Data processing agreement

Last updated: 18 September 2026.

This agreement forms part of the terms & conditions when Kalebtec Studio S.C. processes personal data on your behalf through Browxai Cloud. You are the controller, or a processor authorised by your controller. Kalebtec is your processor or subprocessor for that processing.

Kalebtec separately acts as controller for its own account, billing, security, and support processing, described in the privacy policy.

1. Scope and instructions

The subject matter is transmission of browser-tool requests and results between your chosen AI client and your paired host, with the routing metadata necessary to operate that connection. Processing lasts for your service use and any necessary return or deletion period.

Operations comprise receiving, temporarily handling, routing and transmitting payloads, and storing necessary service metadata. Payloads are not persisted or logged. Data subjects and personal-data categories depend on the sites and tools you authorise; they may include your users, staff, customers, and website visitors, with identifiers, communications, or other information contained in requested results.

You determine what your browser and AI client may access. Do not instruct us to process special-category or criminal-offence data without first agreeing appropriate arrangements in writing.

Your configuration and authorised requests are your documented instructions. We process data only on those instructions, including for transfers, unless law requires otherwise. We notify you of a legal requirement before processing unless prohibited, and tell you if we believe an instruction infringes applicable data-protection law.

2. Your responsibilities

You establish a lawful basis, provide required notices, and obtain any required permissions. Authorise only the people and clients entitled to access the relevant data. Your relationship with your chosen AI provider is your responsibility; its receipt of requested results is part of your instructions.

Where you are a processor, you confirm your controller has authorised this arrangement.

3. Confidentiality and security

We restrict access to authorised people who are bound by confidentiality. We implement measures appropriate to the risks under GDPR Article 32, including:

• Encrypted network transport and workspace-scoped authorisation.
• Credential validation, expiry and revocation mechanisms.
• Restricted operator access and metadata-only operational logging.
• No browser-payload archive, screenshots, or content-bearing diagnostics.
• Service monitoring and controls against unauthorised requests.

We provide further information needed to assess these measures privately to customers, subject to appropriate confidentiality. You secure your hosts, browser profiles, account access, and AI-client settings.

4. Subprocessors and transfers

Before processing on your behalf, we provide the current subprocessor list and obtain your written specific or general authorisation. The public service-provider information describes recipient categories; it is not a substitute for that authorisation. We impose applicable data-protection obligations on subprocessors and remain responsible for their performance as required by GDPR Article 28.

We will notify you of an intended new or replacement subprocessor at least 30 days before it begins processing your data. You may object on reasonable data-protection grounds during that period. We will seek a workable alternative; if none is available, you may end the affected service without penalty and receive a refund of any unused prepaid period.

Transfers outside the EEA require a lawful transfer mechanism. We provide information about the applicable safeguards on request. Your general authorisation does not waive those requirements.

5. Assistance and incidents

Taking account of the processing and information available to us, we assist with data-subject requests, security obligations, breach notifications, impact assessments, and prior consultation. If we receive a request about data we process for you, we notify you unless prohibited and do not answer substantively without your instructions, except as required by law.

We notify you without undue delay after becoming aware of a personal-data breach affecting data we process for you. We provide available information about its nature, likely consequences, response, and a contact point, with updates as facts become available. This does not replace your responsibility to assess notification to an authority or affected people.

6. Return and deletion

At the end of processing, we delete or return personal data at your choice and delete existing copies unless law requires storage. We explain any required retention and restrict further processing.

Browser payloads are not retained, so we cannot export past browser sessions or tool results. Send requests for return or deletion of retained metadata to hello@kalebtec.com. We coordinate any residual provider backup handling and communicate the applicable deletion timetable.

7. Information and audits

We provide information necessary to demonstrate compliance with this agreement and allow and contribute to audits, including inspections by you or an auditor you mandate. Agree reasonable arrangements to protect other customers' information and service security. Those arrangements do not remove your Article 28 audit rights or a supervisory authority's powers.

Contact hello@kalebtec.com for instructions, incidents, assistance, or an audit request. The legal notice gives our postal address. This agreement prevails over conflicting service terms on processing undertaken on your behalf.