Privacy Policy

1. Who we are

BrowseOtter is operated by Spartan (a trading name of Melos Bobi), a sole proprietor based in Kosovo("we", "us"). We are the controller of the personal data described in this policy. You can reach us at info@browseotter.com.

BrowseOtter is a service for recording browser tasks and replaying them automatically, with adaptive element matching. This policy covers our website at https://browseotter.com, the BrowseOtter application, and the BrowseOtter Recorder browser extension.

2. What we collect

• Account data: your name, email address, and password. Passwords are handled and hashed by our authentication provider; we never see or store them in readable form. We also keep a log of security-relevant account events (for example sign-ins and settings changes).
• Recordings you create: the steps of a browser task you record or import: page URLs, element selectors, text and label hints that help find elements again, and the non-password values you type or select. Recording only starts when you start it in the extension. The value of a password field is never stored; a password step stores only a reference to a saved credential.
• Credentials and saved sessions you add: website logins and browser session state that let automations sign in for you. They are stored encrypted (AES-256-GCM) and are decrypted only in memory on our worker while a run needs them.
• Run data: status, step progress, error details, any values your recording extracts, and screen recordings (video) and screenshots of the pages being automated. These can contain personal data that the websites you automate display, so only automate pages you are entitled to access.
• API tokens: we store only a one-way hash and a short visible prefix, never the token itself after it is first shown to you.
• Webhook settings: the URL you configure and a signing secret we generate for it. When a run finishes we send the result to that URL.
• Billing data: your payment is handled by Paddle, our reseller and Merchant of Record. We do not receive or store your full card number. We keep your customer and subscription identifiers, plan status, and relevant dates.
• Technical data: our hosting provider processes IP addresses and request details in server logs. Page-view statistics are collected with Vercel Web Analytics, which does not use cookies. If you accept analytics cookies, Google Analytics also measures how the site is used; if you decline, it only receives cookieless signals.
• Emails: we send service emails only, such as run notifications and account messages. We do not send marketing email at present; if that changes we will ask for your consent first.

We use strictly necessary cookies to keep you signed in. With your consent, we also use Google Analytics cookies (named _ga and _ga_*, kept for up to 2 years) to understand how the site is used. We ask before setting them, the site works the same if you decline, and you can change your choice at any time. We do not use advertising or cross-site tracking cookies.

3. Why we use your data, and our legal bases

• To provide the service you asked for (account, recording, replay, scheduling, notifications, billing): performance of our contract with you.
• To keep the service secure and reliable (abuse prevention, rate limiting, diagnostics, fixing failed runs): our legitimate interests.
• To meet legal obligations such as tax and accounting records: legal obligation.
• Where you choose to enable something optional (for example webhook delivery): your consent or the contract, as applicable.

We do not sell your personal data, we do not use it for advertising, and we do not use your recordings, credentials, or run content to train machine-learning models.

4. Who receives your data

We share data only with service providers that help us run BrowseOtter, under their own data protection terms:

• Supabase – database, authentication, and private file storage for run videos and screenshots (hosted in the EU, Frankfurt).
• Vercel – website and application hosting, and web analytics. Application requests may be processed in the United States.
• Google – website analytics (Google Analytics and Google Tag Manager; analytics cookies only with your consent) and search performance reporting. Data may be processed in the United States.
• Resend – delivery of service emails.
• Paddle – our reseller and Merchant of Record: checkout, payment processing, invoicing, sales tax, and subscription management.
• The websites you automate – when a run executes, our worker connects to the sites in your recording as you would from a browser, so those sites receive the requests and any values your recording enters.

We may also disclose data if required by law, to protect our rights or users' safety, or in connection with a sale or restructuring of the service (we would tell you first).

5. International transfers

Some providers process data outside Kosovo, the EU, or the UK, including in the United States. Where that happens we rely on the safeguards those providers offer, such as standard contractual clauses or equivalent mechanisms.

6. How long we keep data

• Run records, videos, screenshots, and extracted results: 30 days after the run completes, then deleted automatically.
• Saved browser sessions: deleted after 30 days without use. You can also revoke them at any time in Settings.
• Security and audit events: 365 days.
• Recordings, saved credentials, schedules, API keys, and account data: until you delete them or your account.
• Payment records held by our payment processor: as long as tax and accounting law requires.
• When you delete your account, your data is deleted immediately. See our data deletion page for what, if anything, remains briefly.

7. Security

We protect data with encryption for stored credentials and session state, one-way hashing of API tokens, private storage with short-lived signed links for run videos and screenshots, per-user access controls in the database, and rate limiting. Automations are blocked from reaching private and internal network addresses. No system is perfectly secure, so please use unique passwords and keep your API tokens private. If we learn of a breach affecting your data, we will notify you and the relevant authority as the law requires.

8. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy;
• correct inaccurate data (you can edit most of it directly in the app);
• delete your data (you can delete your account yourself in Settings);
• restrict or object to certain processing, and withdraw consent where we rely on it;
• export your recordings (each recording can be exported as JSON in the app).

To exercise a right, email info@browseotter.com. We will respond within one month. You also have the right to complain to a data protection authority: in Kosovo, the Information and Privacy Agency, or the authority in your own country if you live elsewhere.

9. Browser extension

The BrowseOtter Recorder extension records your actions on pages only after you start a recording, and sends the resulting steps only to theBrowseOtter server you configured, using your own API token. The token is stored locally in your browser. We use extension data only to provide the recording feature you asked for. We do not sell it, use it for advertising, or transfer it for purposes unrelated to the feature.

10. Children

BrowseOtter is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.

11. Changes to this policy

We may update this policy. For material changes we will give notice in the app or by email before they take effect. The date at the top shows when it was last updated.

12. Contact

Questions or requests about privacy: info@browseotter.com.