Browser Use

GDPR overview

Browser Use never claims GDPR compliance in so many words, but it publishes a full data processing agreement, last updated 30 July 2026. That DPA names the GDPR and the UK GDPR among the privacy laws it covers, incorporates the European Commission's 2021/914 Standard Contractual Clauses by reference, and handles the UK Addendum and the Swiss FADP explicitly. Sub-processing runs under Clause 9 Option 2, with ten days' notice before any new sub-processor and a five-day right of objection; the current list is published on a Vanta trust page. Data subject rights cover access, correction, deletion, portability, objection, withdrawal of consent, appeal and complaint to a supervisory authority. The company states it neither sells personal information nor shares it for interest-based advertising. No Article 27 EU representative is named, and Do Not Track signals are not honoured. Privacy contact: privacy@browser-use.com.

Who owns the data?

You decide entirely what you submit: the agent filters nothing, much as a browser or a search engine would not. Browser Use acts as controller for its own site and account data, and as processor — or sub-processor — for the customer data it handles under contract, which the privacy policy expressly does not cover. Inputs and outputs may be passed to the third-party LLM providers that power the service, and to hosting, analytics, payment and support vendors. Professional advisers, authorities and a future acquirer may also receive personal information. Browser profiles retain cookies and session state, though the vendor states it does not store browser passwords.

Reuse rights

Outputs come back as structured JSON you can pass straight to the next step, and nothing in the terms requires permission to reuse them. Two limits matter. The terms forbid using the service to harvest email addresses or contact details of other users for unsolicited messaging, and forbid circumventing any block Browser Use applies, including through a proxy or a VPN. You remain solely responsible for the legality, quality and accuracy of what you submit, and Browser Use may refuse or remove content at its sole discretion. Separately, it reserves the right to build aggregated, de-identified, anonymous or sanitised datasets from inputs, outputs, usage telemetry and workflow patterns, and to use, share and license them.

Data retention & training

Hosting summary

No hosting country or region is named anywhere on the site. Section 11(a) of the data processing agreement states that customer personal data may be processed in any country where Browser Use, its affiliates and its authorised sub-processors maintain facilities; for data covered by European privacy law, it undertakes not to transfer outside the country of collection without first putting the necessary measures in place. The European Commission's Standard Contractual Clauses are incorporated by reference, with the UK Addendum and the Swiss FADP handled separately. The current sub-processor list is published on a Vanta trust page cited in section 7(a). Stripe processes payments, and inputs and outputs may be passed to third-party LLM providers. The responsible entity is a US company whose team sits in San Francisco, with Californian law governing the terms. SOC 2 Type II attests to the controls without specifying a storage jurisdiction. The domain resolves to an anycast address in the United States, which identifies a delivery node rather than a place of storage.