Data processing summary

App data (entities, users) is stored on the Base44 platform. Base44 documents that all servers are located in the United States and that, by default, data for all workspaces is stored in the US. Base44 also documents that Elite and Enterprise workspaces can elect EU or UK storage for apps created after 16 April 2026.

Region for this workspace: United States. The TestCart AI workspace data-residency setting is US (read from Workspace, Settings, Overview, Data hosting on 15 September 2026), so application data, user records, media files, account details, and billing all reside in the United States.

A nightly retention job (enforceDataRetention) runs at 02:00 UTC against all completed or archived experiments and enforces each experiment's data-retention policy.

Each study carries a dataRetention policy with these defaults: raw data retained 365 days, session data 730 days, survey data 730 days, anonymisation after 180 days, and legal basis "consent". Builders can override these per study.

When the retention cutoff is reached, raw gaze and interaction logs are deleted, and survey participant identifiers are anonymised to a pseudonym (anon_<id>). Every run writes an AuditLog entry recording what was deleted or anonymised.

Participants can submit a GDPR request (consent withdrawal, data deletion, or data export) through the app. Requests enter a queue (GDPRDataRequest) with statuses pending → in progress → completed or rejected. A participant can see only their own request; only an admin can action it.

An admin-only function (processGDPRRequest) fulfils the request:

• Consent withdrawal (Art. 7(3)): marks consent withdrawn and the participant inactive; data is retained under legitimate interest pending further review.
• Erasure (Art. 17): deletes all of the participant's gaze, interaction, survey, task-answer, session, assignment, timer, reward, email-log, and support-ticket records, then anonymises the participant record (email and name replaced with a pseudonym, all PII fields nulled).
• Portability (Art. 20): assembles a JSON bundle of the participant's data, uploads it to private storage, and serves it via a short-lived signed URL (5-minute expiry).

Shared reports use a strict field allowlist. When a builder shares a report link, the public endpoint (getSharedReport) replaces participant identifiers with anon_<i>, strips emails, entity ids, and internal metadata, and exposes only the metric and coordinate fields the report renders. Demo and synthetic-admin sessions are excluded from shared reports.

The Base44 platform publishes its full sub-processor list at base44.com/dpa/exhibitc. The sub-processors that process TestCart AI data through the platform are:

• Wix.com Ltd (IL): platform provider; operates the Base44 branded services.
• MongoDB (US): data storage and hosting for app entities and user records.
• Render (US): server services for backend function execution.
• Supabase (US): media hosting for uploaded files (shelf photos, pack shots, textures).
• SendGrid (US): email transmission and external communication (the SendEmail integration).
• OpenAI (US): API calls to LLM (the Core.InvokeLLM integration, used for decision readouts and the report assistant).
• Anthropic (US): API calls to LLM (the Core.InvokeLLM integration, Claude models).
• Google Cloud (US): analytics services.
• DataDog (US): general logging.

Vision model assets: same-origin. The MediaPipe and ONNX models used for in-browser face and gaze detection are served from the app's own origin (/public/vendor/). No external CDN is called for vision assets, so no additional vision sub-processor is involved.

If a new sub-processor is added, this page will be updated before it goes live. The full, authoritative list is always the one published at base44.com/dpa/exhibitc.

Builder isolation. A builder sees and can change only their own studies, shelves, stores, and products. Access is enforced by row-level security on the created_by field (the builder's email) and, for starter-kit copies, the starterKitFor field. One builder cannot read or modify another builder's records.

Session data isolation. All session-derived data (gaze, interaction, task answers, timers, surveys, sessions) is scoped by ownerEmail: the email of the study's owner, stamped server-side when the data is written. A builder sees only the session data for studies they own.

Admin brokering. Admins can read, update, and delete any record. Sensitive operations (actioning a GDPR request, approving recruitment, updating assignments) are restricted to the admin role. Admins broker participant recruitment and reward fulfilment on behalf of builders.

Testers see assignments only. A tester can read only the study assignments sent to their email and their own participant profile. Testers cannot see studies, session data, or other participants' records. The tester dashboard surfaces only the tester's own invitations and sessions.