: hello@testlie.com.