Privacy Policy

Last updated: 2026-05-15

Human Browser is operated by Virix Ltd ("Virix Labs", "we", "us"). This policy explains what data we collect when you use humanbrowser.cloud and the related REST and A2A APIs, how we use it, and the rights you have under the UK GDPR and EU GDPR.

1. Who we are

Virix Ltd is a private limited company registered in England and Wales, company number 16325097, registered office at 167-169 Great Portland Street, 5th Floor, London W1W 5PF, United Kingdom. We are the data controller for personal data processed through humanbrowser.cloud. You can reach us at [email protected].

2. Data we collect

Account information

When you create an account or purchase a plan we collect the email address you sign up with, an optional display name, and the API tokens we issue to you. We do not require a real legal name to use the service.

Payment data

Payments are processed by Stripe (card payments) and 0xProcessing (cryptocurrency). We do not store your card number, CVC, or wallet private keys on our servers. We receive only a transaction ID, the amount paid, a country, a payment status, and the last four digits of the card when applicable. Stripe and 0xProcessing each maintain their own privacy policies which apply to the payment step.

Usage data

We record the following while you use the platform:

• Browser sessions you launch — start time, end time, idle time, profile ID
• API requests — endpoint, timestamp, response status, token used
• Your IP address when you call the API or sign in to the dashboard
• The residential proxy egress IP allocated to each session (so we can map abuse reports back to a customer)
• Aggregate token cost for billing

Analytics and product telemetry

We use Google Analytics 4, Google Ads conversion tracking, and Microsoft Clarity on the marketing site. Clarity records anonymized session replays (mouse movement, clicks, scroll, page views) on humanbrowser.cloud — it does not record what happens inside the cloud Chrome browsers you rent. We do not use these tools inside the customer dashboard areas that contain API tokens or wallet keys.

What we do not collect

We do not inspect or store the page content of browser sessions you run on our platform. We do not read your cookies, form inputs, screenshots, or DOM trees. The only browser-session data we keep is metadata required for billing and abuse handling.

3. How we use your data

• Provide the service — authenticate API calls, allocate proxy IPs, launch and tear down browser sessions
• Billing — process payments, send receipts, track prepaid balance
• Abuse detection — investigate complaints about misuse, fraud, or malware originating from a session
• Customer support — reply to your emails, debug your integration
• Service improvement — aggregate, anonymized metrics about uptime, latency, error rates
• Legal compliance — respond to lawful requests from competent authorities

4. Legal basis for processing

We rely on contract (Article 6(1)(b) GDPR) to operate the service you signed up for, legitimate interests (Article 6(1)(f)) for abuse detection and basic product analytics, and consent (Article 6(1)(a)) for non-essential analytics cookies, which you can decline.

5. Sharing your data

We share data with the following categories of processors:

• Stripe, Inc. — card payments
• 0xProcessing — cryptocurrency payments
• Our residential proxy providers — we send routing instructions but never your account email
• Vercel Inc. — website hosting
• Google LLC — analytics (GA4) and ads conversion tracking
• Microsoft Corporation — Clarity session analytics
• Cloud and email infrastructure — Contabo (servers), Gmail (support inbox)

We do not sell your personal data. We do not share it with advertising networks for behavioral retargeting beyond Google Ads conversion attribution.

6. International transfers

Some of our processors (Stripe, Google, Microsoft, Vercel) operate in the United States. Where data leaves the UK or EEA we rely on Standard Contractual Clauses, the UK International Data Transfer Addendum, or equivalent safeguards.

7. Cookies

We use the following categories of cookies and similar identifiers:

• Strictly necessary — session cookie that keeps you logged in to the dashboard
• Analytics — GA4 and Clarity identifiers, used to count visitors and replay anonymous sessions
• Advertising — Google Ads conversion cookies, set only after you complete a purchase

You can disable analytics and advertising cookies in your browser without losing the ability to use the service.

8. Data retention

• Account data — kept while your account is active and for up to 24 months after cancellation, then deleted
• Billing records — retained for 7 years to comply with UK tax law
• API and session logs — 90 days, then aggregated and the raw rows are deleted
• Microsoft Clarity session recordings — 30 days (Clarity default)
• Support emails — retained for up to 24 months after the ticket closes

9. Your rights

Under UK GDPR and EU GDPR you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion ("right to be forgotten") subject to legal retention rules
• Request a portable copy of your data in machine-readable format
• Object to or restrict processing based on legitimate interests
• Withdraw consent for analytics or advertising cookies at any time
• Lodge a complaint with the UK Information Commissioner's Office (ICO) or your local data protection authority

To exercise any of these rights email [email protected] with the subject "Data request" and the email address tied to your account. We respond within 30 days.

10. Security

We use TLS for all traffic, hash API tokens at rest, isolate customer sessions in separate browser profiles, and restrict admin access to a small set of named operators. No system is perfectly secure — if we discover a breach affecting your personal data we will notify you and the ICO within 72 hours as required by UK GDPR.

11. Children

Human Browser is not intended for users under 18. We do not knowingly collect personal data from minors. If you believe a minor has signed up, email us and we will delete the account.

12. Changes to this policy

We update this policy when our practices change. For material changes (new processors, new data categories, changed retention) we will email registered users at least 14 days before the change takes effect. The "Last updated" date at the top of this page always reflects the current version.

13. Contact

Virix Ltd
167-169 Great Portland Street, 5th Floor
London W1W 5PF, United Kingdom
Company number 16325097
Email: [email protected]