Privacy
Privacy notice.
This notice explains what personal data Trawler processes and why. The controller is Trawler, run from Poland and not yet a registered company; this page will name the company and its registered address once it exists. Write to contact@usetrawler.com about anything in it.
Last updated:
Where it is hosted
The app, its database, the hosted runners and the storage for screen captures run on Railway in the Netherlands, in its EU West (Amsterdam) region. The sub-processors page lists every service that processes data for us, and where.
What we keep
- Your account: the name, email address and picture GitHub or Google gives us when you sign in, the sign-in tokens they give us, encrypted, your sessions with the IP address and browser they started from, and the workspace you belong to, with your role. Trawler has no passwords of its own.
- Your workspace: its name, members and invitations — an invitation holds the invited email address — its plan, its model key, encrypted, and its monthly budget.
- Your projects and runs: while you set up a project, the text of the pages it reads; the product's address and description, the people and goals, test accounts with their passwords encrypted, every event of a run, the findings, verdicts and the cost of each model call, and screen captures of your product with passwords and secrets blacked out.
- Error reports: when something fails, a report without cookies, request bodies or your name, email address or IP address, as Security and data describes.
- Visits to this website: the page you open on usetrawler.com, the page you came from, your IP address, your browser and device type, your country and how fast the page loaded, collected by a script from Cloudflare (Cloudflare Web Analytics) to count visits. The app does not run it.
Your product's pages can contain personal data of their own. Test on environments with test data, and give the people test accounts rather than real people's.
Why
To run Trawler for you under our terms: to sign you in, keep your workspace apart from every other, run your tests, show you the reports, enforce the plans' limits, and find and fix failures. We do not sell data, show ads, or train models on your data. Calls through OpenRouter ask providers not to keep or train on the data; a key from another provider sends calls under that provider's own policy.
On what basis
Your account, workspace, projects and runs: to provide Trawler under the terms you accepted (Article 6(1)(b) GDPR). Error reports, sessions and the plans' limits: our legitimate interest in keeping Trawler working, secure and fair to every workspace, and counting visits to the website to know how people find and use it (Article 6(1)(f) GDPR).
Outside the European Economic Area
The app, its database and the hosted runners run in the European Union. Model providers and sign-in providers can process data outside the European Economic Area, for example in the United States. These transfers rely on the providers' own safeguards: the EU–US Data Privacy Framework where a provider is certified under it, or the European Commission's standard contractual clauses. Error reports stay in Sentry's EU region. Visits to the website are counted by Cloudflare, Inc., which may process them in the United States.
How long
Screen captures: 30 days. Sessions end when you sign out or they expire, and a setup left unfinished expires after a day and is removed after that. Error reports and the app's logs are kept by Sentry and Railway for their own retention periods. Cloudflare keeps the individual measurements of website visits for seven days and then only aggregated figures, which we can see for six months. Everything else: while your workspace exists. There is no way yet to delete a project or a run in the app; write to us and we delete a workspace, or your account, with its data.
Your rights
You can ask for a copy of your personal data, to have it corrected or deleted, or object to how we use it, by writing to contact@usetrawler.com. You can also complain to the Polish data protection authority, the President of the Personal Data Protection Office (UODO), or to the authority where you live or work.