Privacy Policy
Last updated: July 10, 2026
This Privacy Policy explains how Tyrbo (“Tyrbo,” “we,” “us,” or “our”) collects, uses, discloses, and safeguards your information when you use our website at tyrbo.ai, the Tyrbo web application, and our desktop and browser-extension clients (together, the “Service”). We are the data controller for the personal data described here. By using the Service you agree to the practices described in this policy.
1. Information we collect
Information you provide
- Account information: your name, email address, and password (stored only as a salted hash), or the profile information returned by an identity provider if you sign in with Google.
- Organization & billing information: organization name, plan selection, and billing details. Payment card numbers are collected and stored by our payment processor, Stripe — Tyrbo never sees or stores full card numbers.
- Automation content: the workflows you build, the natural-language prompts you give the AI builder, connection metadata, recorded browser steps, and any variables or inputs you configure.
- Connected-account credentials: tokens and secrets for the third-party apps you connect. These are encrypted at rest and used only to run your automations.
- Support communications: the contents of messages you send us.
Information created when you run automations
- Run data: execution logs, timing, credit usage, step results, and — where a step captures it — data scraped from or entered into the websites your automation operates.
- Recordings & artifacts: screenshots and DOM snapshots captured for debugging and self-healing, and saved browser session state (“storageState”) where you choose to reuse a login.
Information collected automatically
- Usage & device data: IP address, browser type, pages viewed, and interactions, collected to operate and secure the Service.
- Cookies: strictly-necessary cookies for authentication and session management. We do not use advertising cookies. See “Cookies” below.
2. How we use your information
- To provide, operate, and maintain the Service and your automations.
- To build automations from your prompts using the AI builder, including sending the prompt and workflow context (never your stored secrets) to our AI provider.
- To process payments, manage credits, and calculate overage.
- To authenticate you, secure accounts, detect abuse, and enforce our Fair Use Policy.
- To provide support and respond to your requests.
- To send service and transactional communications (for example, run failures, billing notices, and security alerts).
- To comply with legal obligations and enforce our agreements.
We do not sell your personal data, and we do not use the content of your automations or the data they process to train our own or any third party’s AI models.
3. Legal bases for processing
Where the EU/UK GDPR applies, we process personal data on the following bases: performance of a contract (to provide the Service you sign up for); legitimate interests (to secure, improve, and support the Service); consent (where required, such as certain communications); and legal obligation (for tax, accounting, and compliance).
4. How we share information & our sub-processors
We share personal data only with service providers that help us run the Service, under contracts that require them to protect it and use it only on our instructions. Our core sub-processors are:
| Processor | Purpose | Data involved |
|---|---|---|
| Supabase | Identity, database, and file storage for accounts, orgs, credit ledger, run history, and recordings | Account, organization, automation, run, and recording data |
| Vercel | Hosting and delivery of the website and web application | Usage and device data (e.g. IP, request logs) |
| Fly.io | Hosting of the automation engine and cloud browser workers | Flow definitions, connection secrets (encrypted), run data |
| Stripe | Subscription billing and payment processing | Billing details and payment information |
| Anthropic | AI builder that turns your prompts into workflows | Your natural-language prompts and workflow context (no stored secrets) |
We may also disclose information if required by law, to protect our rights or the safety of others, or in connection with a merger, acquisition, or sale of assets (in which case we will notify you).
5. International transfers
Our providers may process data in the United States and other countries. Where personal data is transferred out of the EEA or UK, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.
6. Data retention
- Account & organization data: retained while your account is active and deleted within 30 days of account closure, except where we must keep records longer for legal or tax reasons.
- Automation & connection data: retained until you delete the automation or connection, or close your account.
- Run logs, recordings & artifacts: retained for up to 90 days by default to support debugging and history, then deleted; you can delete them sooner.
- Billing records: retained as required by applicable financial-record laws (typically up to 7 years).
7. Security
We encrypt data in transit (TLS) and at rest. Connected-account credentials are encrypted with dedicated keys, and integration secrets never leave our cloud. For sensitive logins you can keep session data entirely on your own device using the Tyrbo desktop app. We follow least-privilege access controls, isolate customer data by organization, and keep private storage buckets behind signed, expiring URLs. No system is perfectly secure, but we work continuously to protect your data.
8. Your rights & choices
Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to withdraw consent. You can manage most data directly in the app or request assistance at privacy@tyrbo.ai. You also have the right to lodge a complaint with your local data-protection authority. We will not discriminate against you for exercising these rights.
9. Cookies
We use only strictly-necessary cookies to keep you signed in and to secure your session. Because we do not use advertising or cross-site tracking cookies, we do not show a tracking-consent banner. You can clear cookies in your browser at any time, though doing so will sign you out.
10. Children’s privacy
The Service is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact us and we will delete it.
11. Changes to this policy
We may update this policy from time to time. When we make material changes we will update the “Last updated” date above and, where appropriate, notify you in the app or by email.
12. Contact us
For any privacy question or request, contact us at privacy@tyrbo.ai. For general support, email support@tyrbo.ai.