What we collect, and what we don't.

Guerrilla Bots Pvt. Ltd. (“Guerrilla Bots”, “we”), based in Bangalore, India, builds Guerrilla Process Automation (GPA) tools: I² Recorder (a Chrome extension that records browser actions), Operative (a Windows desktop app that runs and stores your automations locally), and Workbench (the web app at guerrillabots.com where recorded automations are reviewed and edited).

Account information. Email address and authentication data, via Supabase Auth. If you sign up for the waitlist, also your name, company, and role if provided.

Workflow & automation data. When you record a workflow in Operative and push it to Workbench, we store: the sequence of actions (e.g. “click this element”, “type into this field”), element selectors, the Excel cell addresses/sheet names/column headers you choose to read or write during Excel Debrief, and the input/variable names in your workflow's data model. We do not ingest your Excel files or file contents wholesale. Only the specific cells, ranges, or table columns you explicitly select while recording.

Screenshots. Cropped images of the specific elements you interact with while recording (so you can visually confirm what a step does later), stored privately per account with access-controlled signed URLs.

Usage & diagnostic data. Which API endpoints were called, how long they took, and coarse token counts for AI calls, not the content of what you recorded or narrated. Used for rate limiting and debugging, not analytics on your business data.

Support & contact data. If you use the support form, whatever you choose to include: your message, an optional reply email, and an optional screenshot. This goes directly to our support inbox by email. It is not stored in our database.

Device information. A device identifier and app version for each machine running Operative, so we know which installs are active. No hardware fingerprinting beyond this.

Passwords and logins. We don't ask for your passwords and we don't keep a store of them. When a bot reaches a login screen, you log in yourself and the bot carries on. An update to the recorder and Operative, now in progress, makes sure anything typed into a password or login field during recording is never saved or sent to us. Until that update reaches you, please don't record yourself typing a password.

Your Excel/file contents. Operative reads and writes your files locally on your machine. Only the specific values you record (a cell, a column, a table, and the values you changed while recording) are sent to our AI calls for interpretation. The file itself never is.

Passive browsing. I² Recorder only captures DOM actions while you've explicitly started a recording session. It does not run in the background monitoring your browsing.

To run the product: turning what you record into an editable, re-runnable automation, and letting you review/edit it in Workbench. To improve AI accuracy: cell context, narration text, and recorded actions are sent to our AI provider per-call to interpret what you meant (see below). To communicate: waitlist emails, support replies, and account-related notices. We do not sell your data, and we do not use your recorded workflow content to train AI models.

Microsoft Azure OpenAI (South India region): processes the cell context, page element details and narration text needed to interpret a recording step. Microsoft may keep these for up to 30 days to check for abuse, then deletes them. They are not used to train models.

Amazon Bedrock: a backup AI provider, used only if Azure is unavailable.

Microsoft Azure AI Speech (Central India region): turns your voice narration into text. We don't store the audio.

Upstash: counts requests per account so we can apply fair-use limits.

Supabase: our database, authentication, and private file storage provider (Postgres + object storage), hosted on Supabase's infrastructure.

Vercel: hosts guerrillabots.com and its API.

Resend: sends transactional email (waitlist confirmations, support form submissions).

Axiom: optional operational logging (endpoint, latency, error codes) for debugging. Not used for every deployment.

Data in transit is encrypted (HTTPS/TLS). Screenshots are stored in a private object storage bucket, isolated per account, accessed only via time-limited signed URLs. Not publicly browsable. Your sign-in to Guerrilla Bots is stored encrypted on your PC, tied to your Windows account.

We're a small, pre-revenue team. We follow reasonable security practices for a company at our stage, but we do not yet hold formal certifications (e.g. ISO 27001) or enterprise-grade secret storage, command signing, or audit-log system. Those are on our roadmap, not in place today. If your organisation needs a specific compliance posture before adopting Guerrilla Bots, contact us and we'll tell you honestly where we stand.

Workflow data and screenshots are kept as long as your account is active. Support form submissions exist only as an email in our inbox. We don't retain a separate copy. You can request deletion of your account and associated data at any time (see Contact below).

You can download everything stored in your account at any time from Settings. Server logs that record which features you used (never what you recorded) expire on their own. You can delete your account from Settings. It is deleted after 7 days, and you can cancel before then.

You can request access to, correction of, or deletion of your personal data by contacting us. If you're in India, this is handled consistent with the Digital Personal Data Protection Act, 2023; if you're elsewhere, we'll do our reasonable best to honor equivalent rights (e.g. GDPR-style access/erasure requests).

Guerrilla Bots is a business automation tool, not directed at children. We don't knowingly collect data from anyone under 18.

If this changes materially, we'll update the effective date above. Significant changes will be called out, not buried in a diff.

Questions, data requests, or anything else: guerrillabots@gmail.com, or use the support form.