Privacy Policy

01Who this policy covers

This Privacy Policy explains how BrowserBunny ("we," "us," or "our") handles personal information when you visit our website or documentation, communicate with us, or use our browser-testing platform, dashboard, API, and SDK (the "Services").

Our public marketing site currently presents a coming-soon product. Descriptions of account, testing, and payment information below apply when you use those features, including any early-access offering; visiting the marketing site alone does not create an account or start a browser test.

When a customer submits personal information as part of a test, that customer determines which websites and data are tested. We process that test information to provide the requested service. Questions about a customer’s collection or use of your information should also be directed to that customer.

02Information we collect

• Account information. Your email address, authentication information, account identifiers, project names, API-key metadata, and account settings. If you choose GitHub sign-in where available, we receive your GitHub account identifier and verified email address.
• Test information. URLs, instructions, device selections, files or file URLs you submit, website content observed during a test, and the resulting events, logs, outcomes, reports, and session recordings. Screenshots may be processed during visual checks. This information can include personal information visible on a website you ask us to test.
• Usage and technical information. Testing duration, run identifiers, timestamps, errors, IP addresses, browser and device information, and request information used to deliver, secure, and troubleshoot the Services.
• Billing information. When billing is enabled, payment-provider customer and payment-method references, billing status, charges, and transaction records. Payment details entered into a hosted checkout are collected by the payment provider.
• Communications. Information you include when you contact us, such as your email address, the content of your message, and attachments you choose to provide.

Please use test accounts and synthetic data where possible. Do not include passwords, private keys, payment-card details, health information, or other sensitive information in prompts, uploads, or pages unless you have the necessary authority and an appropriate arrangement with us.

03How we use information

We use information to provide the Services, authenticate users, manage projects and API access, run browser tests, produce and display results, measure testing usage, administer billing, and respond to requests.

We also use relevant technical and account information to diagnose errors, maintain reliability, prevent fraud or misuse, enforce our terms, and meet legal obligations. Service communications may include verification messages, account notices, and responses to support requests.

Where data-protection law requires a legal basis, the applicable basis depends on the activity: performing our agreement with you, complying with legal obligations, pursuing legitimate interests in operating and protecting the Services, or obtaining consent where required. If information is needed to authenticate you or run a test and you do not provide it, that feature may not be available.

04AI processing and test data

BrowserBunny uses AI services to interpret testing instructions, guide browser actions, and evaluate observations. Relevant prompts, observed page content, and images used for visual checks are sent to the AI providers involved in that test. Our current integrations include Typesafe and Amazon Bedrock.

A browser test can interact with the website you select. Information entered or submitted during that test is also sent to that website and is subject to its own practices. You are responsible for choosing appropriate test targets and for having permission to share the information involved.

Saved reports and recordings can contain information displayed during a test. Access is restricted through account authorization, but you should avoid exposing unnecessary personal information in test environments. A screenshot used for analysis and a saved session recording are different forms of processing; deleting a temporary image does not remove information already included in a recording or sent for analysis.

05When information is shared

We share information as needed to operate the Services with providers of hosting, storage, identity, email delivery, browser infrastructure, AI processing, and payment processing. Current integrations include Vercel for the marketing website, Mintlify for documentation, Amazon Web Services for application infrastructure, Typesafe and Amazon Bedrock for AI processing, and Stripe for hosted payment flows where enabled.

If you use a third-party sign-in option or payment flow, that provider also handles information under its own privacy notice. Websites you test receive requests and information submitted by the browser session.

Information may also be disclosed when reasonably necessary to comply with law or legal process, protect people or the Services, investigate misuse, or establish or defend legal claims. If the business is involved in a merger, acquisition, or transfer of assets, relevant information may be reviewed or transferred subject to applicable law and appropriate confidentiality protections.

06Cookies and browser storage

The marketing website does not currently include advertising trackers or analytics cookies. Hosting and security providers may still process technical request information to deliver and protect the website.

When you use the account application, necessary cookies maintain authenticated sessions and protect sign-in flows. The dashboard can also use local browser storage to remember your email address if you choose that option. Documentation, sign-in providers, payment providers, and websites you test may use their own cookies or storage.

You can manage cookies and local storage through your browser settings and turn off the dashboard’s remember-account option. Blocking necessary cookies may prevent sign-in. We do not currently use marketing-site tracking for cross-site targeted advertising; the site does not change its behavior in response to a Do Not Track signal.

07How long information is kept

Retention depends on the type of information and why it is needed. Account and project information supports your use of the Services. Test reports, run logs, and recordings support historical results and troubleshooting. There is currently no fixed automatic expiration period for saved test histories and recordings.

Operational logs, authentication records, billing records, and correspondence may have different retention periods. Relevant criteria include whether an account remains active, whether information is needed to resolve an issue, applicable accounting or legal requirements, security needs, and the handling of a deletion request.

Deletion may be subject to legal obligations, dispute preservation, or backup recovery requirements. Information retained for those purposes remains subject to appropriate restrictions. A request concerning data submitted by a customer may need to be handled through that customer.

08Security and data location

We use technical and organizational measures intended to protect personal information, including encrypted connections, access controls, and private storage for test evidence. No system or transmission method is completely secure. Protect your account credentials and API keys, and notify us if you suspect unauthorized access.

Our application infrastructure includes services in the United States. Service providers may process information in other countries, whose laws may differ from those where you live. Where applicable law requires a specific transfer mechanism or additional safeguards, those requirements must be addressed in the applicable service or data-processing arrangements.

09Your choices and rights

Depending on your location and the law that applies, you may have rights to request access to, correction of, deletion of, or a copy of your personal information; to restrict certain processing; or to withdraw consent where processing relies on consent. Withdrawing consent does not affect processing that was lawful before withdrawal.

You may also have the right to object to processing based on legitimate interests. Where applicable, you may use an authorized agent, appeal a decision about a rights request, or complain to your local data-protection authority. These rights are subject to applicable conditions and exceptions.

To make a request, use the contact details in the contact section and describe the information or account involved. We may need to verify your identity and authority before responding. Do not include account passwords or API keys. If your information appears in a test run submitted by another organization, contact that organization so it can address your request.

10Children’s information

BrowserBunny is a service for adults acting in a professional or business capacity. It is not directed to children, and children under 18 should not create an account or submit personal information to us. If you believe a child has provided personal information, contact us so we can investigate and address it.

11Changes to this policy

We may update this policy as the Services and our practices change. The date at the top identifies the latest revision. Where required, we will provide additional notice or obtain consent before materially changing how previously collected information is used. New features may have additional notices relevant to that feature.

12Contact us

This document is a draft for review. BrowserBunny’s legal operator, business location, and public contact email must be confirmed before publication so that privacy requests and legal notices reach the right person.