Barbwire

Privacy Policy

Effective from 15 October 2026.

1. Who is responsible

The controller of your personal data is VectorLabs s.r.o., Nové sady 988/2, Staré Brno, 602 00 Brno, Czech Republic, company ID 23149281. For anything about your data, write to privacy@vectorlabs.cz.

2. What we collect and why

  • Your account. When you sign in with Google we get your name, email address, profile picture and Google account ID. We use them to create your account, sign you in and show who did what in your organization. Legal basis: the contract with you (Art. 6(1)(b) GDPR).
  • Your organization. Its name, its members and the email addresses you invite. Legal basis: the contract.
  • The sites you test. The addresses you submit, the text and screenshots of the public pages our cloud browsers visit, the personas, reports and the notes you add. If a page shows personal data, it can end up in a screenshot. Legal basis: the contract.
  • Billing. Your billing name, address, VAT ID and invoices. Stripe handles the card; we never see the full number. Legal basis: the contract, and our legal duty to keep accounting records (Art. 6(1)(c)).
  • Security logs. IP address, browser and times of requests, to keep Barbwire safe and to apply daily limits. Legal basis: our legitimate interest in a secure service (Art. 6(1)(f)).
  • Product analytics. Which pages you open and what you click, so we can see which parts of Barbwire help and which get in your way. When you are signed in, we link these events to your email and organization. Until you choose in the cookie banner, we keep no analytics cookie. If you press “No thanks”, we send nothing. Legal basis: your consent for the cookie (Art. 6(1)(a)), otherwise our legitimate interest. See the Cookie Policy.

We do not sell your data and we do not use it for advertising. We do not use your sites or reports to train AI models, and our AI providers may not either.

3. Data we get from Google

Barbwire uses Google sign-in only to know who you are. We ask Google for the openid, email and profile scopes and nothing else. We get your name, email address, profile picture and Google account ID. We do not get access to your Gmail, Drive, Calendar, contacts or any other Google data.

  • How we use it. To create your account, sign you in, show your name and picture in the app, and show your organization who did what.
  • How we store it. In our database on Google Cloud in the EU (Belgium), encrypted at rest and in transit. We keep it while your account exists and delete it within 30 days after you close the account.
  • Who we share it with. No one, except the processors in section 4 when they need it to run Barbwire, or when the law makes us. We do not sell it, use it for advertising, or use it to train AI models.
  • How to remove it. Delete your account in the app, or write to privacy@vectorlabs.cz. You can also remove Barbwire’s access at myaccount.google.com/permissions.

Barbwire’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. Who processes data for us

These companies process data only on our instructions, under a data processing agreement:

  • Google Cloud (Google Ireland Ltd.): Hosting, database, file storage, Google sign-in. Where: EU (Belgium, europe-west1).
  • Anthropic PBC: Claude AI models that build the personas and read the pages. Where: USA.
  • Browser Use, Inc.: Cloud browsers that visit the sites you test. Where: USA.
  • Stripe Payments Europe Ltd.: Payments, invoices, the billing portal. Where: EU, with transfers to the USA.
  • PostHog Inc.: Product analytics, with the choice you make in the cookie banner. Where: EU (eu.i.posthog.com).

When data goes outside the EU, we rely on the EU–US Data Privacy Framework where the company is certified, or on the European Commission’s Standard Contractual Clauses.

We also share data when the law makes us, for example with a court or the tax office.

5. How long we keep it

  • Account, organization, sites and reports: while your account exists. We delete them within 30 days after you ask us to close the account.
  • Invoices and accounting records: 10 years, as Czech tax law asks.
  • Sign-in session: 30 days. An unfinished sign-up: 30 minutes.
  • Product analytics: up to 12 months.
  • Security logs: up to 90 days.

6. Your rights

Under the GDPR you can ask us to:

  • show you the data we have about you and give you a copy;
  • correct it;
  • delete it;
  • limit how we use it;
  • give it to you in a format a machine can read, to take it elsewhere.

You can object to use based on our legitimate interest, and take back your consent at any time with Cookie settings in the footer. Taking it back does not make earlier use unlawful.

Write to privacy@vectorlabs.cz. We answer within one month. You can also complain to the Czech Office for Personal Data Protection (ÚOOÚ), uoou.gov.cz, or the authority where you live.

7. Security

We encrypt data in transit, keep the session in an HttpOnly cookie, store only a hash of each session token, and limit who on our team can reach production data. If a breach puts your data at risk, we tell you and the ÚOOÚ as the law asks. Found a security problem? Write to security@vectorlabs.cz.

8. Changes

We may update this policy. For a change that matters, we tell you before it applies. The date at the top shows the current version.