Staffinc Browser Bridge — Privacy Policy

Applies to the Staffinc Browser Bridge browser extension. Last updated 28 September 2026.

The Staffinc Browser Bridge lets the Staffinc agentic platform operate a browser tab on your own computer, so that work on sites you are already signed in to does not require handing your credentials to a server. It also runs a Staffinc WhatsApp number through WhatsApp Web in that same browser, so the agent can carry the conversations Staffinc has with the workers it staffs. It is distributed privately to Staffinc staff and is not offered to the general public.

What the extension can reach

It acts only on origins you have granted in the extension's own side panel, and only in a tab it opened itself, in its own window. It never acts on the tab you are looking at, and it cannot read any other tab. The Staffinc server can ask for an origin, but it cannot grant one — only a click in the panel can. Removing every grant stops the extension from operating any website.

WhatsApp Web is separate from that list. If you pair a Staffinc WhatsApp number, the extension also works inside web.whatsapp.com in this browser, which it reaches by a permission declared in the extension rather than by a grant in the panel — so removing your origin grants does not stop it. It acts only on the number you paired, and only while that connector is connected. Disconnecting it in the Staffinc app, or signing that number out of WhatsApp Web, stops it.

What is stored on your computer

• Your Staffinc sign-in tokens (identity and refresh), handed over by the Staffinc app when you pair.
• The list of origins you have granted, or the flag recording that you allowed the whole browser to be driven.
• The address of the Staffinc backend the app paired you to.
• For the current browser session only: each conversation's automation tab id, the last 20 actions shown in the panel, and a short-lived command journal used to avoid repeating actions after reconnecting. Journal entries, including cached responses, expire after ten minutes as new commands arrive.

All of this lives in the browser's own extension storage. Uninstalling the extension removes it.

What is sent to Staffinc

• The content of pages the agent reads. When the agent takes a snapshot, the text and interactive elements of the page — as an accessibility tree, not an image — are returned to the Staffinc backend and passed to the AI model that is carrying out your request. Anything visible on a page the agent is working on can therefore reach the model, including personal data shown on it.
• Screenshots requested by the agent. A viewport image can be sent to the Staffinc backend and selected AI provider to help interpret the page. Screenshot payloads are stored separately from the conversation with a 30-day expiry and are deleted with the session. These images may contain personal information visible on the page. Embedded page origins must also be allowed before a screenshot can be captured.
• A record of every action. Each tool call is logged with the action name, the origin it ran on, whether it succeeded, and its input — which for a typing action includes the text typed into the page. This is the accountability record for automation acting under your account.
• Messages on the paired WhatsApp number. While a WhatsApp connector is connected through this browser, messages sent and received on that number — text, attachments, the sender's number and the time — are sent to Staffinc and kept in your Staffinc workspace, so that the agent can follow a conversation across turns and answer it. This covers the paired number only; other chats in that WhatsApp account are not read, and no other WhatsApp account is touched.
• A label for the browser, the extension version, and a periodic heartbeat so the app can show whether the bridge is connected.

Page content is sent to the AI provider selected for the session under Staffinc's applicable commercial agreement with that provider.

What is not sent anywhere

• The live picture of the automated tab is streamed directly to the Staffinc app tab in the same browser, over an in-browser channel. That live stream is not uploaded or recorded; separately requested agent screenshots are described above.
• Your browsing history, bookmarks, downloads, saved passwords, cookies and other tabs are never read.
• The extension asks for no credentials. When a site needs you to sign in, it hands the browser back to you so that you type into the real page yourself.
• Nothing goes to a third party. The open-source WhatsApp Web library this extension uses ships with analytics reporting and with link previews resolved through servers run by its community; both are switched off in this build, so neither your usage nor any link in a message reaches anyone but Staffinc and the AI provider above.

Retention and deletion

• Disconnecting the Your Browser integration in the Staffinc app deletes the pairing record for that browser.
• Uninstalling the extension removes everything it stored locally, including your tokens.
• The action log described above is retained on Staffinc's systems as an audit record and is not deleted when a browser is unpaired.
• WhatsApp messages stored in your workspace stay there when the connector is disconnected; disconnecting stops new ones being collected. Ask at the address below to have them erased.
• To request access to, or erasure of, data held about you, contact Staffinc at the address below.

Why the extension asks for the debugger permission

Operating a page the way a person does — a real click, real typed keystrokes — requires Chrome's DevTools Protocol, which is what this permission grants. It is used only on granted origins and only on the bridge's own tab, and Chrome shows its "is being debugged" bar on every tab it is used on, so the automation is always visible to you. Clicks are hit-tested before they are dispatched, so a click cannot land on something you could not see.

Contact

Staffinc Group — privacy@staffinc.co.