Privacy Policy

This policy explains how [Company legal name], Tax ID (RUT) [Tax ID (RUT)], with its registered address at [Address], Chile ("Wutbug", "we", "us") processes personal data. It covers two groups of people:

1. Customers and their teams: those who create a Wutbug account and use the Dashboard. Here we are the controller of the processing.
2. End Users: the people who use our customers' applications and submit a report with the widget. Here we are the processor: we process their data on behalf of and on the instructions of the customer, who is the controller.

Privacy contact: [Contact email].

#1. Data of customers and their teams

We do not sell your data or use it for third-party advertising.

#2. End User data (captured by the widget)

The customer decides whether to install Wutbug in its application, how to configure it and how long to keep reports. Depending on that configuration, a report may contain:

• What the person writes: a description of the problem and, optionally, their email.
• A screenshot of the page (with form fields masked), which the person can annotate or remove before submitting.
• A screen recording, only if the person starts it and authorizes it in their browser (up to 2 minutes, without audio).
• A DOM replay of approximately the last 2 minutes: page structure, clicks, scrolling and mouse movements. Form and password values are masked by default.
• Console logs and network requests (fetch/XHR): URL, method, status, timings, headers and content, with secrets (passwords, tokens, cookies, cards) replaced before leaving the browser.
• Browser and device information: user agent, operating system, device type and model when the browser exposes it, language, time zone, screen size, accessibility preferences, network connection, battery level (Chromium browsers only), approximate memory and cores, and the page URL.
• Usage signals: repeated or unresponsive clicks, slow requests and page performance metrics.
• Identity and metadata provided by the customer: for example, the person's ID, email or name, plan or company.

When they are sent. The data is kept in the browser's memory and is only sent when the person presses "Send report". If the customer enables auto-capture in "automatic" mode, the widget may send a report when it detects an error, without any action by the person, subject to per-session limits. In "ask" mode, only a prompt is shown.

IP. We use the IP address transiently to limit submissions and prevent abuse. We do not store it in the report.

Purpose. We process this data solely so that the customer can reproduce, diagnose and resolve problems in its application, and communicate with the person who reported if they left their email.

Your rights as an End User. Because the customer is the controller, direct your requests for access, rectification, erasure, objection or portability to the company whose application you used. If you write to us, we will forward the request to that customer and assist it in responding.

#3. Artificial intelligence

The Dashboard can generate a summary of each report (steps to reproduce and probable cause):

• The summary is generated on our server through OpenRouter, which sends the already-masked report context (description, steps, errors, failed requests and device) to a language model.
• We ask OpenRouter to route only to providers that do not store prompts or train on them.

We do not use the content of reports to train artificial intelligence models.

#4. Who we share data with

• Subprocessors that provide us with infrastructure (database, storage, authentication, email, hosting, AI). Up-to-date list at Subprocessors.
• Integrations that the customer connects (Slack, Linear, Jira, Notion, Asana) or AI assistants via MCP: we send the data the customer indicates, under the customer's responsibility.
• Share links: when a report is submitted, the person who submitted it receives (unless the customer has disabled this) a public link to their report —replay, console, network and device data, already masked— to share with whomever they wish. The customer's team can also create these links. Anyone who has the link can view the report; it does not appear in search engines, and the team can disable it at any time with "Stop sharing".
• Authorities, when a law or a court order requires it.
• In a merger or sale of the company, with prior notice.

#5. Where data is stored

Data is stored on Neon (Databricks) servers on AWS, region us-east-2 (Ohio, United States). Some subprocessors may process data in other countries. Where the law requires it, we use appropriate safeguards for these international transfers, such as the European Commission's Standard Contractual Clauses and the safeguards established by Chile's Agencia de Protección de Datos Personales (Personal Data Protection Agency).

#6. How long we keep it

• Reports: the period chosen by the customer for each project (7 to 365 days; 30 by default). When it expires they are deleted automatically, first the files and then the records.
• Incomplete uploads: deleted after 1 hour.
• Account and team: while they are active. Deleting a team deletes its projects, reports, recordings and integrations. Deleting your account deletes your identity, your tokens and your memberships.
• Backups of the database provider: deleted according to its backup cycle, at most [N] days later.
• Billing data: the period required by tax law.

#7. Security

We mask sensitive data in the browser before sending it, we encrypt in transit (TLS) and at rest, we encrypt integration credentials with AES-256-GCM and we store only hashes of tokens. More details at Security.

#8. Your rights

Depending on the law that applies to you, you may request access, rectification, erasure, objection, portability, restriction of processing and not to be subject to automated decisions with significant effects. You can exercise them from the Dashboard (edit or delete your account) or by writing to [Contact email]. We will respond within a maximum of 30 days.

#European Union and United Kingdom (GDPR)

If you are in the European Economic Area or the United Kingdom, you have the rights under Articles 15 to 22 of the GDPR and you may lodge a complaint with the supervisory authority of your country. EU representative (Art. 27 GDPR): [to be completed if applicable].

#Chile (Ley 19.628 and Ley 21.719)

We process personal data in accordance with Ley 19.628 on the protection of private life (Chile's data protection law) and, from its entry into force, Ley 21.719 (the law that amends it). You have the rights of access, rectification, erasure, objection, portability and blocking, and you may lodge a complaint with the Agencia de Protección de Datos Personales (Chile's Personal Data Protection Agency).

#California (CCPA/CPRA)

If you reside in California, you may know what data we process, request its deletion or correction, and not be discriminated against for exercising your rights. We do not sell or share personal data for cross-context behavioral advertising. For End User data we act as the customer's "service provider".

#9. Minors

The Dashboard is not directed at persons under 18 years of age. If a customer installs the widget on a service for minors, it must comply with the rules applicable to that audience.

#10. Cookies

The Dashboard uses strictly necessary cookies to maintain your session and protect forms. The widget does not install cookies; it uses the browser's sessionStorage to remember the appearance and the auto-capture limits during the session. This site [does not use analytics cookies / to be completed if they are added].

#11. Changes

If we change this policy in a material way, we will notify you in the Dashboard or by email before the change takes effect.