Shield Web — Browser Extension Privacy

Data we collect through the extension

• Account data: your email and the organization/user identifiers from your Shield Control account, to authenticate you. The session is stored locally in the browser.
• AI-service usage (discovery): when you visit a supported AI service (e.g. ChatGPT, Claude, Gemini, Copilot and others), we record the service's domain, a timestamp, and your organization/user identifiers.
• Policy-enforcement events (audit): when you take a monitored action (submitting a prompt, pasting text, uploading a file), we record the action type, the outcome (allowed / warned / blocked / redacted), the policy applied, the redaction count, and the category labels of any sensitive data detected on your device (e.g. "pii", "financial" such as credit-card or IBAN numbers, "secrets", "source_code").
• Error diagnostics: technical error reports without personal content (Sentry).

Data read on your device (never transmitted)

To enforce your organization's policies, the extension reads — locally on your device — the prompts you submit, the text you paste, and the text of files you upload to supported AI services, including any personally identifiable or financial data within them. This is why website content, personal communications, personally identifiable information, and financial and payment information are among the extension's declared data types. None of this content is ever transmitted, stored, or shared: sensitive-data detection and redaction run entirely on your device, and only the derived category labels and counts described above leave it. When a redaction policy applies, detected values are replaced with placeholders locally and never leave your device.

How we use it

To provide the service your organization deployed: an inventory of AI tools in use, enforcement of your organization's DLP policies, and a compliance audit trail. We process only the metadata described above — never the content of your prompts, pasted text, uploaded files or AI responses, and never the values of any sensitive data detected on your device.

Storage & retention

Locally (chrome.storage): your session, a short-lived policy cache, and settings. Backend: discovery and audit events are stored in Qadar AI's Supabase database (EU region), scoped to your organization via row-level security; retention follows your organization's agreement — absent a specific term in your organization's Data Processing Agreement, discovery and audit events are retained for at most 24 months and then deleted. All data transmitted to our backend is sent over encrypted connections (TLS).

Who we share data with

We do not sell your personal data, we do not use it for any purpose unrelated to the service your organization deployed, and we do not transfer it to anyone other than the sub-processors below. Each processes data on our behalf, only on our documented instructions, under a data processing agreement:

• Supabase (EU region): stores the discovery and audit events and handles account authentication — i.e. the metadata listed above, never prompt or file content.
• Cloudflare: provides hosting, WAF/DDoS protection and the edge/API gateway that the extension's backend requests pass through, plus Browser Rendering for the Qadar AI platform.
• Resend: sends the transactional and notification emails the service requires — invitations, sign-in confirmations, and access-request notices. It processes the recipient's email address and the links contained in those emails, never your discovery or audit data.
• Sentry (EU region): receives technical error diagnostics only, with no personal content.

Your organization's administrators can access the data in their Shield Control workspace. Session-handoff and sign-out requests go to api.qadar.ai, Qadar AI's own first-party endpoint — not a third party. When the companion Shield Desktop app signs you in, only a single-use sign-in token is exchanged — never your password. We never sell, rent, or otherwise transfer your data to unauthorized parties, and we never use it for advertising or any purpose unrelated to Shield Web's security and governance function. The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Permissions

We request only what the purpose requires: local storage; alarms (session refresh); the side panel; the active tab's URL on click; access to your Shield Control workspace and our backend, including our api.qadar.ai gateway (session continuity); native messaging to the companion Shield Desktop app, if your organization deploys it, so you stay signed in across both; and content scripts on the supported AI services it monitors.

Controller & contact

Qadar AI Limited, DIFC Innovation Hub, Dubai (see the Legal Notice). First-run consent is shown in the extension.