Shadow AI Sensor privacy policy

What this extension is

ColossalX Shadow AI Sensor is a browser extension for organisations. An organisation's IT team installs it on its managed browsers and connects it to the organisation's own ColossalX workspace. It helps the organisation's security team see which AI services are used in those browsers, and carries out the organisation's AI usage policy on them.

It is not a consumer product. If your employer or school installed it, your organisation controls it and you may not be able to remove it. Ask your IT or security team about their own use of the data. This policy describes what the extension itself does.

The extension sends nothing anywhere until it has been given a workspace address and an enrollment key.

The short version

• Reports to your organisation's workspace: the name and hostname of an AI service that was used, how many times, and the work identifier your organisation set up (for example a work email address or employee id). Which local AI model runtimes are running on the device. What the organisation's policy did on a service (a notice, a redirect, a restriction or a block) and how many times.
• Never collects: what you type, paste or upload, or what an AI service replies. Page contents. Full web addresses, search terms or form values. Cookies or passwords. A record of other websites you visit.
• Sends it to: only the workspace address your organisation configured. No third party, no analytics, no advertising.
• Sells or shares it: no.

What it handles, in detail

• Workspace address, enrollment key and work identifier. Set by your organisation through browser management policy, or typed on the extension's options page for a pilot, and stored on the device. The address says where to report. The key is a credential issued by the workspace that proves a report comes from an enrolled browser; it is sent with each request. The identifier is sent with the reports so the organisation can tell who used a service. It is whatever your organisation chooses to configure.
• The address of the page you are on. The extension's page script runs on web pages so that it can recognise a listed AI service. It passes the page address to the extension's own background process, which keeps only the hostname, compares it with the organisation's list of AI services and discards it if there is no match. For a page that is not on the list, nothing is stored and nothing is sent.
• That a prompt was submitted. When you press Enter in a text box or click a send-style button on a listed AI service, the extension counts that the event happened. It never reads the text box's contents. To tell a send button from another button it looks at the button's own accessible name or test label; that is not stored or sent.
• Hostname and counts of listed AI services. Held on the device in a small buffer (hostname, count, work identifier, and the times of first and last use), then sent as a report. The times are not part of the report; the workspace knows when each report arrived.
• Local AI model runtimes. The extension asks a few fixed addresses on your own device (127.0.0.1) whether a local AI runtime is answering, and records only that it answered. The answer's content is not read. The runtime's name, a count of how many periodic checks found it running, and the work identifier are reported.
• What the policy did. When your organisation's policy applies a notice, redirect, restriction or block on a service, the extension counts it (for example "coached", "continued", "redirected", "restricted" or "blocked") with the hostname and the work identifier, and reports it. A choice to continue after a notice is remembered on the device, for that hostname, for the number of hours the workspace sets (8 by default).
• Pasted or dragged content, when a restriction is on. The extension only checks whether what is arriving is a file, and refuses the action. It never reads what is pasted, dragged or chosen.
• A random device identifier. Made once by the extension on install and kept on the device, then sent in a request header so the workspace can count how many browsers are enrolled. It is not your name, your device's serial number or your browser profile. A new one is made if the extension is reinstalled.
• Browser name and extension version. Sent in request headers: whether the browser is Chrome, Edge or another browser, and the extension version.
• Your network address. As with any internet request, the workspace's server sees the network address a request came from. The extension does not read, record or add it.

What it never collects

The extension has no code that reads a text box's contents, a page's text or HTML, form values, cookies, browser storage belonging to a website, saved passwords, clipboard contents, files, or the browser's history. It does not take screenshots and does not record keystrokes. It does not ask for browser permissions for cookies, history, downloads, web requests or the clipboard. Automated tests fail the build if the source uses the browser features that would read text boxes, page text, cookies or website storage, or if the manifest asks for any of those permissions.

Who it talks to

• Your organisation's ColossalX workspace, at the address your organisation configured (normally a subdomain of astrabastion.com). It fetches the organisation's list of AI services and its policy, and sends reports. The extension's browser permissions cover https workspace addresses only; plain, unencrypted http is covered only for your own device.
• Your own device, for the local runtime check above.

The extension contacts no other server. It has no advertising, no analytics, no tracking and no third-party code. Your browser itself talks to the Chrome Web Store to install and update the extension; that is the browser's doing, not the extension's.

If a workspace address outside astrabastion.com is used, the browser asks the person for permission to reach that single address before the extension will contact it.

After a report is sent

Reports are received by your organisation's ColossalX workspace, which Quantexra Labs LLP runs for your organisation. Your organisation's security team sees them in the workspace. How long the workspace keeps them, and which of your organisation's staff can see them, is set by your organisation and by its agreement with us. Ask your organisation's security team for those details.

We do not use these reports for advertising, to profile people, to make a credit or lending decision, or for any purpose other than providing the service to the organisation.

Storage on your device and removal

The extension keeps the items above in the browser's own extension storage on your device. It does not add its own encryption on top of that; they are protected by your operating-system account and your browser profile.

A report that cannot be sent is kept on the device and sent later, so that a network failure is not mistaken for "nothing was used". Once a report is sent, its buffer is cleared.

Uninstalling the extension removes this data from the device. If your organisation installed it by policy, only your organisation can uninstall it.

How we use data: Chrome Web Store Limited Use

The use of information received by this extension complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.

• The data is used only to provide the extension's single purpose: helping an organisation see and govern the use of AI services in its managed browsers.
• It is not transferred except to the organisation's own ColossalX workspace, and where the law requires or for security.
• It is never used or transferred for advertising, including personalised or interest-based advertising.
• It is never used or transferred to determine creditworthiness or for lending.
• No person reads it except the organisation's authorised administrators using the workspace, as the product is designed; or with consent, for security, to comply with law, or in aggregate.

Roles

Your organisation decides to install the extension, which AI services it watches, what policy applies and what the work identifier is. Quantexra Labs LLP provides the extension and runs the workspace for your organisation. For the personal data the organisation chooses to have reported, the organisation decides how it is used, and we process it for the organisation to provide the service.

Your choices and rights

• Ask your organisation's IT or security team what is reported about you, why, and how long it is kept. They decide the policy.
• On a device not configured by policy, the extension's options page shows when the last report was sent and how many services are waiting to be sent.
• To ask us a question, or about your data in the workspace, write to client.success@quantexra.tech. For data your organisation controls, we may direct your request to the organisation.
• The extension is not directed at children.

Changes to this policy

If a new version of the extension changes what it reads or sends, this policy is updated before that version is published, and the date at the top changes with it.

Contact

Quantexra Labs LLP, Bangalore, India. client.success@quantexra.tech.

This policy covers the extension. The website has its own website privacy notice.