Security

Data processing summary

A factual summary of what TestCart AI collects, where it is stored, how long it is kept, and who can access it. Every statement here reflects how the platform is built today.

1. What we collect per session

A session is one shopper visit to a virtual store. The following records and fields are written per session. No video is stored at any point. Gaze is recorded as estimated positions (the product looked at, and the path of the gaze estimate over a shelf front), not camera frames.

Gaze

Where a shopper looked: looks at products, a summary per product, and the gaze path over a shelf front.

Session, study and study owner references
Task, task order, and time within the task
Timestamps, including the offset of the device clock
Product looked at (name and ID) and its price
How long the look lasted, and the point looked at in the 3D store
Shelf level, distance from the shelf, study version, how the study was run, and trip number
Record type (a look, a per-product summary, or a stretch of the gaze path), how the look was matched to a product, and the stage of the visit
Confidence that the right product was looked at, the gaze error at that moment, and the size of the product block on the shelf (width and number of facings)
Point on the screen, the shelf fixture, and the number and spacing of gaze samples
Gaze path on a shelf front: time offset, position on the shelf front, and gaze error for each point, plus the start time

Interactions

What a shopper did: pick, drop, inspect, add to cart, navigate.

Session, study and study owner references
Task, task order, and timestamps
Action: pick, drop, inspect, add to cart, remove from cart, walk, or jump to a spot
Product (name and ID), and the input used (mouse click, keyboard, system, or gaze)
Position of the product and of the shopper in the store
How long the action took, dwell time, distance from the shelf, and shelf level
Study version, how the study was run, stage of the visit, and extra details
For store-flow records: the zone in front of a shelf and the time spent in it, the first shelf approached, the path length, and positions on the floor plan (no camera data)

Task answers

A shopper answer to an in-visit task or question.

Session, study and study owner references, the random participant ID (admins only), and a shopper ID that is new in every study
Task and its title, and the answer (text or selected option)
Product the task is about, time to answer, study version, and trip number

Task timing

How long a task took from display to submission.

Session, study and study owner references, and the task
Task title and order, when it was shown, when it was completed, and the time in between
How the task was completed, study version, and trip number

Survey answers

Post-visit survey: experience scales and product ratings.

Session, study and study owner references, the random participant ID (admins only), and a shopper ID that is new in every study
Age range and gender
Engagement, interactivity, ease of using the controls, and discomfort (no, a little, yes)
Per product: liking, purchase intent, and value for money
Open feedback, completion time, and quality score and flags

Session record

The session envelope: timing, device, calibration, quality.

Session, study, study version, random participant ID (admins only), shopper ID that is new in every study, and study owner references
Whether it is a demo session (and its demo label), and how the study was run
Consent given, and when it was accepted
Eye-tracking calibration: accuracy score, calibration points, validation accuracy, the engine used, and the fitted gaze mapping (numbers only)
Gaze checks: error measured on 5 fresh points and whether it passed, median gaze error, drift checks, time gaze tracking was paused, and the gaze estimator version
Start time, when walking started, end time, duration, whether the task was completed, and the completion code
Distance walked, store load time, and frame rate (median and slowest)
Store zones, and flow flags (for example no movement in the store)
Device: processor cores, memory, graphics chip and screen size; browser, operating system, and webcam resolution and frame rate
Quality score, flag and breakdown, and when quality was checked

No camera frames are stored. Shelf photos and pack shots a builder uploads are stored as private files. The webcam eye-tracking pipeline processes camera frames in the browser and writes only numbers: mapped gaze coordinates (product looked at, point looked at, duration, the gaze path over a shelf front) to the gaze record, and the fitted gaze mapping with its measured accuracy to the session.

2. Where it is stored

App data (entities, users) is stored on the Base44 platform. Base44 documents that all servers are located in the United States and that, by default, data for all workspaces is stored in the US. Base44 also documents that Elite and Enterprise workspaces can elect EU or UK storage for apps created after 16 April 2026.

Region for this workspace: United States. The TestCart AI workspace data-residency setting is US (read from Workspace, Settings, Overview, Data hosting on 15 September 2026), so application data, user records, media files, account details, and billing all reside in the United States.

3. Retention

A nightly retention job runs at 02:00 UTC against all completed or archived studies and enforces each study's data-retention policy.

Each study carries a data-retention policy with these defaults: raw data retained 365 days, anonymisation after 180 days, and legal basis "consent". Builders can override these per study.

When the retention cutoff is reached, raw gaze and interaction logs are deleted, and survey participant identifiers are replaced with a pseudonym. Aggregated study results are kept for the builder's account. Every run writes an audit log entry recording what was deleted or anonymised.

4. Deletion and export (GDPR)

Participants can submit a GDPR request (consent withdrawal, data deletion, or data export) through the app. Requests enter a queue with the statuses pending, in progress, completed, or rejected. A participant can see only their own request; only an admin can action it.

Only an admin can carry out a request, and it works as follows:

Consent withdrawal (Art. 7(3)): marks consent withdrawn and the participant inactive; data is retained under legitimate interest pending further review.
Erasure (Art. 17): deletes all of the participant's gaze, interaction, survey, task-answer, session, assignment, timer, reward, email-log, and support-ticket records, then anonymises the participant record (email and name replaced with a pseudonym, all PII fields nulled).
Portability (Art. 20): assembles a JSON bundle of the participant's data, uploads it to private storage, and serves it via a short-lived signed URL (5-minute expiry).

Shared reports use a strict field allowlist. When a builder shares a report link, the shared report replaces participant identifiers with pseudonyms, strips emails, record IDs, and internal metadata, and exposes only the metric and coordinate fields the report renders. Demo and synthetic-admin sessions are excluded from shared reports.

5. Sub-processors

The Base44 platform publishes its full sub-processor list at base44.com/dpa/exhibitc. The sub-processors that process TestCart AI data through the platform are:

Wix.com Ltd (IL): platform provider; operates the Base44 branded services.
MongoDB (US): data storage and hosting for app entities and user records.
Render (US): server services for backend function execution.
Supabase (US): media hosting for uploaded files (shelf photos, pack shots, textures).
SendGrid (US): email transmission and external communication.
OpenAI (US): AI model calls, used for decision readouts and the report assistant.
Anthropic (US): AI model calls (Claude models).
Google Cloud (US): analytics services.
DataDog (US): general logging.

TestCart AI also uses these Google services directly, outside the platform:

Google Workspace, Google Ireland Limited (EU and US): business email at testcartai.com, and demo bookings made through the Google Calendar booking page (name, email and the time chosen). Google may process this data in the EU and the US under its Cloud Data Processing Addendum and the Standard Contractual Clauses.
Google Analytics 4, Google Ireland Limited (EU and US): website analytics, loaded only after a visitor accepts analytics cookies. Pages viewed (access codes, emails and share links removed from the address), device and browser type, and approximate location. Google signals and ad personalisation are off; data is kept for up to 14 months under the Google Ads Data Processing Terms and the Standard Contractual Clauses.

Vision model assets: our own origin first. The MediaPipe and ONNX files used for in-browser face, gaze and shelf detection are served from our own origin (/public/vendor/). Only if that copy fails to load does the browser fetch the same files from a public CDN: cdn.jsdelivr.net (jsDelivr) and storage.googleapis.com (Google) for the face model, and cdnjs.cloudflare.com (Cloudflare) for the ONNX runtime. These hosts see the visitor's IP address, never study data.

If a new sub-processor is added, this page will be updated before it goes live. The full, authoritative list of platform sub-processors is always the one published at base44.com/dpa/exhibitc.

6. Access model

Builder isolation. A builder sees and can change only their own studies, shelves, stores, and products. Access is enforced by row-level security tied to the builder's account and, for starter-kit copies, to the account the kit was made for. One builder cannot read or modify another builder's records.

Session data isolation. All session-derived data (gaze, interaction, task answers, timers, surveys, sessions) is tagged with the study owner's account on the server when the data is written. A builder sees only the session data for studies they own.

Admin brokering. Admins can read, update, and delete any record. Sensitive operations (actioning a GDPR request, approving recruitment, updating assignments) are restricted to the admin role. Admins broker participant recruitment and reward fulfilment on behalf of builders.

Testers see assignments only. A tester can read only the study assignments sent to their email and their own participant profile. Testers cannot see studies, session data, or other participants' records. The tester dashboard surfaces only the tester's own invitations and sessions.

7. Request our DPA

For studies you run with your own shoppers, you are the controller of the study data and TestCart AI processes it on your behalf. For a pilot, enterprise buyers can request our Data Processing Agreement. Email us and we will send the DPA and schedule a security review.

Request our DPA

Every statement here reflects how the platform is built today.

8. Reporting a security issue

If you believe you have found a security issue in testcartai.com or the TestCart AI app, email theo@testcartai.com with the address affected, the steps to reproduce it and what an attacker could do. We aim to acknowledge reports within three business days and to keep you informed until the issue is fixed.

Please do: test only with accounts you own, stop as soon as you see data that is not yours, and give us reasonable time to fix the issue before sharing it publicly.

Please do not: access, change or delete other people's data, run denial-of-service or load tests, send spam or social-engineering messages, or test physical or third-party systems.

Out of scope: the infrastructure of our hosting provider, Base44 (report those to Base44 directly), and findings that need a compromised device or browser.

If you follow this policy in good faith, we will not pursue legal action against you for your research, and we will credit you if you wish.

Back to pricing