BrowseWiz Logo
Add to Browser

PRIVACY POLICY OF BROWSEWIZ PLATFORM AND APP

Effective date: 11 November 2026

1. Initial Provisions

The Privacy Policy sets out the principles for processing the personal data of users of the online platform https://browsewiz.com/ (hereinafter referred to as the Platform) and Browsewiz App (hereinafter referred to as the App).

Detailed rules for the use of the Platform and the App can be found in the Terms of Use of the BrowseWiz Platform and App.

A User of the Platform is any person using its functionality, i.e., natural persons acting on behalf of themselves or other entities (legal persons or other organisational units).

Personal data is processed in accordance with the General Data Protection Regulation of 27th April 2016 (Official Journal of the EU L 119 of 04.05.2016) (hereinafter referred to as GDPR), regardless of the User's place of residence.

The Administrator informs that chat histories stored by the User as part of the App are used only to provide the App's functions to the User: keeping, showing and restoring them, and generating AI answers and chat titles (see Section 10). No person reads their content. The exceptions are conversations and comments that the User chooses to share when rating a response (see Section 3, item 6), which are read by persons authorised by the Administrator (the BrowseWiz team) in order to improve the quality of responses, and conversations the User asks the Administrator to read. Persons authorised by the Administrator may also read chat histories where this is needed to investigate a specific security incident or breach of the Terms, or where the law requires it, and may search backed-up chats and other backed-up content for the details given in a request described in Section 7, item 6, and read what is found.

2. Who Processes Your Data?

The administrator of your data is Tomasz Posłuszny, conducting business activity as DevPeer Tomasz Posłuszny, Kłobucka 8B/249, 02-699 Warsaw, Poland.
Tax number: 5213730587,
Email: contact@browsewiz.com

The Administrator is the controller of the personal data described in this Policy, except as described in the next paragraph, including:

  • account, billing, statistics and response-rating data, including conversations shared with a rating,
  • the records of approved actions (Section 3, items 8 and 11, and Section 4, item 8),
  • data processed to prevent abuse and to investigate a specific security incident or breach of the Terms (Section 3, item 9),
  • the content listed in Section 4, item 7, when the User has the App process it for private use.

When the User uses the App for business use, as the Data Processing Agreement (DPA) defines it, the User, or the organisation the User acts for, is the controller of the content listed in Section 4, item 7, including its backup (Section 7) and the email alerts made from it (Section 4, item 10). The Administrator processes that content as the User's processor under the DPA, which is part of the Terms for business use. For a User whose account was created before this version of the Policy was published, the DPA applies 30 days after the email informing them of it, or earlier if the User accepts it by email to contact@browsewiz.com (Terms, section XI, paragraph 3); until then, the Administrator already meets its obligations under section 6, paragraphs 1, 2 and 4, and sections 8 to 14 of the DPA, within the limits of its section 16, and the rest of the DPA applies from that date.

3. For What Purpose and on What Basis Is Your Data Processed?

Your personal data is processed for one or more of the purposes indicated below:

  1. To enable you to use the Platform and its functionalities - i.e., to provide a service in accordance with your expectations (Article 6(1)(b) GDPR),
  2. To answer messages the User sends via the contact form - to take steps at the User's request before entering into a contract or to perform it (Article 6(1)(b) GDPR) and, for other enquiries, on the basis of the Administrator's legitimate interest in answering them (Article 6(1)(f) GDPR); feedback the User sends from the page shown after the App is removed (the uninstall page) is processed to answer it and to improve the App, on the basis of the Administrator's legitimate interest (Article 6(1)(f) GDPR); withdrawal statements the User sends via the form at https://browsewiz.com/withdraw or by email are processed to handle the withdrawal and the refund, to fulfil the Administrator's legal obligations (Article 6(1)(c) GDPR),
  3. To enable you to use the App, i.e., to provide a service in accordance with your expectations (Article 6(1)(b) GDPR), to fulfil the Administrator's legal obligations (Article 6(1)(c) GDPR),
  4. To handle the purchase and billing of subscriptions - i.e., to provide a service in accordance with your expectations (Article 6(1)(b) GDPR), to fulfil the Administrator's legal obligations, such as the fulfilment of tax obligations (Article 6(1)(c) GDPR),
  5. To send the User optional emails about product updates, new features, tips and offers, and invitations to share feedback about the App - based on the User's consent (Art. 6(1)(a) GDPR), which the User can turn on or off at any time in the App's Options → Settings → Email updates, and on the page shown after the App is removed (the uninstall page): while the User is signed in, the App adds an encrypted account token to that page's link, whether or not "Usage analytics" is on, so that the page can show the account's email address and let the User manage these emails there; an email with a discount coupon and news of price changes is sent only to a User who gave a separate consent to it on the uninstall page, after choosing the price as the reason for leaving, and the User can withdraw that consent there, by turning off Email updates in the App's Options → Settings, or by writing to contact@browsewiz.com; the text shown and the time of each change are kept with the account as a record of that choice,
  6. To improve the quality of responses in the App - i.e., as regards response ratings and their metadata, on the basis of the Administrator's legitimate interest in improving the App (Article 6(1)(f) GDPR), and as regards conversations and comments shared with a rating, on the basis of the User's consent (Article 6(1)(a) GDPR), which the User may withdraw at any time in the App's Options → Settings → Privacy; personal data of third parties contained in shared conversations is processed on the basis of the Administrator's legitimate interest in improving the App (Article 6(1)(f) GDPR),
  7. To answer the User with AI models and to carry out the tasks the User asks for (chat, the browser agent, scheduled tasks, page monitors, the Google Sheets and Google Calendar tools, voice input, read aloud and chat titles), as described in Section 10 - for content processed for private use, on the basis of the performance of the contract for the provision of the App (Article 6(1)(b) GDPR); personal data of third parties contained in the content the User has the App process for private use is processed on the basis of the Administrator's legitimate interest in providing the App's functions to the User (Article 6(1)(f) GDPR). For content processed for business use, the Administrator acts as the User's processor, and the legal basis is the User's as controller (Section 2),
  8. To safety-check the browser agent's actions and to keep a record of the actions the User approved - a record of what the agent did, on which page and when, of the plans the User approved, and that the User approved them, kept to establish or defend legal claims - on the basis of the Administrator's legitimate interest (Article 6(1)(f) GDPR). The User may object to this processing (Section 8, item 6); records may still be kept where they are needed to establish, assert or defend legal claims,
  9. To apply plan limits, meter credit usage, prevent abuse of the App and investigate a specific security incident or breach of the Terms, including by reading chat content as described in Section 1 - on the basis of the Administrator's legitimate interest (Article 6(1)(f) GDPR), and where the law requires disclosure, to fulfil the Administrator's legal obligation (Article 6(1)(c) GDPR),
  10. To collect statistics on how the App is used - pseudonymously by default (with a random identifier that changes daily), on the basis of the Administrator's legitimate interest in improving the App and measuring the effectiveness of its pages and ads (Article 6(1)(f) GDPR), to which the User may object by turning off "Usage analytics" in the App's Options → Settings → Privacy; linked to the User's account only with the User's consent, given by turning on "Link usage statistics to my account" (Article 6(1)(a) GDPR). The last day the account was active is also recorded, to measure how many Users keep using the App, and so is the Platform page or ad campaign the App was installed from, to measure which of the Administrator's pages and ads bring Users who keep using it,
  11. To learn, in aggregate, which sites and kinds of tasks the browser agent is used for, in order to improve it - on the basis of the Administrator's legitimate interest in improving the App (Article 6(1)(f) GDPR). For this purpose the Administrator analyses the records of approved browser-agent actions (Section 4, item 8) made from 3 November 2026, using only the domain of the page each action was on (from the page address or the approval's domain), the approval type, and each action's description with any typed text removed, i.e. the kind of action (such as a click, typing or opening a page) and the name of the page element it acted on, and, for an approved plan, its title and the descriptions of its steps; the text the User approved typing is never used. The results are aggregate only and do not identify any User, and a domain appears in them only when the browser agent was used on it from at least 3 accounts. Working extracts made for an analysis are deleted when that analysis is finished, and the records are not sent to AI providers for it. The User has the right to object to this processing at any time, separately from the processing in item 8 (Article 21 GDPR): by turning off "Use my approved actions to improve BrowseWiz" in the App's Options → Settings → Privacy, or as described in Section 8, item 6. The Administrator then stops using the User's records for this purpose, including those made before the objection.
  12. To handle requests under the GDPR and notices of illegal content about personal data in Users' content (Section 7, item 6) - searching that content, checking the requester's identity, telling the User and the requester what Section 7, item 6 describes, and keeping a record of the request and the decision - to fulfil the Administrator's legal obligations under Articles 12 to 17 GDPR, where it is the controller, and Articles 16 to 18 of the Digital Services Act (Article 6(1)(c) GDPR); as regards telling a requester who the controller is and keeping the record, on the basis of the Administrator's legitimate interest in letting people exercise their rights, showing how requests were handled and establishing or defending claims (Article 6(1)(f) GDPR).

The Administrator does not make decisions based solely on automated processing, including profiling, that produce legal effects concerning the User or similarly significantly affect them (Article 22 GDPR).

4. What Data Do We Process?

The Administrator processes the following personal data:

  1. The User's email address,
  2. The User's first and last name, if voluntarily provided by the User when creating an account or received from Google when the User signs in with a Google account,
  3. Other personal data voluntarily provided by the User as part of the contact form, together with the account identifier of a signed-in User and any file attached to the message, and the comment and optional email address the User sends from the uninstall page, together with the chosen reason, the App version, the App language and the install week; the name and account email entered in the withdrawal form and the date and time of the statement,
  4. Where the User rates a response in the App: the rating (positive or negative), the identifier of the model that produced the response and the chat mode, the position of the response in the conversation, the time of the rating and of its last change, and the identifier of the User's account; and, only with the User's consent, the text of the conversation up to and including the rated response (the User's messages, the replies, tool calls and their results, and page addresses without their query string or fragment), any comment added by the User, and the record of that consent (its wording and the time it was given). Shared conversations may contain personal data of third parties, in particular text from web pages read by the assistant. Pages and files attached to a message, screenshots, images and the results of the Google Sheets and Google Calendar tools are never included, but page text that the assistant read with a tool can be,
  5. Account and usage data: the account identifier, the sign-up date, the plan, credit usage and limits, the last day the account was active, the User's settings and consent records, and the time of a request to delete the account,
  6. Billing data: the Stripe customer identifier, the plan, the billing period, the time of the order and of the request to start the service, and the version of their wording. Payment details are handled by Stripe,
  7. Content the User has the App process: messages; pages, files, images and screenshots attached to them; text the browser agent reads or types on pages; the names and sizes of the files the browser agent downloads, which the App reads on the User's device when the User has allowed it to see downloads; Google Sheets and Google Calendar data the tools read or write; voice recordings and text read aloud. This content may include personal data of third parties,
  8. Records of browser-agent actions approved by the User: the account identifier, the approval type, the time, the domain and the plan identifier; each approved action as the approval card described it, including typed text (leaving out values typed into fields the page marks as password, one-time-code or payment-card fields) and the names of page elements; the page address without its query string; and, for each plan card the User approves, the plan as the card showed it: its title, each step with its page address (without its query string), the schedule, what a page monitor watches and the changes a scheduled run may make. These records may include personal data of the User and of people shown on the page. They are stored on Amazon Web Services (AWS) servers in the United States, are not sent to AI providers and are used only for the purposes in Section 3, items 8 and 11; each record also notes whether the User has objected to the purpose in Section 3, item 11,
  9. App usage statistics: the features used, the App version, the browser and operating system, which Platform page the App was installed from (when it was one of the use-case pages or the used-car dealers page, or the page matching the ad's audience), the audience of the Administrator's ad the App was installed from (when it was one of the Administrator's ad campaigns, such as the one for car flippers), and a random identifier that changes daily; only with the User's consent, also the account identifier and an installation identifier. They never include chat text, page addresses or page titles,
  10. Email alerts the User turns on with "Notify via email" for a scheduled task or a page monitor: for each finished or failed run, the task's name, the run's status, the run's final answer and the titles and identifiers of the spreadsheets the run edited, for each monitor match, the monitor's name, headline, summary and page address, and when a monitor stops working after 3 failed checks in a row, the monitor's name, the reason it stopped working and its page address, together with the random identifier of the run, match or alert, which the email's link uses to open it in the App. The App sends them to the Administrator's server only to create the email, which goes to the User's own verified email address. They may include personal data of third parties, in particular text from the pages the task or monitor read.

Providing the email address is necessary to create an account and use the App; providing other data is voluntary.

5. For How Long Do We Process Your Data?

  1. Personal data shall be processed for the duration of the performance on behalf of the User of the activities for which the data were provided and for the period of limitation of claims arising from the performance of the specified activities. After the account is deleted, data is kept only as described in Section 8.
  2. In the case of personal data provided solely on the basis of the User's consent (with no other basis for processing), the personal data are processed until the consent is withdrawn, but for no longer than 10 years.
  3. By way of derogation from items 1 and 2, response ratings, together with any conversations and comments shared with them, are deleted automatically 12 months after their last change, or earlier upon deletion of the User's account or at the User's request; conversations and comments already shared are also deleted when the User withdraws consent to sharing them. Automatic deletion may take a few days after that date.
  4. Records of approved browser-agent actions (Section 4, item 8) are deleted automatically 90 days after they are made. Working extracts made from them for the analysis in Section 3, item 11 are deleted when that analysis is finished.
  5. Server logs (the account identifier, the requested address and the time, and in the web server's access log also the IP address and the browser's user agent) are kept for up to 30 days for security and troubleshooting.
  6. If you raise a complaint or claim, we keep the records relevant to it until it is resolved.
  7. Records of requests and notices described in Section 7, item 6, and of the decisions on them, are kept for 3 years after the decision, to show how they were handled.

6. To Whom Do We Share Your Data?

  1. Your personal data may be passed to third parties directly involved in the maintenance of the Platform or in the performance of contracts or other activities on your behalf, such as law firms, accounting and tax offices, IT service providers (including hosting), permanent collaborators - with each time the Administrator guarantees that personal data will be processed only for the purpose specified in this Policy.
  2. Response ratings, together with any conversations and comments shared with them, are stored on servers in the United States operated by the Administrator's hosting provider, Amazon Web Services (AWS), acting as a processor. This involves a transfer of personal data outside the European Economic Area, which is based on the European Commission's adequacy decision for the EU–US Data Privacy Framework, under which Amazon Web Services, Inc. is certified (Article 45 GDPR), and, where that decision does not apply, on the standard contractual clauses adopted by the European Commission and included in the data processing addendum concluded with AWS (Article 46(2)(c) GDPR), a copy of which can be obtained from the Administrator. For Users in the United Kingdom and Switzerland, the transfer is based on the UK Extension to the EU–US Data Privacy Framework and the Swiss–US Data Privacy Framework, under which Amazon Web Services, Inc. is also certified. For Users in other countries, the consent to sharing conversations, given in a dialog that says they are stored in the United States, also covers their transfer there. Ratings, shared conversations and comments are not passed to AI model providers for training their models.
  3. If you connect Claude Code or another local MCP client program to the BrowseWiz extension, BrowseWiz gives that program, on your computer, the Google Sheets and Google Calendar data and the tool results it asks for through the Spreadsheet and Calendar tools you have switched on. While the browser agent is switched on, BrowseWiz also gives that program the URLs and titles of the tabs in the BrowseWiz Tabs groups, and, for the browser tasks it hands to BrowseWiz, the web page content the browser agent reads and the agent's reports. The browser agent itself runs as it does in BrowseWiz chat, through BrowseWiz's servers and AI providers. What that program does with this data, including sending it to its AI provider, is governed by your agreement with that program's provider, not by BrowseWiz.
  4. The recipients of personal data and their roles are:
    • Amazon Web Services (AWS): hosting, databases, sign-in (Amazon Cognito) and delivery of contact-form emails, of the email acknowledging receipt of a withdrawal statement sent via the form at https://browsewiz.com/withdraw (it goes to the email address entered in that form), and of the email alerts the User turns on with "Notify via email" for a scheduled task or page monitor (Amazon SES, as a processor; the Administrator does not store the content of these alerts), in the United States,
    • the AI providers listed in Section 10,
    • Stripe: payments,
    • Mixpanel and PostHog, hosted in the European Union: statistics,
    • Google Analytics, Google Ads and Google Tag Manager on the Platform, only with the User's consent,
    • the Google APIs used for the User (Section 11),
    • people who ask for access to their own data held in a User's content, after their identity is checked: their own data and, where the User says the content was processed for business use, the User's name and contact email as controller (Section 7, item 6),
    • Users whose content a request or notice concerns: what is asked and, only where needed, the requester's name and contact details (Section 7, item 6).
  5. The grounds for the transfer of personal data outside the European Economic Area set out in item 2 also apply to the data stored on AWS and to the recipients listed in item 4: the EU–US Data Privacy Framework where the entity receiving the data is certified under it, and otherwise the standard contractual clauses adopted by the European Commission (Decision (EU) 2021/914), included in the recipient's data processing terms; where the recipient passes the data on to its affiliate or sub-processor (for example a model provider reached through OpenRouter), it binds that entity by written contract to the same data-protection obligations, as Article 28(4) GDPR and, where they apply, those clauses require. Where a recipient contracts with the Administrator through its entity in the European Economic Area (as OpenAI and Anthropic do), that entity transfers the data to its affiliates outside the European Economic Area on the same grounds.

7. Backup of Chats, Prompts, Scheduled Tasks, Monitors, Settings, Custom Models, Tools and MCP Servers

  1. While backup is on, the App stores the User's chats (including the page and file contents read or attached in them, and the results of scheduled task runs and monitor matches saved in the chat history), the custom prompts created by the User, the User's scheduled tasks (each task's plan and schedule, its last result only while chat backup is on, and the name and a random identifier of the browser that runs it, such as "Chrome on Windows"), the User's monitors (each monitor's page URL, name and criterion, the labels and page selectors of the items it tracks, only while chat backup is on the headline and time of its latest match and a record of its latest 5 attempts to repair a tracked item's selector (the time, the old and new selectors and the values each read on the page), and the name and a random identifier of the browser that checks it), the User's settings (such as the colour theme, the language, the selected model, the built-in tool switches and their settings), custom models (each model's name, endpoint URL and non-secret request headers), custom tools (each tool's name, endpoint URL, method, schema and non-secret request headers) and MCP servers (each server's URL, name and version) in the Administrator's cloud storage, so that the User can restore them on any device by signing in. Chats are backed up only if the User chooses so: the App asks once per account, and until the User agrees, no chat is stored in the Administrator's cloud storage. The last results of scheduled tasks, the latest matches of monitors and the records of their repair attempts follow that choice. Backup of everything else is on by default. Each can be turned off separately in the App's Options → Settings → Backup & Sync. API keys, the values of request headers marked as secret and MCP server authorization headers are never uploaded: they stay only on the device where the User entered them and must be entered again on another device.
  2. The legal basis for the backup of chats, and of the task results, monitor matches and repair records that follow that choice, is the User's consent (Article 6(1)(a) GDPR) and, for special categories of personal data the User's chats may contain, the User's explicit consent (Article 9(2)(a) GDPR). The User withdraws this consent at any time by turning chat backup off in the App's Options → Settings → Backup & Sync, which deletes the backed-up chats and removes those results from the backed-up tasks and monitors. The text shown to the User and the time of the User's answer are kept with the account as a record of the choice. The legal basis for the backup of everything else is the performance of the contract for the provision of the App (Article 6(1)(b) GDPR). Personal data of third parties contained in backed-up chats is processed on the basis of the Administrator's legitimate interest in providing the backup to the User (Article 6(1)(f) GDPR). The legal bases in this item, including the consent described in it, apply to private use. For business use (Section 2), chats are backed up on the User's instruction under the DPA, which the User gives with their choice in the App. For accounts that have not answered the question described in item 1, chats backed up before the App started asking it stay in cloud storage until the date given in the email that notifies Users of this version of the Privacy Policy, which is at least 30 and at most 45 days after that email is sent, and are deleted on that date. Chat backup is paused for these accounts until the User answers. Until then they are kept on the basis of the Administrator's legitimate interest in letting the User choose before the chats are deleted (Article 6(1)(f) GDPR). This applies to business use too, as announced in that email.
  3. Chats, prompts, scheduled tasks, monitors, settings, custom models, tools and MCP servers are stored on servers in the United States operated by the Administrator's hosting provider, Amazon Web Services (AWS), acting as a processor. The transfer of personal data outside the European Economic Area is based on the same grounds as for response ratings (Section 6, item 2).
  4. Backed-up chats, prompts, scheduled tasks, monitors, settings, custom models, tools and MCP servers are kept until the User deletes the item, turns backup off (which deletes the backed-up copies of that kind) or deletes the account. Backed-up chats are also deleted automatically 12 months after their last change. When the User deletes a prompt, a scheduled task, a monitor, a custom model, a custom tool or an MCP server, a record of its identifier and deletion time is kept for 90 days, so that another device cannot bring the item back. Only the User's 100 most recent chats are kept in the backup.
  5. Chats can contain special categories of personal data (Article 9 GDPR), such as health data, because a User asked the App to process them. The Administrator does not seek such data out, does not search backed-up chats for it and does not build profiles from it. For the User's own data of this kind, the legal basis for its backup is the User's explicit consent (item 2). The App may not be used to collect, compile or profile other people's data of this kind, or personal data relating to their criminal convictions and offences (Article 10 GDPR), unless the law allows it (Terms, section IV.1). For business use, the User as controller must have a condition under Article 9 or 10 GDPR. The Administrator acts on notices about such data as described in item 6.
  6. People whose personal data is in a User's chat:
    • The Administrator does not notify them: finding them would mean searching every User's chats, which would be a disproportionate effort and would expose all Users' private content. This Policy is public so that they can learn of the processing (Article 14(5)(b) GDPR).
    • They can write to contact@browsewiz.com with a request under the GDPR or with a notice of illegal content (Article 16 of the Digital Services Act, Regulation (EU) 2022/2065). A request under the GDPR needs only enough to identify the person and find their data, such as the BrowseWiz account that holds it and the person's name, email address or phone number; reasons are needed only for an objection or for erasure on a specific ground. A notice of illegal content gives the reasons why the content is illegal, where it is (such as the account), the notifier's name and email address, and a statement that the notice is made in good faith and that the information in it is accurate and complete; for a notice concerning the sexual abuse or sexual exploitation of children, including solicitation (Articles 3 to 7 of Directive 2011/93/EU), the name and email address are optional.
    • The Administrator confirms receipt, and a person reviews the message; the Administrator may ask for more information. It searches the account's backed-up content (item 1, including data kept from earlier versions of the App), its records of approved actions and the conversations the User shared with a rating for the details given, and a person reads what is found. If the message names no account, it searches all of these by automated means for the exact email address or phone number given, and a person reads only what is found; a name alone is searched only within a named account. It does not search only where, as controller, it finds a request manifestly unfounded or excessive (Article 12(5) GDPR), or where a notice is too imprecise to act on.
    • Within 5 working days of receiving the message or the further information it asked for, except where it may not tell the User before deciding (see the next points), the Administrator tells the User which content contains those details and what is asked, and asks whether the content was processed for business use. It gives the User the person's name and contact details only where this is needed to handle the message, and not where the person asks it not to and the message can be handled without them. The User has 10 days from that message to answer, and the Administrator sends a reminder after 5 days. Where content may be deleted, the message says which content, the facts and the ground, that the content was found by a search for the details given and that a person read it and takes the decision, and that the User may comment.
    • Before telling the person anything about a User or giving out any data, the Administrator checks that the person controls the email address or phone number found, by a code sent to it, or that they otherwise prove their identity; a name alone is never enough.
    • The Administrator decides a notice of illegal content as hosting provider, in private and business use alike, taking into account what the User says. Where content is manifestly illegal or a notice concerns a threat to life or safety, it may disable access to the content at once, without waiting for the User; it does not tell the User of a notice before deciding where that would hinder the prevention, detection or prosecution of a criminal offence, and it informs the authorities as Article 18 of the Digital Services Act requires. It tells the notifier its decision, that the content was found by an automated search for the details given and that a person took the decision, and the possibilities for redress (Article 16(5) and (6) of the Digital Services Act). When it deletes content, disables access to it, or blocks or restricts the account, it sends the User, at the latest when it does so, its decision with a statement of reasons (Article 17 of the Digital Services Act): what was done, that the decision followed a notice, the facts and circumstances relied on, the legal ground, that the content was found by a search for the details given and that a person took the decision, and how the User can contest it, including in court.
    • For a request under the GDPR, where the DPA applies to the User and the User says the content was processed for business use, the User is the controller (Section 2), answers the person within the time Article 12(3) GDPR allows, and tells the Administrator, by the later of the 25th day after the Administrator received the request and the 7th day after the Administrator's message to the User, that it has answered, extended the time limit or refused the request. The Administrator gives the User the person's contact details for that purpose where this is needed, as described above, gives the person the name and contact email of the User, or of the organisation it acts for, as the controller, and acts on the request only on the User's instruction under the DPA.
    • Where the User does not answer in time, the Administrator decides the request as controller and gives the person a copy of their own personal data found, with the information Article 15 GDPR requires about the processing in the App, or, where erasure is due, deletes the backed-up items, or the parts of them, that contain those details. Other content, and the User's identity, are withheld where Article 15(4) GDPR requires it. For an account in fact used for business use to which the DPA applies, the Administrator instead follows the User's standing instruction under the DPA (DPA, section 6, paragraph 3).
    • Where the User says the content was processed for business use but has, by the later of the 25th day after the Administrator received the request and the 7th day after the Administrator's message to the User, told the Administrator neither that it has answered the person nor that it has extended the time limit or refused the request under Article 12(3) or (4) GDPR, the Administrator gives the person the controller's name and contact email and a copy of their own personal data found, with information about the processing in the App only, leaving out content whose disclosure would adversely affect the rights and freedoms of others (Article 15(4) GDPR), on the User's standing instruction under the DPA.
    • Where the User says the content was processed for private use and gives reasons against the request, the Administrator decides the request as controller, taking those reasons into account.
    • Where the Administrator is the controller, it answers the person within one month of receiving the request; where needed because of the complexity or number of requests, it may extend this by two further months, telling the person within the first month, with the reasons (Article 12(3) GDPR). If it refuses the request, it gives the reasons and informs the person of their right to lodge a complaint with a supervisory authority, such as the President of the Office for Personal Data Protection (UODO) or the authority where they live or work, and to go to court. Records of approved actions may be kept where they are needed for legal claims (Article 17(3)(e) GDPR).
    • Deleting a chat removes its backed-up copy. A copy stays on the User's devices and is backed up again if the User changes the chat, turns chat backup back on or signs in on a device that still holds it. The Administrator therefore asks the User to delete the chat on their devices, and tells the person what was deleted and that a copy may remain on the User's devices.

8. What Rights Do You Have?

Every data subject has the right to:

  1. Access the data - to obtain confirmation from the Administrator as to whether their personal data is being processed. If data about a person is being processed, they are entitled to access them and to obtain the following information: about the purposes of the processing, the categories of personal data, information about the recipients or categories of recipients to whom the data has been or will be disclosed, the period of storage of the data or the criteria for determining it, the right to request rectification, deletion or restriction of the processing of personal data of the data subject, and to object to such processing (Article 15 GDPR),
  2. Obtain a copy of the data - to obtain a copy of the data undergoing processing, the first copy being free of charge and for subsequent copies, the controller may charge a reasonable fee based on administrative costs (Article 15(3) GDPR),
  3. Rectification - to request the rectification of personal data concerning them which is inaccurate or the completion of incomplete data (Article 16 GDPR),
  4. Deletion - to request the deletion of their personal data where the administrator no longer has a legal basis for processing them, the data are no longer necessary for the purposes of the processing, the data subject has withdrawn the consent on which the processing is based and there is no other legal basis for it, or the data subject has objected to the processing and there are no overriding legitimate grounds for it (Article 17 GDPR). Such a request does not affect the validity of the processing before the request,
  5. Restrict processing - to request the restriction of processing of personal data (Article 18 GDPR) when:
    • The data subject questions the accuracy of the personal data - for a period allowing the Administrator to verify the accuracy of the personal data,
    • The processing is unlawful and the data subject objects to the deletion of the data by requesting the restriction of the processing,
    • The Administrator no longer needs the data, but the data are needed by the data subject to establish, assert or defend a claim,
    • The data subject has objected to the processing - until it is established whether the legitimate grounds on the part of the controller override the grounds of the data subject's objection,
  6. Object - to object to the processing of their personal data for the legitimate purposes of the administrator on grounds related to their particular situation, including profiling. The Administrator shall then assess the existence of valid legitimate grounds for the processing that override the interests, rights, and freedoms of the data subjects or the grounds for establishing, asserting, or defending claims. If, according to the assessment, the interests of the data subject outweigh the interests of the administrator, the administrator will be obliged to cease processing for these purposes (Article 21 GDPR),
  7. Withdraw consent - at any time, without affecting the lawfulness of processing based on consent before its withdrawal (Article 7(3) GDPR). Consent to sharing conversations when rating a response can be withdrawn in the App's Options → Settings → Privacy; withdrawal stops the sharing of further conversations and comments and deletes those already shared. Consent to the backup of chats can be withdrawn by turning chat backup off in the App's Options → Settings → Backup & Sync; withdrawal stops the backup and deletes the backed-up chats (Section 7, item 2),
  8. Data portability - to receive the personal data they have provided to the Administrator, where it is processed by automated means on the basis of consent or of a contract, in a structured, commonly used and machine-readable format, and to have it transmitted to another controller (Article 20 GDPR).

The User can download their data with "Export my data" and request deletion with "Delete account" in the App's Options → Account. While a paid subscription is running, "Delete account" is unavailable: the User cancels the subscription and can use "Delete account" once the subscription has ended, or can ask the Administrator for erasure at any time. A request for erasure does not cancel the subscription: the account and billing data are deleted once the subscription has ended, and the User cancels it in the App's Options → Account → Manage; backed-up content is deleted within 30 days of the request, also while a subscription runs. Deletion is carried out within 30 days of the request or, while a paid subscription is running, of the end of the subscription, except billing and tax records, which the law requires the Administrator to keep for 5 years from the end of the calendar year in which the tax payment was due (Articles 70 and 86 of the Polish Tax Ordinance), usage statistics that cannot be linked to the User, and records kept under Section 5, items 6 and 7.

To exercise the aforementioned rights, the data subject should contact the Administrator using the provided contact details and inform them of which right and to what extent they wish to exercise it.

The data subject has the right to complain with the supervisory authority, which is the President of the Office for Personal Data Protection (2 Stawki Street, Warsaw) or any other competent authority if this results from generally applicable legislation.

9. Cookies

  1. Apart from the information contained in cookies, the Administrator automatically collects cookieless statistics on the Platform: without cookies and without any identifier, the website counts page views, clicks on the install button and clicks on the "Open BrowseWiz" button of the page shown after installing the App, recording the page address, the language version, the button position, the referring site's domain, campaign (UTM) tags and the browser type (e.g. Chrome desktop, mobile), and, when the User removes the App and picks a reason on the uninstall page, that reason with the App version, the App language and the install week, which the App adds to that page's address while "Usage analytics" is on, and, when a signed-in User saves an email choice there, only whether they turned the emails on or off. Only if the User accepts cookies in the cookie banner, campaign tags are kept in the browser's session storage until the browser tab is closed, and choosing Reject deletes them. These statistics are sent to PostHog and Mixpanel in the European Union. The IP address and the full user agent are neither stored nor passed on, and the statistics cannot be tied to a person. Statistics on the use of the App are described in Section 3, item 10.

  2. Cookies are IT data, in particular text files, which are stored on the User's terminal equipment and are intended for the use of the Platform's websites. Cookies usually contain the name of the website they come from, the time they are stored on the end device, and a unique number.

  3. The entities placing cookies on the User’s terminal equipment and accessing them are the Administrator and, only with consent given in the cookie banner, Google (Google Analytics, Google Ads, Google Tag Manager).

Cookies are used to:

  • Adapting the content of the Platform's websites to the User’s preferences and optimising the use of the websites; in particular, these files allow the Platform to recognise the User’s device and appropriately display the website, adapted to his/her individual needs,
  • Create statistics which help to understand how the Users use the websites, which makes it possible to improve their structure and content,
  • Maintain the User’s session.

The Platform uses the following types of cookies:

  • Session cookies and permanent cookies (persistent cookies). Session cookies are temporary files that are stored on the User’s terminal equipment until the User logs out, leaves the website, or switches off the software (web browser). Permanent cookies are stored on the User’s terminal equipment for the period specified in the parameters of the cookies or until they are deleted by the User,
  • Necessary cookies that enable the use of the services available on the Platform, such as authentication cookies used for services that require authentication on the Platform,
  • Security cookies, e.g., those used for detecting abusive authentication on the Platform,
  • Performance cookies, enabling the collection of information about the use of the Platform's websites,
  • Functional cookies, which make it possible to “remember” the settings selected by the User and to personalise the User’s interface; interface preferences such as the colour theme are kept in the browser's local storage,
  • Advertising cookies, which make it possible to provide the User with advertising content more tailored to their interests.

The Platform uses the following cookies:

  • bwsid - keeps the User signed in (7 days),
  • the sign-in security cookie - protects the sign-in process (10 minutes),
  • bw_consent - stores the User's cookie choice (182 days),
  • only with consent given in the cookie banner: Google's _ga* cookies (Google Analytics) and _gcl* cookies (Google Ads), on the basis of the User's consent (Article 6(1)(a) GDPR).

Consent can be withdrawn at any time through "Cookie settings" in the Platform's footer. Choosing Reject deletes Google's cookies.

Where a blog post embeds a YouTube video, YouTube (Google) may set its own cookies.

In many cases, the web browsing software (web browser) allows cookies to be stored on the User’s terminal device by default. Users can change their cookie settings at any time. These settings can be changed in particular in such a way as to block the automatic handling of cookies in the settings of the web browser or inform about their placement on the User's device each time. Detailed information on the possibility and methods of using cookies is available in the settings of your software (web browser).

The Administrator informs that restrictions on the use of cookies may affect certain functionalities available on the Platform.

10. What the App Sends to AI Providers

  1. To answer the User, the App sends the User's messages together with what is attached to them (page text, address and title, selected text, files, images and screenshots), the pages the browser agent reads, including the values of form fields (it leaves out the values of fields the page marks as password, one-time-code or payment-card fields, but a field the page doesn't mark that way is sent with its value), the names and sizes of the files the browser agent downloads, as part of the agent's tool results (the App sends them nowhere else), the text of the pages read to set up a page monitor or to find a tracked item again after a page's layout changed, and the results of the Google Sheets and Google Calendar tools, through the Administrator's server on Amazon Web Services (AWS) in the United States, to:

    • Anthropic (Claude Haiku), the main model of BrowseWiz Chat and of the browser agent, and Claude Sonnet, the main model of BrowseWiz Chat Pro, followed by Claude Haiku (when Claude Sonnet is unavailable, a BrowseWiz Chat Pro request goes on as a BrowseWiz Chat request),
    • OpenAI, for chat titles (the first message of a chat), voice input (the recording) and read aloud (the text),
    • OpenRouter, when Anthropic is unavailable (for Claude Haiku, which OpenRouter passes on only to Amazon Bedrock, Amazon Web Services' AI model service) or for the model the User chose; OpenRouter passes the request on to the company hosting that model; OpenRouter requests use OpenRouter's setting that excludes providers which, according to OpenRouter, keep the data they receive after answering or use it for training.

    Where the User chose earlier a model that the Administrator's server sends directly to its provider (OpenAI, Anthropic or Google), the request goes to that provider.

  2. Scheduled tasks and page monitors read pages in the User's browser, including pages where the User is signed in, and send them as described in item 1 without the User being present.

  3. Before the browser agent acts, a safety check sends the User's request, the agent's plan, the page address and title, the text to be typed, the tool arguments and the earlier messages of the same task through OpenRouter to TypeSafe. When a scheduled task run ends with a final answer, the App also sends the run's request, the tools it called with their results (shortened) and its final answer through OpenRouter to TypeSafe, to judge whether the run did its task, and, for a task with "Only notify when something's new" on, the previous run's final answer, to judge whether the run found anything new. These requests use OpenRouter's setting that excludes providers which, according to OpenRouter, keep the data they receive after answering or use it for training.

  4. The account identifier is sent to OpenAI and OpenRouter to prevent abuse.

  5. Requests to Anthropic (Claude) are sent under Anthropic's commercial terms and are not used for training; Anthropic deletes them within 30 days, unless it needs them longer to enforce its usage policy (up to 2 years for requests its safety systems flag) or the law requires it. Requests to a Google (Gemini) model the User chose earlier are sent under the paid Gemini API terms; Google keeps them for up to 55 days to detect misuse, as its Gemini API usage policies state. Chat titles and replies of OpenAI models are requested from OpenAI with storage of the request switched off; requests to OpenAI may still be kept by OpenAI for up to 30 days to detect misuse, and they are not used for training.

  6. BYOK models (using the User's own API key), custom models, custom tools and MCP servers receive data directly from the User's browser, under the User's agreement with that provider; the browser agent, scheduled tasks and page monitors do not use them. With a saved OpenAI key, voice input and read aloud also go directly to OpenAI.

11. Google User Data

  1. The Google Sheets and Google Calendar tools ask Google only for the drive.file permission (spreadsheets the App created or the User opened with it) and the calendar.app.created permission (calendars the App created), when the User switches them on.
  2. Calls these tools make to Google run from the User's browser, and access tokens for these tools stay in the User's browser.
  3. Data received from Google is sent to AI providers as part of the conversation (Section 10) and saved in the chat and its backup (Section 7). The results of the Google Sheets and Google Calendar tools are never included in conversations shared with a response rating (Section 4, item 4).
  4. Data received from Google is not sold and not used for advertising. BrowseWiz does not use it to develop, improve or train generalised AI or machine-learning models.
  5. BrowseWiz's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
  6. The User can revoke the App's access at any time in their Google Account settings.