Privacy policy

Last updated: October 2026

Who we are

This policy explains how LockInTabs (“we”, “us”) handles personal data when you use the LockInTabs website and browser extension (the “Service”). We are the data controller for this processing. Contact: through your account dashboard.

What we collect

• Account data: your email address and a securely hashed password.
• Task data: the messages you send, and the content of the web page you ask the assistant to work on (page text, the list of buttons and fields, and screenshots when needed). This is only collected when you start a task.
• Chat history: your conversations, saved to your account so you can continue them later.
• Your files: files you upload or ask the assistant to save are stored privately in your account's folder on our EU servers, up to your plan's storage limit. Files are only accessible to you (and to websites you ask the assistant to upload them to, via short-lived links). File contents are not sent to AI providers, except text files you ask the assistant to read.
• Usage and billing data: credits used per step, plan, purchases and timestamps.
• Technical data: IP address and basic server logs for security and abuse prevention.

The extension never reads pages in the background and does not collect your browsing history. It refuses to type passwords or payment card details.

Why we use it (legal bases)

• To provide the Service you asked for — running tasks, saving chats, managing credits (performance of a contract).
• To keep the Service secure and prevent abuse (legitimate interests).
• To meet accounting and tax obligations (legal obligation).

Who we share it with

We use trusted service providers (“processors”) who act on our instructions:

• AI model providers — process your messages and page content to generate the assistant's replies. Depending on the provider, this may take place outside the EU/EEA (for example in the United States) under Standard Contractual Clauses or an equivalent safeguard.
• Hosting provider — our servers are hosted in the EU.
• Stripe (payment provider) — processes subscriptions and credit purchases. Card details are entered on Stripe's secure page; we never see or store card numbers.

We do not sell your personal data and do not use it for advertising. A list of our current processors is available on request.

How long we keep it

Chats are kept until you delete them or close your account. Usage and billing records are kept as long as required by law. Server logs are kept for a short period for security.

Your rights

You can access, correct, export or delete your data, object to or restrict processing, and withdraw consent where applicable. You can delete individual chats in the extension at any time. You also have the right to lodge a complaint with your local data protection authority (in Lithuania: the State Data Protection Inspectorate).

Security

Data is encrypted in transit (HTTPS). Passwords are stored as salted hashes. Access to production systems is restricted.

Changes

We may update this policy. Material changes will be announced on the website or by email.