Privacy policy
Last updated: 5 October 2026.
Browxai Cloud relays browser-tool requests between an AI client and a computer you control. This policy covers the Browxai Cloud website, workspace, relay service, and connector.
1. Who is responsible
Kalebtec Studio S.C., a Spanish sociedad civil, is responsible for account, service, billing, and support data. Our CIF is J26989384 and our registered address is Avenida do Alcalde Portanet 20, 4º J, 36210 Vigo (Pontevedra), Spain.
For privacy questions or rights requests, contact hello@kalebtec.com. You may also write to that postal address or call +34 686 130 103.
Where we relay personal data on your instructions for your organisation, we act as a processor. The data processing agreement covers that relationship.
2. Browser content and the relay
Browser execution and profiles remain on your hardware. Tool requests and results travel through our relay to your chosen AI client. The relay temporarily handles those bytes in memory and reads protocol metadata needed to route them.
We do not persist or log browser content. This includes tool arguments and outputs, screenshots, page text, DOM content, captured network bodies, local file contents and paths, and credentials belonging to sites in your browser. There is no content-recording diagnostic mode.
Connections use encryption in transit. This is transport encryption, not a promise that the relay cannot access bytes while forwarding them. Your AI provider receives the results you request and may retain or otherwise process them under its own policy. Decide which client to connect and what it may access before use.
3. Data we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| Email address and account identifiers; passkey public credentials | Account creation, sign-in, and account security | Contract or pre-contractual steps, GDPR Article 6(1)(b); legitimate interests in security, Article 6(1)(f) |
| Workspace membership, roles, names, host labels, connector records and credential digests | Authorisation, routing, and workspace administration | Article 6(1)(b) |
| Connection state, timestamps, usage totals, operational metrics and audit events | Running the service, enforcing limits, investigating faults and abuse | Article 6(1)(b) and Article 6(1)(f) |
| Order record: the plan, price and taxes shown to you, the terms version, the time you ordered, whether you asked for the service to start straight away, and any withdrawal or cancellation | Concluding the contract, proving what was shown and agreed, handling withdrawals, cancellations and refunds | Article 6(1)(b); legal obligations under consumer and commercial law, Article 6(1)(c) |
| Billing name, billing address, country and any VAT number you give at checkout, collected by Stripe | Charging you, working out VAT for your country, and issuing invoices | Article 6(1)(b); tax obligations, Article 6(1)(c) |
| Renewal reminders and order emails sent to your account email | Telling you before a yearly plan renews, confirming orders, withdrawals and cancellations | Article 6(1)(b) and (c) |
| Details you give on the public "Cancel contracts here" page: your name, email, the contract, the reason if you cancel for cause, and when it should take effect | Receiving and confirming your cancellation, and finding the contract it belongs to | Article 6(1)(b) and (c) |
| Support correspondence | Answering requests and resolving problems | Article 6(1)(b); Article 6(1)(f) for general enquiries |
| Billing contact and subscription references, if you purchase a paid service | Billing and accounting | Article 6(1)(b); legal obligations, Article 6(1)(c) |
| Your account declaration: full name, account type, company for a business account, and the country (and, in Ukraine, the region) you say you are in | Checking EU sanctions lists and the countries where the service is not offered | Legal obligations under EU sanctions regulations that apply directly, such as Regulation (EU) 269/2014 Article 2(2) and Regulation (EU) 833/2014, Article 6(1)(c) |
| Your declared date of birth | Telling you apart from a listed person with the same name, so a match is reviewed faster and fewer accounts are held by mistake; and refusing sign-ups from anyone under 18. We do not verify it | Our legitimate interests in accurate, quick sanctions reviews and in offering the service only to adults, Article 6(1)(f). Contact us for our assessment of those interests |
| Network metadata processed by hosting and transport providers, such as IP addresses and request timing | Delivering and securing network connections | Article 6(1)(f) |
We obtain information from you, your workspace administrators, your connected software, and the providers involved in sign-in, networking, and payment. Providing account and routing information is necessary to operate your connection. The beta form's use-case field is optional. Do not send sensitive information, credentials, or browser content in labels, forms, or support messages.
Passkeys disclose public credential material to us, not your private key, fingerprint, or face data. Our payment provider handles payment card details where paid billing is enabled; we do not store full card numbers.
We do not sell personal data, build advertising profiles, or use relay content to train AI models. A beta request is not consent to marketing. We do not make solely automated decisions producing legal or similarly significant effects about you; technical limits can refuse requests to protect the service.
4. Who receives data and where
Workspace members see the metadata their role permits. Authorised Kalebtec personnel may access service metadata for support and operations.
Our service-provider list identifies the hosting, database, networking, email, and payment providers. Some providers process data outside the European Economic Area, including in the United States.
Transfers outside the EEA require an applicable adequacy decision or appropriate safeguards, such as the European Commission's Standard Contractual Clauses. Contact us for the safeguards applying to a particular provider and processing activity.
We may disclose data to comply with a lawful obligation or defend legal claims. Professional advisers receive only information needed for their work. Your chosen AI platform and websites you visit have separate responsibilities and policies.
5. Retention and deletion
Browser payloads are held only for in-flight forwarding and are not written to an archive or diagnostic log. There is no stored browser-content history to retrieve.
Account and workspace records remain while needed to provide access and manage the workspace. On account closure, we review them for deletion or anonymisation, retaining only what is needed for outstanding obligations, security incidents, or legal claims. Contact us to request account closure or deletion.
Authentication records have validity limits and revocation rules. Expiry stops their use; it does not necessarily mean immediate physical deletion. The cookie lifetimes are listed in the cookie policy.
We keep beta enquiries and support correspondence for as long as needed to answer the request and handle related follow-up. Requests to erase them are handled under section 6. Beta contact details and client/device choices may also be held in operational records used to receive and follow up enquiries. These records are included when we assess retention and erasure requests.
Your account declaration, including your date of birth, is kept while your account exists. If a sanctions check matches your name, a person reviews the match; the review case keeps a copy of your declaration for five years after it is decided, as evidence of the check. We also keep a record of each refused action and each sanctions match, tied to your workspace, for five years. On a match, the record holds the name on the list entry, which can be the same as your name. These records never contain your date of birth.
Order records are kept for six years after the order, as the Spanish Commercial Code (Código de Comercio, Article 30) requires for commercial records. Cancellation requests made on the public page are kept for three years, or 90 days if they don't match any account.
Federated sign-in link, unlink and sign-in audit events are kept for five years.
Usage, billing and audit records are retained only while needed for service administration, accounting, security, or legal claims. Applicable statutory accounting retention takes priority over an erasure request. Provider log and backup lifetimes depend on the configured service; a data export or erasure response will identify any applicable residual retention. We do not promise instant deletion from provider backups.
6. Your rights
You may request access, correction, erasure, restriction, portability, and objection where the GDPR provides them. You may withdraw consent for any consent-based processing without affecting earlier lawful processing.
Email hello@kalebtec.com. We may ask for proportionate information to verify your identity. We respond within one month; the GDPR permits an extension of up to two further months for complex or numerous requests, with notice and reasons within the first month.
Erasure can be limited by legal obligations or the need to establish, exercise, or defend claims. We will explain an applicable exception. You can complain to the Agencia Española de Protección de Datos or the competent authority where you live or work. You do not need to complain to us first.
7. Security and cookies
We use access controls, workspace-scoped credentials, encryption in transit, and content-redacted logging. No system eliminates every risk; keep your local browser permissions and connected clients under review.
The public landing does not set an authentication cookie merely because you visit it. Signed-in and consent flows use the cookies in our cookie policy. The current portal includes no advertising or optional analytics tracker.
8. Children and changes
Browxai Cloud is offered to adults aged 18 or over. Contact us if a child has provided information so we can investigate and delete it where appropriate.
We update this policy when our processing changes and date each revision. We notify affected users of material changes as required by law. The legal notice provides our full identity and contact details.