Privacy Policy

Effective from January 14, 2019 

  1. Introduction.

    Your privacy is of paramount importance to BrowserStack, Inc. BrowserStack, Inc. and its affiliates are referred to collectively in this policy as as “BrowserStack”, “we”, “us” or “our.” Our affiliates are:

    • BrowserStack Inc. in the United States.
    • BrowserStack Limited in Ireland.
    • BrowserStack Software Pvt. Ltd. in India.

    BrowserStack provides a cloud-based service (the “Service”), which is an automated testing platform for testing websites and mobile apps. We fully respect your right to privacy in relation to your interactions with the Service and are committed to being transparent in our dealings with you as to what personal information we will collect and how we will use your personal information. Also, we only collect and use personal information that is necessary for providing Service and where we have a lawful basis to do so.

    We have operations in India, Ireland and in the United States. The location of BrowserStack’s main establishment in the European Union is Ireland and therefore we consider our lead supervisory authority, for purposes of “one stop shop” oversight over our cross-border data processing, to be the Irish Data Protection Commissioner (“DPC”).

    Our European Union representative for purpose of this Privacy Policy is:

    Nakul Aggarwal
    BrowserStack Limited
    8th Floor, Block E, Iveagh Court, Harcourt Road, Dublin 2 Ireland
    nakul@browserstack.com

    We have created this Privacy Policy to describe our practices and procedures in handling “Personal Information” we collect or receive from you. The term “Personal Information” means any information that identifies, relates to, describes, or is capable of being associated with, or could reasonably be linked, directly or indirectly, to an identified or identifiable living natural person, including but not limited to: (i) Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier Internet Protocol address, email address, account name, social security number, driver’s license number, government identification card number, passport number, or other similar identifiers; and (ii) information defined as “personal information,” “personally identifiable information,” “personal data,” or similar expressions under applicable privacy laws or data security Laws, which include the European Union’s General Data Protection Regulation (”GDPR”).

    This Privacy Policy covers two kinds of Personal Information: Account-Related Information and Personal Information collected by or in connection with the use of our website.

    • Account-Related Information” means contact information, payment information, and biographical information about our customers’ representatives and contacts used for marketing, opening new user accounts to use BrowserStack’s Services, and to maintain existing accounts.
    • We collect various categories of Personal Information by or in connection with the use of our websites described in Section 3 below. Our websites include our main website and certain pages hosted by third parties on our behalf, such as pages to apply for jobs at BrowserStack.

    Please read this Privacy Policy carefully. We will ask for your consent to be bound by this Privacy Policy as a condition of:

    • Allowing you to register for a BrowserStack account (an “Account”) on our website or any mobile application. Any users who use an Account will also be required to expressly accept this Privacy Policy before first accessing (or before continuing to access) our Service through Your Account. If you do not agree to these terms you must leave our website immediately, you must discontinue use of any use of our mobile application, and you will not be permitted to create an Account or use the Service. If you choose to accept this Privacy Policy, we will keep a record of your acceptance.
    • Submitting a web form to communicate with us or apply for a job on website pages we our vendors host on our behalf.

    Please note that this Privacy Policy does not cover “Customer Content.” “Customer Content” means (i) data or content in a website or mobile application that a customer chooses to test (and for mobile applications, the application package itself); (ii) data a customer submits or creates as part of a test, including test scripts and screenshots; and (iii) any other data a customer submits to BrowserStack in connection with the use of the Services (not including Account-Related Information).

    Customer Content does not fall within this Privacy Policy, because the Services are not designed for use with (and do not require) Personal Information included in Customer Content. In our agreements with customers, they specifically agree not to use the Services to collect, store, process or transmit any Personal Information other than Account-Related Information, and will not submit to the Services any Customer Content containing any Personal Information.

    Our website and Services are intended for use by adults. We do not knowingly collect and Personal Information from users under 18 years of age.

  2. Privacy Shield Disclosures.

    BrowserStack complies with the EU-U.S. Privacy Shield Framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal information transferred from the European Union to the United States. BrowserStack has certified to the Department of Commerce that it adheres to the principles of the Privacy Shield Framework (“Privacy Shield Principles”). If there is any conflict between the terms in this Privacy Policy and the Privacy Shield Principles, the Privacy Shield Principles shall govern. To learn more about the Privacy Shield program, and to view our certification, please visit https://www.privacyshield.gov/.

    BrowserStack’s commitments under the Privacy Shield Framework are subject to the investigatory and enforcement powers of the United States Federal Trade Commission.

    Section 14 below discusses information about the specific independent dispute resolution body that is available to address complaints about BrowserStack’s privacy practices and to provide appropriate recourse free of charge to individuals.

  3. Types of Information We Collect.

    You must register an Account in order to use the Service. The registration process asks for Account-Related Information: a full name, password, email address, IP address, zip code and last four digits of your credit card (and address and contact details, which are optional). When you are running tests on BrowserStack, we log additional information like browser used, your latency to remote VM, your plan information, integration used, local, performance numbers etc. When you log into the Service, our servers automatically record information that your browser sends whenever you visit a website. These server logs may include information such as your web request, Internet Protocol address, browser type and settings, browser language, the address of the web page visited before using the Service, the date and time the Service was used, information about browser configuration and plugins, language preferences and one or more cookies that may uniquely identify your browser. (See the discussion of cookies in Section 3.) The legal bases upon which we process Account-Related Information is fulfillment of our contract to provide the Service to you and your consent.

    Our websites collect certain Personal Information about visitors. For instance, through the use of cookies (discussed in Section 4), we are able to collect and analyze data about the use of our websites. See Section 4 for more detail. Also, when you submit a web form to communicate with us, we collect your name, email address, and whatever Personal Information you include in the webform’s fields. When you apply for a job using a web page with a job listing, we collect your name, email address, phone number, postal address, and whatever Personal Information you include in the “cover letter” field you provide or the resume you upload. We ask for consent for the use of cookies, and we ask for your consent to this Privacy Policy when submitting a communication or job application web form as the legal basis for processing the Personal Information communicated to us.

    When you send a web form, email, or other communication to BrowserStack (other than in respect of Personal Information included in support requests), we may retain those communications in order to process your inquiries, respond to your requests and improve our Service. When you submit a job application to BrowserStack, we will process the Personal Information you provide to us in connection with your candidacy for the job for which you applied. BrowserStack is a “data controller” under applicable data protection law with respect to the Personal Information covered by this Privacy Policy.

    We may collect information from potential customers at trade shows or meetings, as well as information obtained by obtaining contact lists from marketing companies. The basis for receiving such information is the consent of the individual.

    Note to California residents: BrowserStack does not currently have a mechanism to take action in response to a “do not track” signal or browser setting. There is no current standard way of handline such signals. If and when the industry creates standards for responding to them, BrowserStack will reappraise its handling of “do not track” signals.

  4. Cookies.

    A cookie is a small text file that is placed on your device by a web server which enables a website and/or mobile app to recognize repeat users, facilitate the user’s ongoing access to and use of a website and/or mobile app and allows the website and/or mobile app to track usage behavior and compile aggregate data that will allow content improvements and targeted advertising. We collate information on in relation to the Service which is represented in aggregate format through cookies. They help us to improve our Service and to deliver many of the functions that make your browser experience more user friendly. You can find a list of cookies we use and the purposes for which we use them in our Cookies Policy located here: https://www.browserstack.com/cookie-policy

    When you consent to the terms of this Privacy Policy when enrolling for the Service, you are consenting to the use of cookies as described in this Privacy Policy. That is, you are agreeing to the placement of cookies on your device unless you specifically choose not to receive cookies.

    For more information about cookies and managing them including how to turn them off, please visit www.cookiecentral.com. However, because cookies allow you to take advantage of some of the Service’s essential features and features of the website, if you disable cookies you will not be able to use the Service or features of our website.

  5. Use of Account-Related Information and Other Personal Information.

    BrowserStack only processes Account-Related Information for the purpose of providing, improving, and ensuring the delivery of the Service, developing new related services to users, and personalizing the way our content is presented to you and ensuring that content on our Service is presented in the most effective manner for you and for your computer/device. Specifically, we may collect (i) names and email addresses for uniquely identifying users and for communication to users, (ii) IP addresses for identifying the latency for our user and tweak his/her tests configuration to provide better performance, based on latency; for optimized streaming experience, having an IP address helps us establish better path and protocol; to identify misuse of our service from one IP address/region or country; (iii) URLs to identify spam on our infrastructure from paid or free accounts; to debug issues around stability and performance of internet on our machines, and (iv) information through the use of cookies (see cookies section below).

    We may communicate with you using your Account-Related Information for administration reasons related to the Service (e.g. to provide you with password reminders or to notify you that a particular service, activity or online content has been suspended for maintenance, or in response to a question that you ask us.

    We may contact you using Account-Related Information or other Personal Information we collect:

    • to provide you with information about our Service, activities or online content, including sending e-newsletters or similar correspondence and updates or responding to any contact you have made with us, e.g. on our website, by email or via the ‘How To Contact Us’ facility referred to below;
    • to invite you to participate in surveys about our services (participation is always voluntary).

    We use the Personal Information in your job application, cover letter, or resume to process and consider your application.

    Where we wish to use Account-Related Information or Personal Information in any other way, we will ensure that we notify you and get your consent first. You will be given the opportunity to withhold or withdraw your consent for the use of Personal Information for purposes other than those listed in this Privacy Policy.

    BrowserStack only processes Account-Related Information for the purpose of providing, improving, and ensuring the delivery of the Service.

  6. Individual Rights of Individuals within the European Economic Area.
    1. Overview of Individual Rights.
      If you are an individual within the European Economic Area, you may have the following rights under applicable data protection law data protection law and we, as Data Controller in respect of Account-Related Information or other Personal Information covered by this Privacy Policy, will comply with such rights in respect of such Personal Information:

      • the right of access to Personal Information relating to you;
      • the right to correct any mistakes in your Personal Information;
      • the right to object and ask us to stop contacting you with direct marketing;
      • rights in relation to automated data processing;
      • the right to restrict or prevent your Personal Information being processed;
      • the right to have your Personal Information ported to another data controller;
      • the right to erasure; and
      • the right to complain to the DPC if you believe we have not handled your Personal Information in accordance with applicable data protection law.

      These rights are explained in more detail below, but if you have any comments, concerns or complaints about our use of your Personal Information, please contact us (see ‘How To Contact Us’ below). We will respond to any rights that you exercise within a month of receiving your request, unless the request is particularly complex or cumbersome, in which case we will respond within three months (we will inform you within the first month if it will take longer than one month for us to respond). Where a response is required from us within a particular time period pursuant to applicable data protection law, we will respond within that time period.

      If you are within the European Economic Area, and to the extent that you wish to exercise any of the above rights in respect of Personal Information contained in Account-Related Information, please contact us (see ‘How To Contact Us’ below).

      As mentioned above, BrowserStack does not permit customers to include Personal Information in Customer Content provided to BrowserStack’s Services (other than Account-Related Information). Nonetheless, if a data subject contacts BrowserStack directly concerning the exercise of individual rights in relation to Customer Content, contending that his or her Personal Information is included in Customer Contact, BrowserStack will contact the relevant customer and provide reasonable cooperation to the customer to respond to the data subject’s request.

    2. Right of Access to Personal Information Relating to You.
      See Section 9 below.
    3. Right to Update or Correct Mistakes in Personal Information Relating to You (Rectification).
      See Section 9 below.
    4. Right to Object to Contacting You with Marketing Messages.
      If you are user working on behalf of an existing BrowserStack customer, and we have your Account-Related Information under an agreement with that customer, we have a legitimate interest to send you electronic communications/direct marketing in connection with the Service and related matters (which may include but shall not be limited to newsletters, announcement of new features etc.). We may also ask you different questions for different services, including competitions. We may also ask you to complete surveys that we use for research purposes, although you do not have to respond to them.You can ask us to stop contacting you for direct marketing purposes. If you would like to do this, please:

      • email or write to us (see ‘How can you contact us’ below). You can also click on the ‘unsubscribe’ button at the bottom of the electronic communication. It may take up to 15 days for this to take place; and
      • let us know what method of contact you are not happy with if you are unhappy with certain ways of contacting you only (for example, you may be happy for us to contact you by email but not by telephone).

      We will provide you with information on action taken on a request to stop direct marketing – this may be in the form of a response email confirming that you have ‘unsubscribed’. Unsubscribing from direct marketing does not unsubscribe you from essential electronic communications in respect of the administration of Your Account.

    5. Right to Restrict or Prevent Processing of Personal Information.
      In accordance with applicable data protection law, you may request that we stop processing your Personal Information temporarily if:

      • you do not think that your Personal Information is accurate (but we will start processing again once we have checked and confirmed that it is accurate);
      • the processing is unlawful but you do not want us to erase your Personal Information;
      • you believe we no longer need the Personal Information for our processing; or
      • you have objected to processing because you believe that your interests should override the basis upon which we process your Personal Information.

      If you exercise your right to restrict us from processing your Personal Information, we will continue to process the Personal Information if:

      • you consent to such processing;
      • the processing is necessary for the exercise or defense of legal claims;
      • the processing is necessary for the protection of the rights of other individuals or legal persons; or
      • the processing is necessary for public interest reasons.
    6. Right to Data Portability.
      In accordance with applicable data protection law, you may ask for an electronic copy of your Personal Information that you have provided to us and which we hold electronically, or for us to provide this directly to another party. This right only applies to Personal Information that you have provided to us – it does not extend to data generated by us. In addition, the right to data portability also only applies where:

      • the processing is based on your consent or for the performance of a contract; and
      • the processing is carried out by automated means.
    7. Right to Erasure.
      Please note our data retention periods, as set out in Section 11 below.
      In accordance with applicable data protection law, you can ask us (please see ‘How To Contact Us’ below) to erase your Personal Information where:

      • you do not believe that we need your Personal Information in order to process it for the purposes set out in this Privacy Policy;
      • if you had given us consent to process your Personal Information, you withdraw that consent and we cannot otherwise legally process your Personal Information;
      • you object to our processing and we do not have any legal basis for continuing to process your Personal Information;
      • your Personal Information has been processed unlawfully or have not been erased when it should have been; or
      • the Personal Information have to be erased to comply with law.

      We may continue to process your Personal Information in certain circumstances in accordance with applicable data protection law (i.e. where we have a legal basis to continue to store or preserve such Personal Information, for example because it is within our legitimate business interest to do so (e.g. retaining evidence of resolved support requests, billing information etc.). Where you have requested the erasure of your Personal Information, we will inform recipients to whom that Personal Information have been disclosed, unless this proves impossible or involves disproportionate effort. We will also inform you about those recipients if you request it.

    8. Right to Withdraw Consent.
      If you no longer consent to our processing of Account-Related Information or other Personal Information (in respect of any matter referred to in this Privacy Policy as requiring your consent), you may request that we stop such processing by contacting us via the ‘How To Contact Us’ facility referred to below. Please note that if you withdraw your consent to such processing, for example in respect of the use of cookies, it may not be possible for us to provide all/part of the Service to you.
  7. When BrowserStack Will Disclose or Transfer Account-Related Information or Personal Information.

    BrowserStack will not share Account-Related Information without your consent or unless required by law (except as described in this Privacy Policy) or as discussed below in this section. By the nature of our Service, and in connection with the collection of website analytics under Sections 3 and 4 above, BrowserStack will gather statistics about the usage of your website and store that information. BrowserStack will not share your website statistics without your consent. If BrowserStack becomes involved in a merger, acquisition, or any form of sale of some of all of its assets (including in a bankruptcy, insolvency, receivership, or similar proceeding), you agree that we will be able to transfer Account-Related Information to any successor or transferee third party.

    BrowserStack shall remain liable under the Principles if its agent processes such personal information in a manner inconsistent with the Principles, unless BrowserStack proves that it is not responsible for the event giving rise to the damage.

    We may share with third parties certain pieces of aggregated, non-personal information such as the number of sites, devices accessed while using BrowserStack, for example. Such information does not identify you individually.

    We restrict access to Personal Information to employees, contractors, agents, and subcontractors who need to know that information in order to operate, develop, or improve our Service. These individuals and businesses are bound by confidentiality obligations and may be subject to discipline, including termination, civil litigation, and/or criminal prosecution, if they fail to meet these obligations.

    Account-Related Information may be transferred to, stored at, or accessed from a destination outside the European Economic Area (“EEA”) for the purposes of us providing the Service. It may also be processed by staff operating outside the EEA who work for us, another corporate entity within our group, or any of our suppliers. By submitting Account-Related Information, you explicitly consent to this transfer, storing or processing. We will take all steps reasonably necessary to ensure that Account-Related Information is treated securely and in accordance with this Policy. The safeguards in place with regard to the transfer of Account-Related Information outside of the EEA are the entry by us into appropriate contracts with all transferees of such data and/or assurance that the data importer is subject to a code of conduct or certification imposing reasonable and appropriate data protection safeguards.

    All Account-Related Information you provide to us is stored on our (or contracted third party) secure servers. Where we have given you (or where you have chosen) a password which enables you to access the Service, you are responsible for keeping this password confidential. We ask you not to share a password with any person not authorized to use the Service.

    Also, we may disclose Account-Related Information or other Personal Information when required by a subpoena, court order, search warrant, other legal process, lawful requests by law enforcement or other public agencies, or applicable law. These requests may include those pursuant to national security or law enforcement requirements. Moreover, we may disclose Account-Related Information or other Personal Information to the extent necessary to maintain the security of our websites, resolve disputes, or investigate possible misconduct.
    We use third party service providers and their websites to collect certain Personal Information on our behalf, such as a payment services and a hosted job application site. We require our service providers to maintain appropriate administrative (organizational) and technical measures designed to protect the security and confidentiality of any Personal Information these service providers process on our behalf.

  8. Security of Account-Related Information and Other Personal Information.

    We implement reasonable and appropriate administrative, physical, and technical safeguards to protect user privacy and protect Account-Related Information and other Personal Information. We restrict access to Account-Related Information and other Personal Information to employees, contractors, agents, and subcontractors that need to know such Personal Information in order to operate, develop or improve the Services that we provide. When we outsource any processes, we require the service provider to have reasonable and appropriate security measures in place.
    We will implement appropriate technical and organizational measures to ensure a level of security appropriate to the risks that are presented by the processing of Account-Related Information and other Personal Information we collect. In particular, we will consider the risks presented by accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Account-Related Information and other Personal Information transmitted, stored or otherwise processed.

    Unfortunately, the transmission of information via the internet is not completely secure. Although we will implement safeguards to protect Account-Related Information and other Personal Information we collect, we cannot guarantee the security of any data transmitted us and any transmission of Account-Related Information is at your own risk. Once we have received your Personal Information, we will use security procedures and security features to try to prevent unauthorized access. You acknowledge that we cannot guarantee the absolute prevention of cyber-attacks such as hacking, spyware and viruses.

    We will notify serious data breaches in respect of Account-Related Information or other Personal Information as required by law without undue delay, A Personal Information breach in this context means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Information transmitted, stored or otherwise processed.

  9. Right of Access and Data Integrity.

    You may ask to see what Personal Information we hold about you and be provided with:

    • a summary of such Personal Information and the categories of Personal Information held (see Sections 3 and 5 above);
    • details of the purpose for which it is being or is to be processed (see Section 5 above);
    • details of the recipients or classes of recipients to whom it is or may be disclosed, including if they are overseas and what protections are used for those oversea transfers (see Section 7 above);
    • details of the period for which it is held or the criteria we use to determine how long it is held (see Section 12 below);
    • details of your rights, including the rights to rectification, erasure, restriction or objection to the processing (set out in this Section 5);
    • any information available about the source of that data (see Section 1 above);
    • whether we carry out automated decision-making, or profiling, and where we do, information about the logic involved and the envisaged outcome or consequences of that decision making or profiling, although we do not currently carry out any profiling or use automated decision-making; and
    • where your Personal Information are transferred out of the EEA, what safeguards are in place (see Section 7 below).

    Details in respect of the above points are all set out in this Privacy Policy; however, if you need further clarification, please contact us (see ‘How To Contact Us’ below).

    Requests for your Personal Information must be made to us (see ‘How To Contact Us’ below) specifying what Personal Information you need access to, and a copy of such request may be kept by us for our legitimate purposes in managing the Service. To help us find the information easily, please give us as much information as possible about the type of information you would like to see. If, to comply with your request, we would have to disclose information relating to or identifying another person, we may need to obtain the consent of that person, if possible. If we cannot obtain consent, we may need to withhold that information or edit the data to remove the identity of that person, if possible.

    There are certain types of data which we are not obliged to disclose to you, which include Personal Information which records our intentions in relation to any negotiations with you where disclosure would be likely to prejudice those negotiations. We are also entitled to refuse a data access request from you where (i) such request is manifestly unfounded or excessive, in particular because of its repetitive character (in this case, if we decide to provide you with the Personal Information requested, we may charge you a reasonable fee to account for administrative costs of doing so), or (ii) we are entitled to do so pursuant to data protection law.

    You can require us to correct any mistakes in your Personal Information which we hold free of charge. If you would like to do this, please:

    • email or write to us (see ‘How can you contact us’ below);
    • let us have enough information to identify you (e.g. name, registration details); and
    • let us know the information that is incorrect and what it should be replaced with.

    If we are required to update your Personal Information, we will inform recipients to whom that Personal Information have been disclosed (if any), unless this proves impossible or has a disproportionate effort.

    It is your responsibility that all of the Personal Information provided to us is accurate and complete. If any information you have given us changes, please let us know as soon as possible (see ‘How To Contact Us’ below).

  10. Purpose Limitation.

    Except as stated in other provisions of this Privacy Policy, we process only that Account-Related Information needed for the purpose of providing, improving, and ensuring the delivery of the Service as consented to by you or in accordance with your instructions. We process Personal Information for job applications only in connection with the processing of your application. We process other Personal Information only as described in Section 5. If we intend to process Personal Information for other purposes or in a manner incompatible with the purposes for which it has been collected or authorized by a data subject, we will obtain your consent before such processing occurs.

  11. Retention of Account-Related Information and Other Personal Information Content.

    Account-Related Information other Personal Information will be kept and stored for such period of time as we deem necessary taking into account the business purpose for which it was collected in the first instance (i.e. the administration of Your Account for as long as Your Account is active and a reasonable period thereafter in case you decide to re-activate Your Account), and our obligations under applicable data protection law. This may include retaining Account-Related Information or other Personal Information as necessary to comply with our legal obligations, to resolve disputes, to enforce our agreements, to support business operations, and to continue to develop and improve our Services.

    Where we retain Personal Information for Service improvement and development, we take steps to eliminate information that directly identifies you, and we only use the information to uncover collective insights about the use of our Service, not to specifically analyze personal characteristics about you.

  12. Amendments to this Privacy Policy.

    BrowserStack may change its Privacy Policy from time to time and at BrowserStack’s sole discretion. The date of the most recent revisions will appear on this page. If you do not agree to these changes, please do not continue to use the Service to submit Account-Related Information or other Personal Information to us. If material changes are made to the Privacy Policy, we will notify you by placing a prominent notice on our website or by sending you a notification in relation to this. We will not process Account-Related Information in a manner not contemplated by this Privacy Policy without your consent.

  13. How to Contact Us.

    If you need to contact us with regard to any of your rights as set out in this Policy, all such requests should be made in writing by email to compliance@browserstack.com.

  14. Recourse and Resolving Disputes or Complaints.

    If you do not think that we have processed your Personal Information in accordance with this Privacy Policy, please contact us in the first instance. You may submit a complaint to us at the contact information in Section 12.

    Once we receive a privacy complaint, our privacy team will investigate your complaint and give you a response. We will need sufficient information from you for us to evaluate your complaint and, as a result, we may request that you give us additional information that we believe is necessary to assess your complaint.

    Dispute resolution proceedings will be in English.