Testmates privacy notice

Updated 23 September 2026.

Who we are

Testmates is operated by Ben Luke Spink, trading as thinkspink. Contact benlukespink@gmail.com about privacy or your information. We manage account and service administration data. Where an organisation supplies customer report data, it is responsible for the purpose and authority for using those records, and we handle them to provide the service it requests.

Information used and why

We process your email, account identifier, organisation membership and permissions to authenticate you and provide access to your reports. Saved report information can include site addresses, client details, electrical readings, inspection results and observation text. We use this to store and retrieve the reports you request. Support messages are used to answer you. Operational metadata, such as request time, error reference and network address, may be processed by our hosting and authentication providers to run and protect the service.

For account services you request, we rely on performance of our agreement with you. For service security and responding to support requests, we rely on our legitimate interests in maintaining a reliable service. Legal obligations may require specific records to be retained. An organisation using Testmates must establish its own lawful basis for customer information it supplies.

What is shared with ChatGPT

When you approve a connection, Testmates sends the report summaries or sections requested through its tools to OpenAI for use in your ChatGPT conversation. This can include site addresses, recorded measurements, inspection outcomes and observations. The connection is limited to your selected organisation. It does not send passwords, authentication tokens or signature images in tool results. Avoid adding unnecessary personal or sensitive information to report text. ChatGPT conversation storage and use are governed separately by your OpenAI account settings and OpenAI’s privacy policy.

Service providers

We use Cloudflare for hosting and secure connection sessions, Supabase for authentication and report storage, and Resend for account emails. Your email provider receives support messages sent to our Gmail support address. These providers may process information in countries outside the UK. Their applicable contractual arrangements and data-transfer safeguards govern that processing; contact us for details relevant to your account. We do not sell your personal information.

Cookies and credentials

We use essential cookies for sign-in and connection-request protection. Normal browser sign-in keeps account access and refresh tokens on the server behind a Secure HttpOnly cookie. Email verification and password-recovery links may contain temporary tokens, which the account page removes from the address bar before further requests. The Testmates account pages do not include advertising or analytics scripts.

Retention

Connection requests expire after ten minutes. Current private connection sessions expire after thirty days without use; signing out invalidates the browser session and its linked access. OAuth registration and grant metadata can be retained separately for connection administration. Disconnecting does not remove information already returned to ChatGPT.

Saved reports do not currently have automatic age-based deletion. We retain them while they are needed to provide the account’s report history. When you request deletion or close an account, we assess which records can be removed and which must remain for a specific legal, security or audit reason, and explain this to you. Support correspondence is kept as needed to resolve the request and related follow-up. Copies held in provider backups may remain until those backups expire; contact us for the applicable details. Do not use the beta as your only copy of important records.

Your choices and rights

Depending on the information and applicable law, you can ask to access, correct, erase, restrict or receive a portable copy of your data, and object to processing based on legitimate interests. Contact benlukespink@gmail.com. We may need to verify your identity or organisation authority. You can also complain to the UK Information Commissioner’s Office.

Changes

We will update this page when our handling of information changes. The date above identifies this version.