Your privacy is of paramount importance to BrowserStack, Inc. BrowserStack, Inc. and its affiliates are referred to collectively in this policy as as “BrowserStack”, “we”, “us” or “our.” Our affiliates are:
- BrowserStack Inc. in the United States.
- BrowserStack Limited in Ireland.
- BrowserStack Software Pvt. Ltd. in India.
BrowserStack provides a cloud-based service (the “Service”), which is an automated testing platform for testing websites and mobile apps. We fully respect your right to privacy in relation to your interactions with the Service and are committed to being transparent in our dealings with you as to what personal information we will collect and how we will use your personal information. Also, we only collect and use personal information that is necessary for providing Service and where we have a lawful basis to do so.
We have operations in India, Ireland and in the United States. The location of BrowserStack’s main establishment in the European Union is Ireland and therefore we consider our lead supervisory authority, for purposes of “one stop shop” oversight over our cross-border data processing, to be the Irish Data Protection Commissioner (“DPC”).
8th Floor, Block E, Iveagh Court, Harcourt Road, Dublin 2 Ireland
- “Account-Related Information” means contact information, payment information, and biographical information about our customers’ representatives and contacts used for marketing, opening new user accounts to use BrowserStack’s Services, and to maintain existing accounts.
- We collect various categories of Personal Information by or in connection with the use of our websites described in Section 3 below. Our websites include our main website and certain pages hosted by third parties on our behalf, such as pages to apply for jobs at BrowserStack.
- Submitting a web form to communicate with us or apply for a job on website pages we our vendors host on our behalf.
Our website and Services are intended for use by adults. We do not knowingly collect and Personal Information from users under 18 years of age.
Privacy Shield Disclosures.
BrowserStack’s commitments under the Privacy Shield Framework are subject to the investigatory and enforcement powers of the United States Federal Trade Commission.
Section 14 below discusses information about the specific independent dispute resolution body that is available to address complaints about BrowserStack’s privacy practices and to provide appropriate recourse free of charge to individuals.
Types of Information We Collect.
You must register an Account in order to use the Service. The registration process asks for Account-Related Information: a full name, password, email address, IP address, zip code and last four digits of your credit card (and address and contact details, which are optional). When you are running tests on BrowserStack, we log additional information like browser used, your latency to remote VM, your plan information, integration used, local, performance numbers etc. When you log into the Service, our servers automatically record information that your browser sends whenever you visit a website. These server logs may include information such as your web request, Internet Protocol address, browser type and settings, browser language, the address of the web page visited before using the Service, the date and time the Service was used, information about browser configuration and plugins, language preferences and one or more cookies that may uniquely identify your browser. (See the discussion of cookies in Section 3.) The legal bases upon which we process Account-Related Information is fulfillment of our contract to provide the Service to you and your consent.
We may collect information from potential customers at trade shows or meetings, as well as information obtained by obtaining contact lists from marketing companies. The basis for receiving such information is the consent of the individual.
Note to California residents: BrowserStack does not currently have a mechanism to take action in response to a “do not track” signal or browser setting. There is no current standard way of handling such signals. If and when the industry creates standards for responding to them, BrowserStack will reappraise its handling of “do not track” signals.
A cookie is a small text file that is placed on your device by a web server which enables a website and/or mobile app to recognize repeat users, facilitate the user’s ongoing access to and use of a website and/or mobile app and allows the website and/or mobile app to track usage behavior and compile aggregate data that will allow content improvements and targeted advertising. We collate information on in relation to the Service which is represented in aggregate format through cookies. They help us to improve our Service and to deliver many of the functions that make your browser experience more user friendly. You can find a list of cookies we use and the purposes for which we use them in our Cookies Policy located here: https://www.browserstack.com/cookie-policy
Use of Account-Related Information and Other Personal Information.
We may communicate with you using your Account-Related Information for administration reasons related to the Service (e.g. to provide you with password reminders or to notify you that a particular service, activity or online content has been suspended for maintenance, or in response to a question that you ask us.
We may contact you using Account-Related Information or other Personal Information we collect:
- to provide you with information about our Service, activities or online content, including sending e-newsletters or similar correspondence and updates or responding to any contact you have made with us, e.g. on our website, by email or via the ‘How To Contact Us’ facility referred to below;
- to invite you to participate in surveys about our services (participation is always voluntary).
We use the Personal Information in your job application, cover letter, or resume to process and consider your application.
BrowserStack only processes Account-Related Information for the purpose of providing, improving, and ensuring the delivery of the Service.
Individual Rights of Individuals within the European Economic Area.
- Overview of Individual Rights.
- the right of access to Personal Information relating to you;
- the right to correct any mistakes in your Personal Information;
- the right to object and ask us to stop contacting you with direct marketing;
- rights in relation to automated data processing;
- the right to restrict or prevent your Personal Information being processed;
- the right to have your Personal Information ported to another data controller;
- the right to erasure; and
- the right to complain to the DPC if you believe we have not handled your Personal Information in accordance with applicable data protection law.
These rights are explained in more detail below, but if you have any comments, concerns or complaints about our use of your Personal Information, please contact us (see ‘How To Contact Us’ below). We will respond to any rights that you exercise within a month of receiving your request, unless the request is particularly complex or cumbersome, in which case we will respond within three months (we will inform you within the first month if it will take longer than one month for us to respond). Where a response is required from us within a particular time period pursuant to applicable data protection law, we will respond within that time period.
If you are within the European Economic Area, and to the extent that you wish to exercise any of the above rights in respect of Personal Information contained in Account-Related Information, please contact us (see ‘How To Contact Us’ below).
As mentioned above, BrowserStack does not permit customers to include Personal Information in Customer Content provided to BrowserStack’s Services (other than Account-Related Information). Nonetheless, if a data subject contacts BrowserStack directly concerning the exercise of individual rights in relation to Customer Content, contending that his or her Personal Information is included in Customer Contact, BrowserStack will contact the relevant customer and provide reasonable cooperation to the customer to respond to the data subject’s request.
- Right of Access to Personal Information Relating to You.
See Section 9 below.
- Right to Update or Correct Mistakes in Personal Information Relating to You (Rectification).
See Section 9 below.
- Right to Object to Contacting You with Marketing Messages.
If you are user working on behalf of an existing BrowserStack customer, and we have your Account-Related Information under an agreement with that customer, we have a legitimate interest to send you electronic communications/direct marketing in connection with the Service and related matters (which may include but shall not be limited to newsletters, announcement of new features etc.). We may also ask you different questions for different services, including competitions. We may also ask you to complete surveys that we use for research purposes, although you do not have to respond to them.You can ask us to stop contacting you for direct marketing purposes. If you would like to do this, please:
- email or write to us (see ‘How can you contact us’ below). You can also click on the ‘unsubscribe’ button at the bottom of the electronic communication. It may take up to 15 days for this to take place; and
- let us know what method of contact you are not happy with if you are unhappy with certain ways of contacting you only (for example, you may be happy for us to contact you by email but not by telephone).
We will provide you with information on action taken on a request to stop direct marketing – this may be in the form of a response email confirming that you have ‘unsubscribed’. Unsubscribing from direct marketing does not unsubscribe you from essential electronic communications in respect of the administration of Your Account.
- Right to Restrict or Prevent Processing of Personal Information.
In accordance with applicable data protection law, you may request that we stop processing your Personal Information temporarily if:
- you do not think that your Personal Information is accurate (but we will start processing again once we have checked and confirmed that it is accurate);
- the processing is unlawful but you do not want us to erase your Personal Information;
- you believe we no longer need the Personal Information for our processing; or
- you have objected to processing because you believe that your interests should override the basis upon which we process your Personal Information.
If you exercise your right to restrict us from processing your Personal Information, we will continue to process the Personal Information if:
- you consent to such processing;
- the processing is necessary for the exercise or defense of legal claims;
- the processing is necessary for the protection of the rights of other individuals or legal persons; or
- the processing is necessary for public interest reasons.
- Right to Data Portability.
In accordance with applicable data protection law, you may ask for an electronic copy of your Personal Information that you have provided to us and which we hold electronically, or for us to provide this directly to another party. This right only applies to Personal Information that you have provided to us – it does not extend to data generated by us. In addition, the right to data portability also only applies where:
- the processing is based on your consent or for the performance of a contract; and
- the processing is carried out by automated means.
- Right to Erasure.
Please note our data retention periods, as set out in Section 11 below.
In accordance with applicable data protection law, you can ask us (please see ‘How To Contact Us’ below) to erase your Personal Information where:
- if you had given us consent to process your Personal Information, you withdraw that consent and we cannot otherwise legally process your Personal Information;
- you object to our processing and we do not have any legal basis for continuing to process your Personal Information;
- your Personal Information has been processed unlawfully or have not been erased when it should have been; or
- the Personal Information have to be erased to comply with law.
We may continue to process your Personal Information in certain circumstances in accordance with applicable data protection law (i.e. where we have a legal basis to continue to store or preserve such Personal Information, for example because it is within our legitimate business interest to do so (e.g. retaining evidence of resolved support requests, billing information etc.). Where you have requested the erasure of your Personal Information, we will inform recipients to whom that Personal Information have been disclosed, unless this proves impossible or involves disproportionate effort. We will also inform you about those recipients if you request it.
- Right to Withdraw Consent.
When BrowserStack Will Disclose or Transfer Account-Related Information or Personal Information.
We may share with third parties certain pieces of aggregated, non-personal information such as the number of sites, devices accessed while using BrowserStack, for example. Such information does not identify you individually.
We restrict access to Personal Information to employees, contractors, agents, and subcontractors who need to know that information in order to operate, develop, or improve our Service. These individuals and businesses are bound by confidentiality obligations and may be subject to discipline, including termination, civil litigation, and/or criminal prosecution, if they fail to meet these obligations.
Account-Related Information may be transferred to, stored at, or accessed from a destination outside the European Economic Area (“EEA”) for the purposes of us providing the Service. It may also be processed by staff operating outside the EEA who work for us, another corporate entity within our group, or any of our suppliers. By submitting Account-Related Information, you explicitly consent to this transfer, storing or processing. We will take all steps reasonably necessary to ensure that Account-Related Information is treated securely and in accordance with this Policy. The safeguards in place with regard to the transfer of Account-Related Information outside of the EEA are the entry by us into appropriate contracts with all transferees of such data and/or assurance that the data importer is subject to a code of conduct or certification imposing reasonable and appropriate data protection safeguards.
All Account-Related Information you provide to us is stored on our (or contracted third party) secure servers. Where we have given you (or where you have chosen) a password which enables you to access the Service, you are responsible for keeping this password confidential. We ask you not to share a password with any person not authorized to use the Service.
Also, we may disclose Account-Related Information or other Personal Information when required by a subpoena, court order, search warrant, other legal process, lawful requests by law enforcement or other public agencies, or applicable law. These requests may include those pursuant to national security or law enforcement requirements. Moreover, we may disclose Account-Related Information or other Personal Information to the extent necessary to maintain the security of our websites, resolve disputes, or investigate possible misconduct.
We use third party service providers and their websites to collect certain Personal Information on our behalf, such as a payment services and a hosted job application site. We require our service providers to maintain appropriate administrative (organizational) and technical measures designed to protect the security and confidentiality of any Personal Information these service providers process on our behalf.
In the context of an onward transfer BrowserStack has responsibility for the processing of personal information it receives under the Privacy Shield and subsequently transfers to a third party acting as an agent on its behalf. BrowserStack shall remain liable under the Privacy Shield Principles if its agent processes such personal information in a manner inconsistent with the Privacy Shield Principles, unless the BrowserStack proves that it is not responsible for the event giving rise to the damage.
Security of Account-Related Information and Other Personal Information.
We implement reasonable and appropriate administrative, physical, and technical safeguards to protect user privacy and protect Account-Related Information and other Personal Information. We restrict access to Account-Related Information and other Personal Information to employees, contractors, agents, and subcontractors that need to know such Personal Information in order to operate, develop or improve the Services that we provide. When we outsource any processes, we require the service provider to have reasonable and appropriate security measures in place.
We will implement appropriate technical and organizational measures to ensure a level of security appropriate to the risks that are presented by the processing of Account-Related Information and other Personal Information we collect. In particular, we will consider the risks presented by accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Account-Related Information and other Personal Information transmitted, stored or otherwise processed.
Unfortunately, the transmission of information via the internet is not completely secure. Although we will implement safeguards to protect Account-Related Information and other Personal Information we collect, we cannot guarantee the security of any data transmitted us and any transmission of Account-Related Information is at your own risk. Once we have received your Personal Information, we will use security procedures and security features to try to prevent unauthorized access. You acknowledge that we cannot guarantee the absolute prevention of cyber-attacks such as hacking, spyware and viruses.
We will notify serious data breaches in respect of Account-Related Information or other Personal Information as required by law without undue delay, A Personal Information breach in this context means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Information transmitted, stored or otherwise processed.
Right of Access and Data Integrity.
You may ask to see what Personal Information we hold about you and be provided with:
- a summary of such Personal Information and the categories of Personal Information held (see Sections 3 and 5 above);
- details of the purpose for which it is being or is to be processed (see Section 5 above);
- details of the recipients or classes of recipients to whom it is or may be disclosed, including if they are overseas and what protections are used for those oversea transfers (see Section 7 above);
- details of the period for which it is held or the criteria we use to determine how long it is held (see Section 12 below);
- details of your rights, including the rights to rectification, erasure, restriction or objection to the processing (set out in this Section 5);
- any information available about the source of that data (see Section 1 above);
- whether we carry out automated decision-making, or profiling, and where we do, information about the logic involved and the envisaged outcome or consequences of that decision making or profiling, although we do not currently carry out any profiling or use automated decision-making; and
- where your Personal Information are transferred out of the EEA, what safeguards are in place (see Section 7 below).
Requests for your Personal Information must be made to us (see ‘How To Contact Us’ below) specifying what Personal Information you need access to, and a copy of such request may be kept by us for our legitimate purposes in managing the Service. To help us find the information easily, please give us as much information as possible about the type of information you would like to see. If, to comply with your request, we would have to disclose information relating to or identifying another person, we may need to obtain the consent of that person, if possible. If we cannot obtain consent, we may need to withhold that information or edit the data to remove the identity of that person, if possible.
There are certain types of data which we are not obliged to disclose to you, which include Personal Information which records our intentions in relation to any negotiations with you where disclosure would be likely to prejudice those negotiations. We are also entitled to refuse a data access request from you where (i) such request is manifestly unfounded or excessive, in particular because of its repetitive character (in this case, if we decide to provide you with the Personal Information requested, we may charge you a reasonable fee to account for administrative costs of doing so), or (ii) we are entitled to do so pursuant to data protection law.
You can require us to correct any mistakes in your Personal Information which we hold free of charge. If you would like to do this, please:
- email or write to us (see ‘How can you contact us’ below);
- let us have enough information to identify you (e.g. name, registration details); and
- let us know the information that is incorrect and what it should be replaced with.
If we are required to update your Personal Information, we will inform recipients to whom that Personal Information have been disclosed (if any), unless this proves impossible or has a disproportionate effort.
It is your responsibility that all of the Personal Information provided to us is accurate and complete. If any information you have given us changes, please let us know as soon as possible (see ‘How To Contact Us’ below).
Retention of Account-Related Information and Other Personal Information Content.
Account-Related Information other Personal Information will be kept and stored for such period of time as we deem necessary taking into account the business purpose for which it was collected in the first instance (i.e. the administration of Your Account for as long as Your Account is active and a reasonable period thereafter in case you decide to re-activate Your Account), and our obligations under applicable data protection law. This may include retaining Account-Related Information or other Personal Information as necessary to comply with our legal obligations, to resolve disputes, to enforce our agreements, to support business operations, and to continue to develop and improve our Services.
Where we retain Personal Information for Service improvement and development, we take steps to eliminate information that directly identifies you, and we only use the information to uncover collective insights about the use of our Service, not to specifically analyze personal characteristics about you.
Individual Rights of Individuals within California, U.S.A.
- The California Consumer Privacy Act (CCPA) creates certain individual rights for California residents. This section explains the rights of individual California residents.
- Rights of Access to Information and Data Portability Under the California Consumer Privacy Act
Upon request, we will tell a California resident the categories and specific pieces of Personal Information we have collected about that resident in the previous 12 months. In addition, we will tell a California resident:
- The categories of Personal Information we have collected about that California resident.
- The categories of sources from which the Personal Information is collected.
- The business or commercial purpose for collecting that California resident’s Personal Information.
- The categories of third parties with whom we share Personal Information.
- The specific pieces of Personal Information we have collected about that California resident.
- The California Consumer Privacy Act (CCPA) creates certain individual rights for California residents. This section explains the rights of individual California residents.
- Right of Deletion of Personal Information
You have the right to request that we delete any of your Personal information that we collected from you and retained by us, subject to certain conditions and exceptions under the law. For instance, we have the right to retain Personal Information needed to:
- Complete the transaction for which the Personal Information was collected, provide a good or service requested by the California resident, or reasonably anticipated within the context of our ongoing business relationship with the California resident, or otherwise perform a contract between the business and the California resident.
- Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity; or prosecute those responsible for that activity.
- Conduct solely internal uses that are reasonably aligned with the expectations of the California resident based on the California resident’s relationship with us.
- Comply with a legal obligation.
- Use the Personal Information internally, in a lawful manner that is compatible with the context in which the California resident provided it.
The identity of any person making such a request must be verified as a condition of deleting the Personal Information as requested.
- How to Exercise Your Rights
If you need to contact us with regard to any of your rights as set out in this section, all such requests should be made in writing by email to email@example.com.
- Sale of Personal Information
BrowserStack does not sell personal information in its possession and has not done so in the preceding 12 months
- Policy Against Discrimination
BrowserStack’s customers are almost entirely businesses, as opposed to individual sole proprietors. Therefore, BrowserStack is unlikely to transact business with individual California residents. Nonetheless, BrowserStack will not discriminate against individual California residents for exercising any of their rights under the CCPA, including by:
- Denying goods or services to the California resident
- Charging different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties.
- Providing a different level or quality of goods or services
- Suggesting that the California resident will receive a different price or rate for goods or services or a different level or quality of goods or services
Notice to California Residents About “Do Not Track Settings”.
Under California law, online service providers must say in their privacy policies how they respond to “do not track” settings that users can set in their browser software. Currently, there is no standard governing what, if anything, a website operator should do when receiving a “do not track” signal. Accordingly, BrowserStack does not currently take action in response to a “do not track” browser setting. BrowserStack will revisit this policy accordingly if an industry standard regarding such settings emerges.
How to Contact Us.
If you need to contact us with regard to any of your rights as set out in this Policy, all such requests should be made in writing by email to firstname.lastname@example.org.
Recourse and Resolving Disputes or Complaints.
Also, in compliance with the Privacy Shield Principles, BrowserStack commits to resolve complaints about the collection or processing of Personal Information of residents of the European Economic Area. Individual residents of the European Economic Area with inquiries or complaints regarding our Privacy Shield policy should first contact us at the contact information in Section 13.
Once we receive a privacy complaint, our privacy team will investigate your complaint and give you a response. We will need sufficient information from you for us to evaluate your complaint and, as a result, we may request that you give us additional information that we believe is necessary to assess your complaint.
BrowserStack has further committed to refer unresolved Privacy Shield complaints to an alternative dispute resolution provider located in the United States. If you have an unresolved privacy or data use concern that we have not addressed satisfactorily, please contact our U.S.-based third party dispute resolution provider (free of charge) at https://feedback-form.truste.com/watchdog/request.
Dispute resolution proceedings will be in English.
If the informal discussions with BrowserStack and the formal dispute resolution process described above fail to resolve your complaint, you may be entitled to engage in binding arbitration with BrowserStack through the Privacy Shield Panel, which is the ICDR/AAA Privacy Shield Program, an alternative dispute resolution provider located in the United States. Please contact or visit https://go.adr.org/privacyshield.html for more information or to file a complaint.
If you are not satisfied with the results of these dispute resolution mechanisms, you can complain to the DPC or exercise any of your other rights pursuant to applicable data protection law. In the European Economic Area, information about how to do this is available on the DPC website at https://www.dataprotection.ie