1. Home
  2. Privacy Policy

Legal

Privacy Policy

PreLogin is built around a minimum-data principle: we store a session, not a password, and we never see the plaintext of your sessions without the master key.

Last updated: September 2, 2026 Operator: DataDab LLP

1. What we collect and why

PreLogin stores the minimum needed to do the job:

  • Session cookies (including HttpOnly) and per-origin localStorage — to replay your login so agents can run. Encrypted at rest.
  • Tenant metadata and API key hash — for authentication and billing. The plaintext key is shown once and never stored.
  • Run results and run history — the task output you asked for, and a step-by-step record.
  • Audit log — append-only, redacted at the write boundary (counts only, never session material).
  • Webhook endpoints and a delivery log — the outbound notifications you configure.

We do not store your passwords.

2. How data is protected

  • Sessions are encrypted under per-tenant keys (AES-256-GCM with tenant/session-bound additional authenticated data — ciphertext copied between tenants or sessions fails to decrypt).
  • The master key is held in Google Secret Manager, separate from the encrypted data disk (cloud deployment).
  • API access is key-gated; the operator surface is IP-restricted.

3. Where data is processed

  • Cloud deployment: Google Cloud, asia-south1 (Mumbai region), Compute Engine, with the vault database on a persistent disk.
  • Self-hosted: on the infrastructure you choose.

4. Who we share with

  • Third-party sites you automate: the Service replays your session to the sites you configure — that is the point of the product. Those sites see your automated activity as your account.
  • Vision model provider (for the Describe → Plan feature): task descriptions and page context are sent to the configured model endpoint to generate step plans.
  • Sub-processors: Google Cloud (hosting). We do not sell data.

5. Retention

  • Sessions: until you revoke them, they expire, or your account is terminated.
  • Runs, the audit log, and the delivery log are retained for the life of the account (the audit log is append-only with no pruning).
  • On termination: encrypted data is deleted within 30 days; contact us first to export your run history.

6. Your rights

Depending on your jurisdiction you may have rights to access, correct, export, or delete your data. Email hello@prelogin.click. We respond within 30 days.

7. Cookies

The marketing site sets no tracking cookies. The Service sets session cookies only on the third-party sites you automate — never for visitors to our site.

8. Security incidents

If we become aware of a breach affecting your data, we will notify you by email where required by law.

Security questions or reports? Write to security@prelogin.click.