Privacy policy

This policy explains what personal data BrowserTesting handles, why, how long we keep it and what your rights are. BrowserTesting (“we”, “us”) runs automated and manual browser tests of websites at browsertesting.eu, app.browsertesting.eu and api.browsertesting.eu, and the BrowserTesting app for Mac. You can reach us at any time through the contact form or at [email protected].

1. Two roles

• As controller, for the data of people who visit our website, write to us, sign up and use their account. We decide why and how this data is used.
• As processor, for the data our customers put into BrowserTesting or that our test browser sees on their websites: test accounts, emails sent to the test inbox, videos, screenshots, console messages and network calls. The customer decides why this data is used and is the controller. We only process it on their instructions, as described in our terms.

2. What we collect and why

• Website visitors. Our website does not use advertising cookies or trackers that follow you across sites. Our servers keep short technical logs (IP address, time, page, browser) to keep the service secure and working. Legal basis: our legitimate interest in security.
• Contact form. Your name, email address, company and message, so we can answer you. Legal basis: our legitimate interest in answering your question, or steps you ask for before a contract.
• Waiting list. Your name, email address and, if you give them, your company, website and message, so we can invite you. Legal basis: steps you ask for before a contract.
• Your account. Your name, email address, your team and its members, and the API keys you create (we only keep a hash). Legal basis: performing our contract with you.
• Usage of the service. Which runs you start, when you log in and which features you use, so we can keep the service working, fix problems and improve it. Legal basis: our legitimate interest in running and improving the service.
• Billing. When you pay for a plan, our payment provider handles your card details; we never see or store your card number. We keep the invoices and the VAT details the law requires. Legal basis: contract and legal obligation.
• Support. What you send us when you ask for help. Legal basis: our legitimate interest in helping you.

3. Data from the websites we test

When our test browser runs a flow on a website, it records what a user would see: a video, a screenshot of every step, the messages in the browser console and the calls the page makes to its servers, with their timing. It types the values of the test accounts the customer set up, and it receives the emails sent to the test inbox. This data belongs to the customer. We process it only to run the tests, show the results and improve the test of that customer.

• Customers should test on a staging environment with test data, not on a live site with real people's data. Only flows the customer marks as read-only may run on a live site.
• Passwords, 2FA secrets and saved logins of test accounts are stored encrypted (AES-256-GCM) and are never shown again after they are saved.
• To work out and repair test steps, a description of the page and a screenshot of it are sent to the AI model (Google Gemini, through Google Cloud). The model provider does not use this data to train its models.

4. Who else handles data

We use a few service providers. They only process data on our instructions and under a data processing agreement:

• Amazon Web Services: our servers, database and stored videos, in Paris (EU).
• Cloudflare: delivering our websites securely and fast, and our DNS.
• Twilio SendGrid: sending our emails (invites, answers) and receiving the emails sent to the test inbox.
• Google Cloud: the AI model that turns test steps into browser actions.
• Stripe: payments, when you pay for a plan.

Some of these providers are based in the United States. Where data leaves the European Economic Area, the transfer is covered by the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

We never sell personal data and never use it for advertising.

5. How long we keep it

• Account data: as long as your account exists, and up to 30 days after you delete it.
• Run results, videos and screenshots: 90 days, unless the customer deletes them sooner or their plan says otherwise.
• Emails in the test inbox: 30 days.
• Contact form messages: up to 2 years after our last contact.
• Waiting list: until you create your account, or up to 1 year if you do not.
• Login codes and links: 15 minutes; each works once.
• Technical logs: up to 30 days.
• Invoices: as long as tax law requires (7 years in Belgium).

6. Security

Connections are encrypted (HTTPS). Secrets of test accounts are encrypted at rest. Video and screenshot addresses contain a long random key. Access to our servers is limited to the people who need it and protected with keys.

7. Your rights

You may ask to see your data, correct it, delete it, receive it in a common format, limit its use, or object to its use based on our legitimate interest. Write to [email protected]; we answer within one month. If your data was put into BrowserTesting by one of our customers (for example as a test account), please contact that customer first; we help them answer you.

You may also complain to a data protection authority, in Belgium the Gegevensbeschermingsautoriteit / Autorité de protection des données (www.dataprotectionauthority.be), or the authority where you live.

8. Changes

When we change this policy, we update the date at the top. If a change matters for you, we tell account holders by email before it applies.