BrowserBook Privacy Policy

1. Information We Collect

• Account Information: Name and email address, collected for authentication and account management.
• Authentication Credentials: For automation workflows, we store access credentials in a secure vault, encrypted at rest.
• Billing Information: Payment details are collected and processed securely by Stripe; we do not store payment information.
• Usage Data: We collect telemetry, such as error logs, feature usage, and device information, via Posthog, AWS, and AI providers (e.g., OpenAI).
• Healthcare Data: For customers who execute healthcare workflows, we may process Protected Health Information (PHI) under a signed Business Associate Agreement (BAA).

2. How We Use Information

• Provide, operate, and improve the Service
• Authenticate and authorize users
• Execute and monitor automation workflows
• Provide customer support
• Process billing and manage accounts
• Comply with legal and regulatory requirements

We do not sell or rent personal data to third parties.

3. Authentication and Third-Party Providers

• We use Clerk for user authentication. We only store provider-issued tokens; we do not store raw credentials.
• For automation workflows, credentials are stored securely in our vault, encrypted at rest.
• For AI coding agents, we use OpenAI with zero data retention (ZDR) enabled.

4. Data Sharing

We only share information with third-party providers necessary to operate the Service, including:

• Stripe (billing)
• Clerk (authentication)
• Posthog (analytics)
• AWS (infrastructure and storage)
• OpenAI (AI agent processing, with ZDR enabled)

We do not share information with advertisers or marketing platforms.

5. Data Retention and Deletion

• User data is retained while the account is active.
• Upon account deletion, we retain data for 30 days for recovery purposes, after which it is permanently deleted.
• For customers with a signed HIPAA BAA, we comply with HIPAA-mandated retention requirements.

6. Security

• Encrypting stored automation credentials at rest
• Secure infrastructure hosted on AWS
• Optional HIPAA-compliant environment for healthcare customers
• SOC 2 and GDPR support planned

7. User Rights

• Users may update their account information directly in the Service.
• Users may request access to or deletion of their personal data by contacting us at privacy@browserbook.com.
• For healthcare customers, HIPAA rights apply where applicable.

8. Global Use

The Service is available worldwide. If you are located outside the United States, your information may be transferred and processed in the United States, subject to applicable data protection laws.

9. Contact

For privacy inquiries, please contact us at:

• Email: privacy@browserbook.com

10. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last Updated" date at the top of the page indicates when the policy was most recently revised.