BrowseWiz Logo
Get started

PRIVACY POLICY OF BROWSEWIZ PLATFORM AND APP

Effective date: 22 October 2026

1. Initial Provisions

The Privacy Policy sets out the principles for processing the personal data of users of the online platform https://browsewiz.com/ (hereinafter referred to as the Platform) and Browsewiz App (hereinafter referred to as the App).

Detailed rules for the use of the Platform and the App can be found in the Terms of Use of the BrowseWiz Platform and App.

A User of the Platform is any person using its functionality, i.e., natural persons acting on behalf of themselves or other entities (legal persons or other organisational units).

Personal data is processed in accordance with the General Data Protection Regulation of 27th April 2016 (Official Journal of the EU L 119 of 04.05.2016) (hereinafter referred to as GDPR), regardless of the User's place of residence.

The Administrator informs that chat histories stored by the User as part of the App are used only to provide the App's functions to the User: keeping, showing and restoring them, and generating AI answers and chat titles (see Section 10). No person reads their content. The exceptions are conversations and comments that the User chooses to share when rating a response (see Section 3, item 6), which are read by persons authorised by the Administrator (the BrowseWiz team) in order to improve the quality of responses, and conversations the User asks the Administrator to read. Persons authorised by the Administrator may also read chat histories where this is needed to investigate a specific security incident or breach of the Terms, or where the law requires it.

2. Who Processes Your Data?

The administrator of your data is Tomasz Posłuszny, conducting business activity as DevPeer Tomasz Posłuszny, Kłobucka 8B/249, 02-699 Warsaw, Poland.
Tax number: 5213730587,
Email: contact@browsewiz.com

3. For What Purpose and on What Basis Is Your Data Processed?

Your personal data is processed for one or more of the purposes indicated below:

  1. To enable you to use the Platform and its functionalities - i.e., to provide a service in accordance with your expectations (Article 6(1)(b) GDPR),
  2. To answer messages the User sends via the contact form - to take steps at the User's request before entering into a contract or to perform it (Article 6(1)(b) GDPR) and, for other enquiries, on the basis of the Administrator's legitimate interest in answering them (Article 6(1)(f) GDPR); feedback the User sends from the page shown after the App is removed (the uninstall page) is processed to answer it and to improve the App, on the basis of the Administrator's legitimate interest (Article 6(1)(f) GDPR),
  3. To enable you to use the App, i.e., to provide a service in accordance with your expectations (Article 6(1)(b) GDPR), to fulfil the Administrator's legal obligations (Article 6(1)(c) GDPR),
  4. To handle the purchase and billing of subscriptions - i.e., to provide a service in accordance with your expectations (Article 6(1)(b) GDPR), to fulfil the Administrator's legal obligations, such as the fulfilment of tax obligations (Article 6(1)(c) GDPR),
  5. To send the User optional emails about product updates, new features, tips and offers - based on the User's consent (Art. 6(1)(a) GDPR), which the User can turn on or off at any time in the App's Options → Settings → Email updates,
  6. To improve the quality of responses in the App - i.e., as regards response ratings and their metadata, on the basis of the Administrator's legitimate interest in improving the App (Article 6(1)(f) GDPR), and as regards conversations and comments shared with a rating, on the basis of the User's consent (Article 6(1)(a) GDPR), which the User may withdraw at any time in the App's Options → Settings → Privacy; personal data of third parties contained in shared conversations is processed on the basis of the Administrator's legitimate interest in improving the App (Article 6(1)(f) GDPR),
  7. To answer the User with AI models and to carry out the tasks the User asks for (chat, the browser agent, scheduled tasks, page monitors, the Google Sheets and Google Calendar tools, voice input, read aloud and chat titles), as described in Section 10 - on the basis of the performance of the contract for the provision of the App (Article 6(1)(b) GDPR); personal data of third parties contained in the content the User has the App process is processed on the basis of the Administrator's legitimate interest in providing the App's functions to the User (Article 6(1)(f) GDPR),
  8. To safety-check the browser agent's actions and to keep a record of the actions the User approved - a record of what the agent did, on which page and when, and that the User approved it, kept to establish or defend legal claims - on the basis of the Administrator's legitimate interest (Article 6(1)(f) GDPR). The User may object to this processing (Section 8, item 6); records may still be kept where they are needed to establish, assert or defend legal claims,
  9. To apply plan limits, meter credit usage, prevent abuse of the App and investigate a specific security incident or breach of the Terms, including by reading chat content as described in Section 1 - on the basis of the Administrator's legitimate interest (Article 6(1)(f) GDPR), and where the law requires disclosure, to fulfil the Administrator's legal obligation (Article 6(1)(c) GDPR),
  10. To collect statistics on how the App is used - pseudonymously by default (with a random identifier that changes daily), on the basis of the Administrator's legitimate interest in improving the App (Article 6(1)(f) GDPR), to which the User may object by turning off "Usage analytics" in the App's Options → Settings → Privacy; linked to the User's account only with the User's consent, given by turning on "Link usage statistics to my account" (Article 6(1)(a) GDPR). The last day the account was active is also recorded, to measure how many Users keep using the App.

The Administrator does not make decisions based solely on automated processing, including profiling, that produce legal effects concerning the User or similarly significantly affect them (Article 22 GDPR).

4. What Data Do We Process?

The Administrator processes the following personal data:

  1. The User's email address,
  2. The User's first and last name, if voluntarily provided by the User when creating an account or received from Google when the User signs in with a Google account,
  3. Other personal data voluntarily provided by the User as part of the contact form, together with the account identifier of a signed-in User and any file attached to the message, and the comment and optional email address the User sends from the uninstall page, together with the chosen reason, the App version, the App language and the install week,
  4. Where the User rates a response in the App: the rating (positive or negative), the identifier of the model that produced the response and the chat mode, the position of the response in the conversation, the time of the rating and of its last change, and the identifier of the User's account; and, only with the User's consent, the text of the conversation up to and including the rated response (the User's messages, the replies, tool calls and their results, and page addresses without their query string or fragment), any comment added by the User, and the record of that consent (its wording and the time it was given). Shared conversations may contain personal data of third parties, in particular text from web pages read by the assistant. Pages and files attached to a message, screenshots, images and the results of the Google Sheets and Google Calendar tools are never included, but page text that the assistant read with a tool can be,
  5. Account and usage data: the account identifier, the sign-up date, the plan, credit usage and limits, the last day the account was active, the User's settings and consent records, and the time of a request to delete the account,
  6. Billing data: the Stripe customer identifier, the plan and the billing period. Payment details are handled by Stripe,
  7. Content the User has the App process: messages; pages, files, images and screenshots attached to them; text the browser agent reads or types on pages; Google Sheets and Google Calendar data the tools read or write; voice recordings and text read aloud. This content may include personal data of third parties,
  8. Records of browser-agent actions approved by the User: the account identifier, the approval type, the time, the domain and the plan identifier; each approved action as the approval card described it, including typed text (leaving out values typed into fields the page marks as password, one-time-code or payment-card fields) and the names of page elements; and the page address without its query string. These records may include personal data of the User and of people shown on the page. They are stored on Amazon Web Services (AWS) servers in the United States and are not sent to AI providers or used for any other purpose,
  9. App usage statistics: the features used, the App version, the browser and operating system, and a random identifier that changes daily; only with the User's consent, also the account identifier and an installation identifier. They never include chat text, page addresses or page titles.

Providing the email address is necessary to create an account and use the App; providing other data is voluntary.

5. For How Long Do We Process Your Data?

  1. Personal data shall be processed for the duration of the performance on behalf of the User of the activities for which the data were provided and for the period of limitation of claims arising from the performance of the specified activities. After the account is deleted, data is kept only as described in Section 8.
  2. In the case of personal data provided solely on the basis of the User's consent (with no other basis for processing), the personal data are processed until the consent is withdrawn, but for no longer than 10 years.
  3. By way of derogation from items 1 and 2, response ratings, together with any conversations and comments shared with them, are deleted automatically 12 months after their last change, or earlier upon deletion of the User's account or at the User's request; conversations and comments already shared are also deleted when the User withdraws consent to sharing them. Automatic deletion may take a few days after that date.
  4. Records of approved browser-agent actions (Section 4, item 8) are deleted automatically 90 days after they are made.
  5. Server logs (the account identifier, the requested address and the time, and in the web server's access log also the IP address and the browser's user agent) are kept for up to 30 days for security and troubleshooting.
  6. If you raise a complaint or claim, we keep the records relevant to it until it is resolved.

6. To Whom Do We Share Your Data?

  1. Your personal data may be passed to third parties directly involved in the maintenance of the Platform or in the performance of contracts or other activities on your behalf, such as law firms, accounting and tax offices, IT service providers (including hosting), permanent collaborators - with each time the Administrator guarantees that personal data will be processed only for the purpose specified in this Policy.
  2. Response ratings, together with any conversations and comments shared with them, are stored on servers in the United States operated by the Administrator's hosting provider, Amazon Web Services (AWS), acting as a processor. This involves a transfer of personal data outside the European Economic Area, which is based on the European Commission's adequacy decision for the EU–US Data Privacy Framework, under which Amazon Web Services, Inc. is certified (Article 45 GDPR), and, where that decision does not apply, on the standard contractual clauses adopted by the European Commission and included in the data processing addendum concluded with AWS (Article 46(2)(c) GDPR), a copy of which can be obtained from the Administrator. For Users in the United Kingdom and Switzerland, the transfer is based on the UK Extension to the EU–US Data Privacy Framework and the Swiss–US Data Privacy Framework, under which Amazon Web Services, Inc. is also certified. For Users in other countries, the consent to sharing conversations, given in a dialog that says they are stored in the United States, also covers their transfer there. Ratings, shared conversations and comments are not passed to AI model providers for training their models.
  3. If you connect Claude Code or another local MCP client program to the BrowseWiz extension, BrowseWiz gives that program, on your computer, the Google Sheets and Google Calendar data and the tool results it asks for through the Spreadsheet and Calendar tools you have switched on. While the browser agent is switched on, BrowseWiz also gives that program the URLs and titles of the tabs in the BrowseWiz Tabs groups, and, for the browser tasks it hands to BrowseWiz, the web page content the browser agent reads and the agent's reports. The browser agent itself runs as it does in BrowseWiz chat, through BrowseWiz's servers and AI providers. What that program does with this data, including sending it to its AI provider, is governed by your agreement with that program's provider, not by BrowseWiz.
  4. The recipients of personal data and their roles are:
    • Amazon Web Services (AWS): hosting, databases, sign-in (Amazon Cognito) and delivery of contact-form emails and of email alerts about scheduled tasks and page monitors (Amazon SES), in the United States,
    • the AI providers listed in Section 10,
    • Stripe: payments,
    • Mixpanel and PostHog, hosted in the European Union: statistics,
    • Google Analytics, Google Ads and Google Tag Manager on the Platform, only with the User's consent,
    • the Google APIs used for the User (Section 11).
  5. The grounds for the transfer of personal data outside the European Economic Area set out in item 2 also apply to the data stored on AWS and to the recipients listed in item 4: the EU–US Data Privacy Framework where the entity receiving the data is certified under it, and otherwise the standard contractual clauses adopted by the European Commission (Decision (EU) 2021/914), included in the recipient's data processing terms; where the recipient passes the data on to its affiliate or sub-processor (for example a model provider reached through OpenRouter), it binds that entity by written contract to the same data-protection obligations, as Article 28(4) GDPR and, where they apply, those clauses require. Where a recipient contracts with the Administrator through its entity in the European Economic Area (as OpenAI and Anthropic do), that entity transfers the data to its affiliates outside the European Economic Area on the same grounds.

7. Backup of Chats, Prompts, Scheduled Tasks, Monitors, Settings, Custom Models, Tools and MCP Servers

  1. While backup is on, the App stores the User's chats (including the page and file contents read or attached in them, and the results of scheduled task runs and monitor matches saved in the chat history), the custom prompts created by the User, the User's scheduled tasks (each task's plan, schedule and last result, and the name and a random identifier of the browser that runs it, such as "Chrome on Windows"), the User's monitors (each monitor's page URL, name and criterion, the labels and page selectors of the items it tracks, the headline and time of its latest match, and the name and a random identifier of the browser that checks it), the User's settings (such as the colour theme, the language, the selected model, the built-in tool switches and their settings), custom models (each model's name, endpoint URL and non-secret request headers), custom tools (each tool's name, endpoint URL, method, schema and non-secret request headers) and MCP servers (each server's URL, name and version) in the Administrator's cloud storage, so that the User can restore them on any device by signing in. Backup is on by default and can be turned off separately for chats and for everything else in the App's Options → Settings → Backup & Sync. API keys, the values of request headers marked as secret and MCP server authorization headers are never uploaded: they stay only on the device where the User entered them and must be entered again on another device.
  2. The legal basis for this processing is the performance of the contract for the provision of the App (Article 6(1)(b) GDPR). Personal data of third parties contained in backed-up chats is processed on the basis of the Administrator's legitimate interest in providing the backup to the User (Article 6(1)(f) GDPR).
  3. Chats, prompts, scheduled tasks, monitors, settings, custom models, tools and MCP servers are stored on servers in the United States operated by the Administrator's hosting provider, Amazon Web Services (AWS), acting as a processor. The transfer of personal data outside the European Economic Area is based on the same grounds as for response ratings (Section 6, item 2).
  4. Backed-up chats, prompts, scheduled tasks, monitors, settings, custom models, tools and MCP servers are kept until the User deletes the item, turns backup off (which deletes the backed-up copies of that kind) or deletes the account. When the User deletes a prompt, a scheduled task, a monitor, a custom model, a custom tool or an MCP server, a record of its identifier and deletion time is kept for 90 days, so that another device cannot bring the item back. Only the User's 100 most recent chats are kept in the backup.

8. What Rights Do You Have?

Every data subject has the right to:

  1. Access the data - to obtain confirmation from the Administrator as to whether their personal data is being processed. If data about a person is being processed, they are entitled to access them and to obtain the following information: about the purposes of the processing, the categories of personal data, information about the recipients or categories of recipients to whom the data has been or will be disclosed, the period of storage of the data or the criteria for determining it, the right to request rectification, deletion or restriction of the processing of personal data of the data subject, and to object to such processing (Article 15 GDPR),
  2. Obtain a copy of the data - to obtain a copy of the data undergoing processing, the first copy being free of charge and for subsequent copies, the controller may charge a reasonable fee based on administrative costs (Article 15(3) GDPR),
  3. Rectification - to request the rectification of personal data concerning them which is inaccurate or the completion of incomplete data (Article 16 GDPR),
  4. Deletion - to request the deletion of their personal data where the administrator no longer has a legal basis for processing them, the data are no longer necessary for the purposes of the processing, the data subject has withdrawn the consent on which the processing is based and there is no other legal basis for it, or the data subject has objected to the processing and there are no overriding legitimate grounds for it (Article 17 GDPR). Such a request does not affect the validity of the processing before the request,
  5. Restrict processing - to request the restriction of processing of personal data (Article 18 GDPR) when:
    • The data subject questions the accuracy of the personal data - for a period allowing the Administrator to verify the accuracy of the personal data,
    • The processing is unlawful and the data subject objects to the deletion of the data by requesting the restriction of the processing,
    • The Administrator no longer needs the data, but the data are needed by the data subject to establish, assert or defend a claim,
    • The data subject has objected to the processing - until it is established whether the legitimate grounds on the part of the controller override the grounds of the data subject's objection,
  6. Object - to object to the processing of their personal data for the legitimate purposes of the administrator on grounds related to their particular situation, including profiling. The Administrator shall then assess the existence of valid legitimate grounds for the processing that override the interests, rights, and freedoms of the data subjects or the grounds for establishing, asserting, or defending claims. If, according to the assessment, the interests of the data subject outweigh the interests of the administrator, the administrator will be obliged to cease processing for these purposes (Article 21 GDPR),
  7. Withdraw consent - at any time, without affecting the lawfulness of processing based on consent before its withdrawal (Article 7(3) GDPR). Consent to sharing conversations when rating a response can be withdrawn in the App's Options → Settings → Privacy; withdrawal stops the sharing of further conversations and comments and deletes those already shared,
  8. Data portability - to receive the personal data they have provided to the Administrator, where it is processed by automated means on the basis of consent or of a contract, in a structured, commonly used and machine-readable format, and to have it transmitted to another controller (Article 20 GDPR).

The User can download their data with "Export my data" and request deletion with "Delete account" in the App's Options → Account. While a paid subscription is running, "Delete account" is unavailable: the User cancels the subscription and can use "Delete account" once the subscription has ended, or can ask the Administrator for erasure at any time. A request for erasure does not cancel the subscription: the data is deleted once the subscription has ended, and the User cancels it in the App's Options → Account → Manage. Deletion is carried out within 30 days of the request or, while a paid subscription is running, of the end of the subscription, except billing and tax records, which the law requires the Administrator to keep for 5 years from the end of the calendar year in which the tax payment was due (Articles 70 and 86 of the Polish Tax Ordinance), usage statistics that cannot be linked to the User, and records kept under Section 5, item 6.

To exercise the aforementioned rights, the data subject should contact the Administrator using the provided contact details and inform them of which right and to what extent they wish to exercise it.

The data subject has the right to complain with the supervisory authority, which is the President of the Office for Personal Data Protection (2 Stawki Street, Warsaw) or any other competent authority if this results from generally applicable legislation.

9. Cookies

  1. Apart from the information contained in cookies, the Administrator automatically collects cookieless statistics on the Platform: without cookies and without any identifier, the website counts page views and clicks on the install button, recording the page address, the language version, the button position, the referring site's domain, campaign (UTM) tags and the browser type (e.g. Chrome desktop, mobile), and, when the User removes the App and picks a reason on the uninstall page, that reason with the App version, the App language and the install week, which the App adds to that page's address while "Usage analytics" is on. Campaign tags are kept in the browser's session storage until the browser tab is closed. These statistics are sent to PostHog and Mixpanel in the European Union. The IP address and the full user agent are neither stored nor passed on, and the statistics cannot be tied to a person. Statistics on the use of the App are described in Section 3, item 10.

  2. Cookies are IT data, in particular text files, which are stored on the User's terminal equipment and are intended for the use of the Platform's websites. Cookies usually contain the name of the website they come from, the time they are stored on the end device, and a unique number.

  3. The entities placing cookies on the User’s terminal equipment and accessing them are the Administrator and, only with consent given in the cookie banner, Google (Google Analytics, Google Ads, Google Tag Manager).

Cookies are used to:

  • Adapting the content of the Platform's websites to the User’s preferences and optimising the use of the websites; in particular, these files allow the Platform to recognise the User’s device and appropriately display the website, adapted to his/her individual needs,
  • Create statistics which help to understand how the Users use the websites, which makes it possible to improve their structure and content,
  • Maintain the User’s session.

The Platform uses the following types of cookies:

  • Session cookies and permanent cookies (persistent cookies). Session cookies are temporary files that are stored on the User’s terminal equipment until the User logs out, leaves the website, or switches off the software (web browser). Permanent cookies are stored on the User’s terminal equipment for the period specified in the parameters of the cookies or until they are deleted by the User,
  • Necessary cookies that enable the use of the services available on the Platform, such as authentication cookies used for services that require authentication on the Platform,
  • Security cookies, e.g., those used for detecting abusive authentication on the Platform,
  • Performance cookies, enabling the collection of information about the use of the Platform's websites,
  • Functional cookies, which make it possible to “remember” the settings selected by the User and to personalise the User’s interface; interface preferences such as the colour theme are kept in the browser's local storage,
  • Advertising cookies, which make it possible to provide the User with advertising content more tailored to their interests.

The Platform uses the following cookies:

  • bwsid - keeps the User signed in (7 days),
  • the sign-in security cookie - protects the sign-in process (10 minutes),
  • bw_consent - stores the User's cookie choice (182 days),
  • only with consent given in the cookie banner: Google's _ga* cookies (Google Analytics) and _gcl* cookies (Google Ads), on the basis of the User's consent (Article 6(1)(a) GDPR).

Consent can be withdrawn at any time through "Cookie settings" in the Platform's footer. Choosing Reject deletes Google's cookies.

Where a blog post embeds a YouTube video, YouTube (Google) may set its own cookies.

In many cases, the web browsing software (web browser) allows cookies to be stored on the User’s terminal device by default. Users can change their cookie settings at any time. These settings can be changed in particular in such a way as to block the automatic handling of cookies in the settings of the web browser or inform about their placement on the User's device each time. Detailed information on the possibility and methods of using cookies is available in the settings of your software (web browser).

The Administrator informs that restrictions on the use of cookies may affect certain functionalities available on the Platform.

10. What the App Sends to AI Providers

  1. To answer the User, the App sends the User's messages together with what is attached to them (page text, address and title, selected text, files, images and screenshots), the pages the browser agent reads, including the values of form fields (it leaves out the values of fields the page marks as password, one-time-code or payment-card fields, but a field the page doesn't mark that way is sent with its value), the text of the pages read to set up a page monitor, and the results of the Google Sheets and Google Calendar tools, through the Administrator's server on Amazon Web Services (AWS) in the United States, to:

    • Google (Gemini), the main model,
    • OpenRouter, when Gemini is unavailable or for the model the User chose; OpenRouter passes the request on to the company hosting that model; OpenRouter requests use OpenRouter's setting that excludes providers which, according to OpenRouter, keep the data they receive after answering or use it for training,
    • OpenAI, for chat titles (the first message of a chat), voice input (the recording) and read aloud (the text).

    Where the User chose earlier a model that the Administrator's server sends directly to its provider (OpenAI or Anthropic), the request goes to that provider.

  2. Scheduled tasks and page monitors read pages in the User's browser, including pages where the User is signed in, and send them as described in item 1 without the User being present.

  3. Before the browser agent acts, a safety check sends the User's request, the agent's plan, the page address and title, the text to be typed, the tool arguments and the earlier messages of the same task through OpenRouter to TypeSafe. These requests use OpenRouter's setting that excludes providers which, according to OpenRouter, keep the data they receive after answering or use it for training.

  4. The account identifier is sent to OpenAI and OpenRouter to prevent abuse.

  5. Requests to Google (Gemini) are sent under the paid Gemini API terms and are not used to improve Google's products; Google keeps them for a limited time to detect misuse. Chat titles and replies of OpenAI models are requested from OpenAI with storage of the request switched off; requests to OpenAI may still be kept by OpenAI for up to 30 days to detect misuse, and they are not used for training.

  6. BYOK models (using the User's own API key), custom models, custom tools and MCP servers receive data directly from the User's browser, under the User's agreement with that provider; the browser agent, scheduled tasks and page monitors do not use them. With a saved OpenAI key, voice input and read aloud also go directly to OpenAI.

11. Google User Data

  1. The Google Sheets and Google Calendar tools ask Google only for the drive.file permission (spreadsheets the App created or the User opened with it) and the calendar.app.created permission (calendars the App created), when the User switches them on.
  2. Calls these tools make to Google run from the User's browser, and access tokens for these tools stay in the User's browser.
  3. Data received from Google is sent to AI providers as part of the conversation (Section 10) and saved in the chat and its backup (Section 7). The results of the Google Sheets and Google Calendar tools are never included in conversations shared with a response rating (Section 4, item 4).
  4. Data received from Google is not sold and not used for advertising. BrowseWiz does not use it to develop, improve or train generalised AI or machine-learning models.
  5. BrowseWiz's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
  6. The User can revoke the App's access at any time in their Google Account settings.