Browser Data Notice

Scope and roles

This notice applies to data processed while Lexmount cloud browsers run. You determine the automation purpose, websites, inputs, and persistence and generally act as controller for that data; Lexmount supplies infrastructure and processing on your instructions. You must have lawful authority for target sites, accounts, and personal data.

Data categories

Depending on enabled features, an instance may process automation instructions, navigation and browsing history, URLs, rendered page content, DOM or accessibility-tree data, network requests and responses, inputs and interactions, credentials you choose to supply, cookies/localStorage and other browser-context data, screenshots or session recordings, uploads and downloads, extracted outputs, diagnostic files, and operational logs. Do not enable persistence, recording, or downloads unless needed.

Session recording can capture mouse movement, clicks, keystrokes, form entries, page views, and content displayed by a third-party site. Before enabling it, identify affected people and sensitive fields, provide appropriate notice, obtain any consent required by law or contract, mask or exclude data where necessary, and use available access and retention controls. Do not conceal a recording indicator in a way that misleads an affected person.

Retention and deletion

• Temporary instance data enters cleanup when the instance ends.
• Persistent browser contexts remain until you delete them through the relevant product control or the agreed term expires. Deleting a LexHome account does not automatically delete those contexts.
• Public-cloud session recordings currently default to a maximum of 7 days; Office recordings default to a maximum of 1 hour. A shorter period displayed in the console, contract, or region controls.
• Screenshots and other explicitly saved artifacts follow the period shown in the console, API response, selected region, or agreement. Artifacts that were not explicitly persisted enter cleanup with the temporary instance data.
• Download and diagnostic-file retention is the period expressly shown in the console, API response, selected region, or agreement. If no period is shown, do not treat the feature as permanent storage.
• Operational, security, and automation logs are kept only as needed for service operation, troubleshooting, abuse prevention, contractual commitments, and legal obligations.

Deletion may require reasonable processing time. Deleting one artifact does not necessarily delete a separate persistent context, account record, invoice, or backup copy. Data subject to a security incident, dispute, or legal hold is isolated and access-restricted; restricted backups are not restored for ordinary use and are overwritten after their rotation period.

Use restrictions

Except as needed to secure the service, respond to faults, or comply with law, we do not independently determine purposes for browser data. Unless you explicitly opt in through a separate written agreement and all required authority and consent have been obtained, we do not use customer content, browser sessions, navigation history, page or DOM content, inputs, credentials, cookies, screenshots, recordings, downloads, outputs, or automation instructions to train, fine-tune, or evaluate any general-purpose or generative AI model. We do not use browser data to build advertising profiles, sell it, or share it for cross-context behavioral advertising.

Regions, vendors, and security

Data is generally processed in the selected or displayed product region. Cross-region troubleshooting, vendor support, or your use of cross-region resources may create international processing; we will provide additional notice and use applicable mechanisms where required. Service subprocessors and regions vary with the selected region, connected services, payment method, and enterprise deployment; current information relevant to an enterprise order or data-processing addendum is available through Contact. Controls include least privilege, access control, encryption in transit, audit logging, and tenant isolation.

Your responsibilities

Configure the shortest practical retention, delete contexts and artifacts promptly, restrict API-key permissions, keep secrets out of logs, and provide notices to affected people where required. Confirm that automation and recording comply with the target site's terms, access rules, and applicable law; Lexmount's service does not itself grant permission to access a third-party site or account. Report suspected exposure or unauthorized access through Contact.