Privacy Policy

Overview

Cereal ("we," "us," or "our") makes a desktop app for AI browser automation, based in Rotterdam, the Netherlands. We are committed to protecting the privacy of our users. This Privacy Policy outlines how we collect, use, disclose, and safeguard your personal information when you use our website, platform, and services.

Ready-made scripts and the AI browser agent run in the Cereal app on your own computer. When you use the agent with a cloud model, the page content it reads and your prompts go to the model provider you pick; see AI browser agent below. This policy explains what we process, what goes to your model provider, and why.

By accessing or using the Cereal website or platform, you agree to the terms of this Privacy Policy.

Information We Collect

Account Information

To use the Cereal platform, you must create an account. We collect and store the following information:

• Full name
• Email address
• Encrypted password
• Additional information provided during account creation

Desktop App Data

Scripts store the settings you give them on your computer, such as what to watch, sign-ins for the sites they work on, and where to send alerts. A script or agent run uses them only on the websites you point it at.

AI browser agent

The AI browser agent uses a model you choose, with your own API key (bring your own key). Your key never reaches Cereal; the agent's model calls go only to the model provider you pick, or stay on your machine with a local model.

• Page content and prompts. During a goal run, the agent sends your goal and the content of the pages it works on to the model provider you pick (for example Anthropic, Google Gemini, OpenAI or OpenRouter). With a local model, such as one served by Ollama or LM Studio, they stay on your machine.
• Your API key. Your key goes only to that provider. It is never sent to Cereal.
• Repeat. When Repeat replays steps the agent has learned, it does not call the model. If the site has changed, the model steps back in, and page content is sent again.
• Sign-in secrets. Your passwords are typed by Cereal, not the AI: the model only sees a placeholder, and secret values are removed from logs. This covers secrets Cereal types during the run. Anything a website itself shows on the page, such as your name or address once you're signed in, is page content and can reach the model.
• Goal run reports. With Share diagnostics on (the default), Cereal receives your goal (masked), the start URL, the outcome and the cost of each run, keyed by a random install id. Kept 12 months.
• Failure reports. Only when a check fails or you report it: what the agent saw on the pages (which can include content from sites you're signed in to), its steps and the model's replies. Passwords, form values, emails, card and phone numbers and URL query strings are masked first, and screenshots are never sent. Stored privately, deleted after 30 days, used only to debug the agent, keyed by install id. Turn it off in Settings › Privacy.

Your model provider handles what you send it under its own terms and privacy policy, which we don't control. Free tiers may let the provider use your data; a paid key or local model keeps it private.

Waitlist

If you join the AI browser agent waitlist, we store your email address, and whether you'd test a beta, with our email provider Buttondown. You confirm your signup by email, we only email you about the AI browser agent, and you can unsubscribe at any time.

Developer Portal Data

When developers use our developer portal to upload scripts, we collect and store information necessary for script management and distribution.

Usage Information

We collect information on how you use our platform, including:

• Scripts downloaded and subscribed to
• Tasks and automation execution details
• Script configurations provided by users

Cookies and Analytics

Our website does not use cookies. We use Cloudflare Web Analytics (provided by Cloudflare, Inc.) to understand how visitors find and use the site. It is a privacy-first, cookieless analytics tool: it sets no cookies, does not use fingerprinting, does not track you across websites, and does not store any personal data about you.

To count page views, the analytics beacon processes limited, aggregate technical information such as the page visited, the referring source, and general browser and device type. This data is used only in aggregate to measure traffic and improve the website. We do not use it to identify you personally, and we do not sell it.

Because no cookies are set and no personal data is stored, no consent banner is required to use the website. You can also block the analytics beacon using your browser's privacy or content-blocking controls; doing so does not affect your ability to use the website.

The Cereal desktop app itself does not load website analytics; this section applies to our website only.

Legal Basis for Processing

If you are in the European Economic Area or the United Kingdom, we process your personal information under the following legal bases:

• Performance of a contract — to provide your account and the services you request.
• Legitimate interests — to operate, secure, and improve our platform and website (including aggregate analytics, and debugging the product with the AI browser agent's goal run reports and failure reports, which you can opt out of by turning off Share diagnostics).
• Consent — where required; you may withdraw consent at any time.
• Legal obligation — to comply with applicable laws.

How We Use Your Information

We use the collected information for the following purposes:

• To provide and improve our platform and services
• To personalize user experience
• To manage and distribute scripts
• To communicate with users
• To comply with legal obligations

Data Retention

We keep account and platform information for as long as your account is active and for as long as necessary to provide our services, comply with legal obligations, resolve disputes, and enforce our agreements. When information is no longer needed, we delete or anonymize it. AI browser agent goal run reports are kept for 12 months, and failure reports are deleted after 30 days. Website analytics are aggregate and cookieless, and are retained according to Cloudflare Web Analytics' retention period.

Data Security

We prioritize the security of your information. All data stored on our servers is encrypted, and access is restricted to authorized personnel only.

Sharing of Information

We do not sell, trade, or rent your personal information to third parties. What the AI browser agent sends to your model provider goes straight from your computer to that provider; we don't receive or share it. We may share information with:

• Third-party service providers assisting in platform operation (such as hosting, email and analytics providers)
• Developers for script management and support
• Authorities where required by law

International Data Transfers

Some of our service providers, including Cloudflare, may process data outside the European Economic Area. Where this happens, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses to protect your information.

Your Rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to withdraw consent. You can manage your account settings and subscriptions through the Cereal platform, or exercise these rights by contacting us at [email protected]. If you are in the EU or UK, you also have the right to lodge a complaint with your local data protection authority.

Children's Privacy

Cereal is not directed at children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, please contact us so we can remove it.

Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in our practices. We will update the "Last updated" date above when we do. Check this page regularly for updates.

Contact Us

If you have any questions or concerns about this Privacy Policy, contact us at [email protected].