Chrome extension privacy

Your organisation's collection

Collection starts after you pair the extension and your organisation enables monitoring. Collected information goes to the HTTPS Promptective portal you select during pairing. Your organisation controls collection, service exclusions and retention in that portal.

Your organisation's authorised administrators and reviewers can read retained submitted prompt text. This text can contain personal, confidential or sensitive information you submit to an AI service. Pair only with the organisation and portal you intend to share this information with.

Your organisation directs the handling of its governance records. Contact its IT or privacy contact about its monitoring policy, lawful authority, access and retention. Promptective processes those records to provide the service to that organisation.

Information collected

• AI destination activity: matched AI service or registered destination domain, event type and time, service classification, browser installation and regular-window status. Visits and connections are separate from prompt submissions. Potential AI destinations are labelled as candidates using multiple domain signals.
• Submitted user text: when prompt capture is enabled, the latest user text from a supported generation request, up to 8,000 Unicode characters. Records include the service, time, original text length, any truncation marker and the observed HTTP/network outcome. Supported outgoing Microsoft 365 Copilot and Character.AI messages have an unconfirmed server-acceptance outcome.
• Supported AI account settings: when settings collection is enabled on supported ChatGPT, Claude and Perplexity layouts, pseudonymous account/workspace fingerprints, a bounded workspace display name, observed personal/work environment, plan and training settings, with their source and time. Unavailable settings remain unknown. A settings snapshot can accompany a submitted prompt. Fingerprints are pseudonymous identifiers, not anonymous data.
• Browser connection information: the browser name you enter, installation and sensor identifiers, extension version, connection and permission health, queue/delivery counters, policy state and last contact time.
• Account information: the signed-in browser profile's reported email is used for licence grouping and, if configured, organisation account linking. Its account identifier helps detect account changes. Optional Microsoft linking can associate records with a name, principal name, tenant/user identifiers and the original linking method. The reported browser account alone is not authentication proof.
• Authentication and service records: one-time pairing codes, per-browser credentials and signing-key state secure the connection. The portal separately handles account email, password hashes, membership, session and verification records, and optional MFA. Service infrastructure receives network addresses and connection metadata needed to communicate, authenticate and prevent abuse.

Submitted text can include health, financial, location, identity, communication or authentication information. Sensitive-information analysis does not guarantee that secrets or personal information are removed before storage. The sensor does not read provider password fields, authentication headers or cookies.

Capture limits

The sensor excludes drafts, keystrokes, earlier conversation turns, attachments, AI responses, page titles, complete page URLs and unrelated browsing history. Complete request bodies and headers are not retained or uploaded. Known request bodies are inspected transiently to extract only the supported latest user text. Provider account-settings responses are read only through a bounded metadata allowlist.

Manually paired Chrome profiles do not collect Incognito activity. Native applications and server-side API calls are outside this sensor's scope. A destination visit does not establish a prompt submission, and an accepted HTTP request does not establish a completed AI answer.

How information is used

Promptective uses these records to maintain your organisation's AI inventory, submitted prompt history, account-settings reports, governance assessments, collection controls and authorised exports. Retained submitted text is analysed on the Promptective server to flag supported sensitive-information categories for review. Findings follow prompt retention and deletion.

The extension has no advertising or third-party analytics. It does not train models. Optional server model analysis performs inference on retained text within the service environment; this implementation has no cloud model inference endpoint or runtime model-training process. Findings do not change or block the original submission.

Promptective uses browser credentials and account/service records to authenticate access, allocate licences, deliver the service, maintain reliability and investigate security or abuse.

Access and service providers

Your organisation's portal permissions determine who can view retained metadata and prompt text. Prompt-history access is a separate permission. Authorised users may export records; exported copies are controlled by your organisation.

The hosted portal uses Amazon Web Services for application hosting, database and file storage, backups, infrastructure security and operational monitoring. Resend delivers portal account invitations, verification and recovery emails; it does not receive captured prompt history for email delivery. If your organisation enables Microsoft identity linking, Microsoft processes the sign-in or directory requests needed for that feature. The extension sends captured observations only to its configured Promptective endpoint.

Promptective staff access to specific user records is limited to the user's explicit consent for that access, necessary security investigations or legal requirements. We do not sell extension data, use or transfer it for advertising, or use it to determine creditworthiness or lending eligibility. Service providers process information only as necessary to operate the disclosed service. We may disclose information where required by law or necessary to investigate fraud, abuse or security threats.

The AI service you choose receives your submission through its normal website or API and applies its own terms and privacy policy. This extension does not change that provider's data practices. It also does not change provider account or training preferences.

Permissions and optional features

Chrome permissions let the sensor recognise AI destinations, inspect supported generation requests, keep its delivery queue, retrieve portal policy and show the current service. Packaged scripts run only on the supported ChatGPT, Claude, Perplexity, Microsoft 365 Copilot and Character.AI origins for the narrow settings and submission features described above. The extension does not download executable code.

Pairing requests access to the exact HTTPS portal you select. If your administrator enables API destination discovery, a separate Complete connection access setup action requests broader HTTPS website access. This is needed to observe supported AI API connections initiated from other sites. Only recognised or registered AI destination metadata is retained; the broader permission does not add a general request-body reader.

Hourly ChatGPT settings refresh is off by default. If your administrator enables it and a regular ChatGPT tab exists, a temporary inactive Data controls tab may open to read supported settings. It closes when the check finishes or after 90 seconds, unless you take over the tab. This refresh sends no prompt and changes no provider preference.

Storage and retention

The browser holds connection credentials, configuration, health information and a delivery queue of up to 500 records within 2 MB, including permitted submitted text. Pending requests and bounded settings/deduplication information also use browser session storage. Offline browsers use the last received policy until they reconnect. Uninstalling removes the extension's local storage; it does not delete uploaded server records.

Administrators choose evidence retention of 7, 30 or 90 days, and separate prompt-text retention of 1, 7, 30 or 90 days. Defaults are 30 days for evidence and 7 days for prompt text. Expired text and its analysis findings are removed independently of activity metadata. Inventory records, current reviews, first/last observation dates and lifetime totals remain until reset. Credential, account and security records have separate service lifecycles; receipt identifiers and bounded security audits are retained for up to 90 days.

Backups have separately configured expiry schedules. Deletion or reset does not immediately erase earlier backups, database storage or exported copies. Recovery applies the service's recorded privacy changes before restored records are made available. Ask your organisation or Promptective for the backup and export retention that applies to your service.

The store extension uses HTTPS for its portal connection. Browser-profile and operating-system protections safeguard local storage; the extension does not separately encrypt every local record. Hosted storage and backups require restricted access and encryption. Cloud deployments encrypt retained prompt text and analysis findings before database storage, using a separate key for each workspace. Authorised service processing decrypts these records when needed for review and analysis. Processing and support locations depend on the organisation's deployment and service providers; contact us for the arrangements that apply to your organisation.

Collection controls and requests

Your administrator can pause collection, turn submitted-text or settings collection off, exclude services, change retention, revoke a browser connection, delete retained prompt history or reset the workspace. Controls are in the portal; this extension has no individual pause or recording opt-out switch. Revocation stops further uploads when applied, while previously uploaded information follows retention and deletion controls.

For access, correction, deletion or a question about monitoring, contact your organisation's IT or privacy contact first. You can also contact Promptective at privacy@promptective.ai or use the privacy contact form. We will work with your organisation where it controls the records.

Chrome Web Store Limited Use

The Chrome Web Store User Data Policy and its Limited Use requirements set conditions for handling extension user data. We use and transfer information only for the disclosed AI governance purpose and the permitted service, security and legal uses described above.

Changes to this policy

We will update the date on this page when this policy changes. Material changes to collection or use will also be disclosed through the extension or portal before the changed handling begins, with consent where required.