Nehlos

AI Privacy Guardian — Privacy Policy

Last updated: [DATE — set on publish] · Publisher: Nehlos · Contact: [privacy@nehlos.com — confirm address]

AI Privacy Guardian ("the Extension") is built to prevent sensitive data from leaving your browser. Protecting your privacy isn't a side concern for us — it's the product. This policy explains, plainly, what the Extension does and does not do with your data.

The short version

• All detection runs on your device. The Extension scans text locally in your browser. It does not send the content of your prompts, the text you type, or the sensitive data it detects to Nehlos or anyone else.
• By default, nothing is transmitted off your device. For individual users, the Extension operates entirely locally with no network transmission of your data.
• Organizations can optionally enable event logging. If your organization deploys the Extension with cloud logging configured, the Extension sends limited event metadata (described below) to the backend your organization controls — never your prompt text and never the sensitive values themselves.
• We do not sell your data, show ads, or use your data to train models.

What the Extension processes locally

To detect sensitive data, the Extension reads the text you enter into supported AI platforms (e.g., ChatGPT, Claude, Gemini, Copilot) and compares it against detection patterns. This analysis happens entirely within your browser. The text is held only in memory for the moment it takes to analyze it and is not stored or transmitted by this process.

The Extension stores the following locally on your device (via the browser's storage API), and this data never leaves your device unless your organization has enabled cloud logging:

• A local activity log (event type, the category labels of what was detected, platform domain, timestamp) so you can review your own history.
• Local counters (number of warnings, overrides, clean scans).
• A randomly generated installation identifier.
• Your organization's configuration, if provided (API endpoint, key, department label).

What is sent off-device — only if your organization enables cloud logging

Some organizations deploy the Extension centrally to monitor coverage and policy compliance. This is off by default and only active when an organization configures an API endpoint and key. When active, the Extension transmits event metadata only to the endpoint your organization controls:

• Event type (warning shown, user override, or clean submission)
• The category/label of the data type detected (e.g., "Social Security Number," "CUI Marker") — not the value itself
• Severity level and whether it was a combined-risk finding
• The platform domain where the event occurred (e.g., chatgpt.com)
• A machine/installation identifier and optional department label
• Extension version and a timestamp

What is never transmitted, under any configuration: your prompt text, the actual sensitive values detected (SSNs, card numbers, addresses, etc.), your keystrokes, your browsing history, or page content beyond the metadata above. The matched text never leaves your device.

When cloud logging is active, the Extension's on-screen notice reflects this honestly ("your organization logs event metadata — never your prompt text"). When it is not active, the notice states that all processing is on-device.

Permissions and why we request them

• Host access to specific AI platforms — so the Extension can scan prompts and show warnings only on those sites. It does not run on other websites.
• storage — to keep your settings and local activity log on your device.
• activeTab — to show the current page's protection status in the popup.
• alarms — to schedule periodic coverage check-ins (only used when an organization has enabled logging).

The Extension does not request broad ("all sites") access, and does not read or transmit content from non-AI websites.

Data sharing, retention, and your rights

• No sale or advertising. We do not sell, rent, or share your data with third parties for advertising or any other purpose.
• No model training. We do not use your data to train AI models.
• Individual users: all data is on your device. Uninstalling the Extension or clearing the log removes it.
• Organization-managed deployments: event metadata is held by your organization under its own retention and access policies; direct data-subject requests to your organization's administrator.
• Children: the Extension is intended for workplace and adult use and is not directed at children under 13.

Chrome Web Store limited-use disclosure

Our use of information received from the Extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. We collect only the limited event metadata described above (and only when an organization enables it), use it solely to provide the security-monitoring functionality, and do not transfer it except as necessary to provide that functionality to the deploying organization.

Changes

We will update this policy as the product evolves and revise the "Last updated" date. Material changes will be reflected in the Extension's store listing.

---

Drafting note for Romeo: confirm the contact email, set the publish date, and host this at a stable public URL (e.g., nehlos.com/privacy). The Chrome Web Store listing requires a link to a live privacy policy, and the data-use answers in the developer dashboard must match this document exactly.