Legal

Privacy Policy

This policy explains what information we collect when you visit our website or use HeadlessFleet, how we use it, who we share it with, how long we keep it, and the choices you have.

Last updated October 11, 2026

Who we are

HeadlessFleet is operated by headlessfleet.com (“we”, “us”), which is responsible for the personal information described in this policy. The policy covers our website at headlessfleet.com, the dashboard, the API, and the browser sessions and jobs you run with us.

If you have a question or a request about your information, email [email protected].

When your automation handles other people’s information, for example on pages your sessions visit, you decide what it collects and why. We handle that content on your behalf to provide the service, as described in our Terms of Service.

Information we collect

Account information

When you sign up, you give us your name, email address, organization name and a password. We store the password only as an Argon2id hash, never in readable form. We also record whether you’ve verified your email address, and your organization, project, plan and role.

We don’t ask for your phone number, postal address or date of birth.

Billing information

Payments are handled by Stripe. You enter your card details and billing email on Stripe’s pages, not ours, and we never receive or store your full card number. Any receipts or invoices you get by email come from Stripe.

We keep your Stripe customer and subscription IDs, your subscription status and plan, your prepaid credit balance, and a record of your top-ups and usage charges. If you don’t already have one, we create your Stripe customer record when you start buying a paid plan, before you pay, and give it only your organization’s internal ID. When we send you to Stripe, we pass along only internal identifiers for your organization, project and plan.

We take payments through a Stripe account that we share with our affiliated mobile proxy businesses. Your Stripe customer record, including your billing details, your card’s brand and last four digits, and your payment history, is kept in that account, where the people who manage it for those businesses can also see it. Stripe’s checkout pages and receipts may show that account’s business name.

Usage and service data

To run and bill the service, we keep records of:

  • Browser sessions: when each session was created, started and ended and when it was last in use, its status and region, the proxy location, carrier and pool it used, and any error code.
  • Metering: the browser time and the bytes sent and received for each session, and the resulting charges.
  • API keys: the name you give each key, its prefix, scopes and expiry, and when it was last used. We store a hash of the key, not the key itself.
  • Dashboard sign-ins: a hash of each session token, and when the session started, was last used and expires.
  • Audit log: account actions such as creating or revoking an API key, starting a checkout or top-up, creating a job (with its target URL) and saving a profile (with its proxy location). You can read your audit log through the API.
  • Server logs: for each request to our API, including the requests the dashboard makes for you, our servers log the time, the type of request and its path (which can include the IDs of your sessions, jobs, profiles, API keys and files), the response status and how long it took. They also log error messages.

Browser sessions and network traffic

Your sessions’ web traffic passes through a relay on our servers and then through our mobile proxy network.

  • For encrypted (HTTPS) connections, the relay passes the encrypted data through without decrypting it.
  • For unencrypted (HTTP) connections, the content passes through the relay in readable form. We don’t store or log it.
  • The relay counts the bytes each session sends and receives, for metering and billing.
  • While a session runs, the relay keeps a tally in memory of the websites (domains) the session connects to, with a sample hostname, when it was first and last contacted, a connection count and byte counts for each. We don’t save this tally to our database or logs or send it anywhere, and it’s discarded when the session ends. If we decide to keep it in the future, we’ll update this policy before we do.
  • Before routing a connection through the mobile network, our servers look up the destination’s hostname in DNS, so they can refuse destinations that point to private or internal network addresses. These lookups go from our servers to public DNS resolvers, currently Google Public DNS and Cloudflare’s 1.1.1.1, rather than through the mobile connection, so those resolvers see the hostnames your sessions connect to.
  • Commands your automation sends over the Chrome DevTools Protocol (CDP) and the browser’s replies, and the live-view stream and your mouse and keyboard input, are relayed in real time. We don’t record their content. We note only the time of the most recent traffic, which tells us whether the session is still in use.
  • When a session that doesn’t use a saved profile ends, its virtual machine is destroyed along with its browser data, such as cookies and cache.

Apart from the job data and saved profiles described below, we don’t keep a record of the pages your sessions visit or what’s on them.

Content you store with us

  • Saved profiles: when you save a profile, we store the browser’s full data directory, which includes cookies, site storage, history and signed-in sessions for the websites you used, along with the profile’s name and proxy location settings. We store profiles on our own servers, encrypted at rest with AES-256-GCM, with a separate key for each saved version. Each save creates a new version, and we keep every version until you delete the profile.
  • Jobs: for each job, we store its input (the URL, selectors, any actions and the values they type or select, and any webhook URL), its result (the extracted data, plus the page text or HTML if you ask for it), any error details, and any screenshots or PDFs it produces. Through the service, only your project’s users and API keys can access them.

When you visit our website

Cookies. We set two strictly necessary cookies, and only when you sign up or sign in to the dashboard:

  • __Host-cloudbrowser_session keeps you signed in. It’s marked Secure and HttpOnly, so your browser sends it only over HTTPS and scripts on the page can’t read it. It lasts 7 days when you create an account, or when you sign in with “Keep me signed in for 7 days” selected, as it is by default, and 8 hours otherwise. Signing out removes it.
  • __Host-cloudbrowser_csrf protects your account against cross-site request forgery. It’s also marked Secure, but the dashboard’s own scripts need to read it, so it isn’t HttpOnly. It lasts as long as the session cookie, and signing out removes it too.

We don’t set any other cookies ourselves. Google’s advertising tag, described below, may set its own, and Cloudflare, which delivers our site, may set cookies it needs for security.

Google Fonts. Our website and dashboard load fonts from Google Fonts, so your browser connects to Google’s servers (fonts.googleapis.com and fonts.gstatic.com). Google receives your IP address and standard browser information, such as your browser type.

Google Ads. We use Google Ads only to measure whether our ads lead to sign-ups. For this, our sign-up page and the pages of our public website, such as the home, pricing and docs pages and these legal pages, load Google’s tag (gtag.js) from Google’s servers. The dashboard and our sign-in, password-reset and email-verification pages don’t load it. Signing up, signing in and the sign-in links on our website all load the next page in full, so the tag doesn’t carry over into the dashboard or the sign-in page. One exception: if you follow a link from the sign-in, password-reset or email-verification page to a page with the tag and then go back with your browser’s Back button, the tag stays loaded in that tab until the next full page load, such as when you sign in or reload the page. The tag sends Google information about your visit, such as the address of the page you’re on, your IP address and details about your browser. When you create an account, it also reports that a sign-up happened. That report doesn’t include your name, email address or any other account details.

We tell Google not to use information from the tag to personalize ads, including for remarketing. What the tag stores on your device depends on where you are:

  • In the European Economic Area, the UK and Switzerland, the tag runs with every advertising and analytics consent setting turned off. We don’t show a consent banner, so they stay off: the tag doesn’t set or read advertising cookies, and Google receives only cookieless measurement data.
  • Everywhere else, advertising and analytics storage are on, so Google may set and read cookies to connect ad clicks with sign-ups.

IP addresses. When you sign up, sign in, verify your email or reset your password, our servers use your IP address to limit repeated attempts, and for sign-in and password-reset requests they also use the email address entered. These rate-limit records are kept only in memory, and our application doesn’t save your IP address to its database or logs. Cloudflare also processes your IP address, as described in How we share information.

When you contact us

If you email us, we receive your email address and whatever you include in your message.

How we use information

We use the information above to:

  • provide the service: run your browser sessions and jobs, route their traffic, store your profiles and job results, and deliver your webhooks
  • meter your usage, bill you and keep your credit balance, with payments processed by Stripe
  • keep the service secure and prevent abuse, for example by limiting repeated sign-in attempts, checking at sign-up that an email address can receive mail and isn’t disposable, checking whether a new sign-up uses the same mailbox as an existing account (such as the same address with a “+” tag, or a Gmail address with dots added or removed) to prevent duplicate free accounts, and investigating suspected violations of our Terms
  • help you when you contact us
  • send you email about your account and the service, such as verification and password-reset messages, and news about features and offers. You can unsubscribe from news and offers at any time.
  • understand how the service is used and improve it
  • measure whether our ads lead to sign-ups
  • meet legal obligations, such as keeping financial records and responding to lawful requests, and enforce our Terms

We use your stored content and your sessions’ traffic only to provide, secure and support the service (for example, when you ask us for help), to investigate suspected violations of our Terms, and when the law requires it.

How we share information

We don’t sell your personal information. We share it only as described here.

Providers. These companies help us run the service:

  • Cloudflare provides our network edge and TLS encryption. All traffic to our website, dashboard, API and browser connections passes through Cloudflare, which processes your IP address and the content of that traffic, including CDP commands and live-view streams, as it passes through. Cloudflare’s public DNS resolver also receives the hostnames your sessions connect to, as described in Browser sessions and network traffic.
  • Stripe processes payments. It collects your payment details directly and receives internal identifiers for your organization, project and plan from us. The Stripe account we use is shared with our affiliated mobile proxy businesses, as described in Billing information.
  • Resend delivers our account emails. It receives your name, email address and the content of those emails. The Resend account we use is shared with our affiliated mobile proxy businesses, so the people who manage it for those businesses can also see these emails and their content, including verification and password-reset links.
  • MillionVerifier checks at sign-up whether your email address can receive mail and isn’t disposable. It receives only the email address you entered.
  • Google provides Google Fonts and Google Ads, as described in When you visit our website, and Google Public DNS, which receives the hostnames your sessions connect to.
  • Hetzner hosts the server in Finland where we keep encrypted copies of our database backups. The backups are encrypted before they leave our servers, so Hetzner can’t read them.
  • Our mobile proxy network and mobile carriers carry your sessions’ web traffic. The proxy network is operated by us or our affiliated mobile proxy businesses, and the traffic leaves through mobile carrier connections. Like any network provider, they can see where your sessions connect and the content of any unencrypted traffic.

At your direction. When you set a webhook URL for a job, we send the full job, including its input and result, from our servers to that URL. The websites and services your sessions visit receive whatever your automation sends them.

For legal reasons. We may disclose information if the law requires it, or if we believe in good faith that disclosure is needed to protect the rights, property or safety of our users, the public or us.

In a business transfer. If we’re involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that deal, and this policy will continue to apply to it.

How long we keep information

We keep your account information, session history, usage and billing records and audit log for as long as your account exists, as we need them for billing, security and legal purposes. We don’t delete them on a schedule. More specifically:

  • Saved profiles: until you delete them. A deleted profile disappears from your account right away, and we permanently delete all of its stored versions shortly afterwards.
  • Jobs: inputs, results, screenshots and PDFs are kept while your account is open. There’s currently no way to delete individual jobs yourself; email us if you need something removed.
  • Browser data from sessions without a saved profile: deleted when the session ends.
  • CDP commands and live view: not recorded.
  • The tally of domains a session connects to: kept in memory only, and discarded when the session ends.
  • Revoked API keys: kept in your key list, marked as revoked.
  • Backups: we back up our database every night. The backups are encrypted. We keep the three most recent on our database server and the 14 most recent on our backup server in Finland, so each backup is deleted after about 14 days.
  • Other database copies: before each database upgrade, we make a full copy of the database on our database server. A job that runs every night deletes each of these copies once it’s more than 14 days old, so a copy is gone within about 15 days of being made. Like any PostgreSQL database, ours also keeps a short-term log of recent changes so it can recover from a crash. That log is overwritten continually, and we don’t archive it.

When you ask us to delete your account, we cancel any paid plan and then delete your account and everything stored with it from our database and file storage: your user and organization details, projects, API keys, sessions, usage and billing records, audit log, saved profiles, and jobs and their files. Your Stripe customer record and payment history stay in Stripe. If you ask, we also delete the customer record there, and Stripe keeps the payment records it’s required to keep. Deletion doesn’t change copies made before it, such as the backups and database copies described above and our server logs. The nightly backups stop containing your information after about 14 days, and the copies made before database upgrades within about 15 days.

Security

We protect your information with measures that include:

  • TLS encryption for connections to our website, dashboard, API and browser endpoints
  • Argon2id hashing for passwords, and hashing for API keys, sign-in sessions and email verification and password-reset tokens, so we don’t store them in readable form
  • a separate, isolated virtual machine for each browser session, which can reach the internet only through its own relay and is destroyed when the session ends
  • AES-256-GCM encryption at rest for saved profiles
  • card payments handled entirely by Stripe, so card numbers never reach our servers
  • encrypted nightly database backups, whose decryption key isn’t stored on our servers
  • limits on repeated sign-up and sign-in attempts, a sign-in cookie that’s sent only over HTTPS and can’t be read by scripts on the page, and cross-site request forgery protection in the dashboard

No system is perfectly secure, so we can’t guarantee the security of your information. If you think your account has been compromised, contact us right away.

International transfers

We run the service on servers in the United States and keep encrypted database backups on a server in Finland. Our providers may process information in other countries where they operate. If you use the service from outside the United States, your information will be transferred to and processed in the United States.

Your choices and rights

  • Access and export: you can see much of your information in the dashboard and through the API, including your sessions, jobs, usage, billing transactions and audit log. To request a copy of your information, email us.
  • Correction: to change your name, email address or organization name, email us.
  • Deletion: to close your account and delete your information, email us. We delete it as described in How long we keep information.
  • Cookies: you can block or delete cookies in your browser settings. If you block the strictly necessary cookies, you won’t be able to sign in. You can block Google’s tag and its cookies with your browser settings or a content blocker.
  • Email: account emails, such as verification and password-reset messages, are part of the service. You can unsubscribe from news and offers with the link in each one.

Send requests to [email protected], from the address on your account if you have one. We may need to confirm your identity before we act on a request.

If you’re in the EEA, the UK or Switzerland

We rely on these legal bases: performing our contract with you; our legitimate interests in operating, securing and improving the service; complying with legal obligations; and your consent where the law requires it. You have the right to access, correct, delete or export your information, to restrict or object to how we use it, and to withdraw consent at any time. You can also complain to your local data protection authority.

If you’re in California

We don’t sell personal information. You can ask us what personal information we’ve collected about you, and ask us to correct or delete it, by emailing us. We won’t treat you differently for making a request.

Children

The service is for people aged 18 and over and isn’t directed to children. We don’t knowingly collect information from anyone under 18. If you believe someone under 18 has given us information, email us and we’ll delete it.

Changes to this policy

We may update this policy. We’ll post the new version on this page and change the “Last updated” date. If a change is material, we’ll notify you by email or in the dashboard before it takes effect.

Contact us

Email [email protected] with any question or request about this policy or your information. HeadlessFleet is operated by headlessfleet.com.