Extension privacy policy

1. Who we are and who this policy applies to

This policy describes how the Ontik Guard browser extension handles data. It is published by Frivv SRL, a private limited company under Belgian law, with its registered office at Rue de La Loge 43, 7866 Lessines, Belgium, registered with the Crossroads Bank for Enterprises under number 0783.850.466, telephone +32 2 588 44 74 ("Ontik", "we").

Ontik Guard is a professional tool. It is installed by the employer or the organisation that is Ontik's customer ("the customer") on the workstations it manages, alongside the Ontik platform. It is not intended for the general public.

The processing of data within the Ontik platform itself is described in our general privacy policy: https://ontik.be/donnees.

2. What the extension does

Ontik Guard reduces the risk that sensitive organisational data is sent to public artificial-intelligence services. Depending on the policy chosen by the customer, the extension can:

• measure visits to a defined list of AI services, without blocking anything;
• warn the user when sensitive data is detected in a text they are about to send;
• block the sending and offer to continue in the Ontik platform;
• redirect to Ontik any visit to an AI service the customer has not authorised.

The detection of sensitive data (for example a national register number, an IBAN, a company number, an API key, or confidential terms defined by the customer) runs entirely on the user's device. The analysed text is never sent to Ontik or to any third party for analysis.

The extension only acts on the websites of the AI services on its list and on Ontik's own websites. It stays inactive on every other website.

3. What the extension never collects

• The content of what the user types, pastes or drops on the AI services' websites.
• The files themselves: only their name is examined locally, and it is never transmitted.
• Browsing history, apart from the simple fact that an AI service on the list was visited.
• Keystrokes, screenshots, passwords, cookies or form data.
• By default, no identity data about the user (name, e-mail address): see section 4 for the named-user option, which is disabled by default.

Ontik does not sell any data, does not use it for advertising purposes and does not use it to train artificial-intelligence models.

4. Data processed and transmitted

The extension transmits to Ontik only technical information and minimal events, without content.

Once handed to Ontik, the redirected text is processed by the Ontik platform under its general policy: sensitive data detected in the text and in the document extracts is masked before the call to the AI model (masking by default, a setting of your employer), under a contract that excludes training; the call to the engine is counted, without its content.

Named-user option. The customer can enable an option that associates events with the user's identity. It is disabled by default. Enabling it requires a dated attestation from the administrator confirming that workers and their representatives have been informed and consulted, to be renewed every 12 months.

The device-name fingerprint is pseudonymised data, not anonymised data: the customer, who holds the inventory, can link it to a device, and therefore possibly to a person.

5. GDPR roles, purposes and legal bases

The customer is the data controller. It decides to deploy Ontik Guard, chooses the applicable policy and informs its workers. Ontik acts as a processor, on behalf of the customer and on its instructions, under a data processing agreement (Article 28 GDPR).

Ontik acts as a controller only for the technical data needed for the security, proper operation and improvement of the service (for example error logs, which contain no user content).

Purposes: protect the customer's confidential information and the personal data it holds; prevent data leaks to third-party services; demonstrate its compliance efforts.

Legal basis for the customer: its legitimate interest (Article 6(1)(f) GDPR) in securing its data, and its security obligations (Article 32 GDPR). The customer assesses this basis against its own framework, in particular the applicable employment law.

Before deployment, the customer informs its workers and their representatives. Ontik provides a compliance kit (information notice, clause for the work rules, data protection impact assessment template).

6. Retention, security and processors

Retention. Events are kept for the period chosen by the customer, by default 395 days (13 months) for event counters; the record of a device silent for 90 days is deleted together with its token; the settings audit log is kept for 5 years. The redirected text is erased from the browser's memory as soon as it is handed to Ontik, and after 10 minutes at the latest. At the end of the contract, the customer's data is deleted within 60 days.

Security. Exchanges between the extension and Ontik are encrypted (HTTPS). The configuration sent to the extension is cryptographically signed, and the extension rejects any configuration not signed by Ontik. Device tokens are stored as fingerprints, renewed regularly and revocable by the customer. The extension does not execute any remotely downloaded code.

Hosting and processors. The database and the application are hosted in the European Union (Frankfurt). Sub-processors for Guard data: Supabase (database, project in the Frankfurt region; company established in Singapore, support access possible from outside the EU, European Commission standard contractual clauses), Netlify (application hosting, company established in the United States, functions executed in the Frankfurt region, worldwide content delivery network, standard contractual clauses and EU-US Data Privacy Framework certification), Resend (e-mails to administrators, company established in the United States where sending logs are kept for 30 days, standard contractual clauses). No content typed by the employee passes through these providers via Guard. Microsoft (Entra ID) acts on behalf of the employer, whose directory provider it is. The detailed list of processors, their countries of processing and the applicable safeguards are in the compliance kit provided to the customer.

7. Extension permissions

The full list of websites concerned can be consulted at any time on the extension's status page (Extensions menu > Ontik Guard > Options, "Covered services" section); it also appears in the permissions shown on the extension's store listing.

8. Rights of individuals and contact

Users have the rights provided by the GDPR: access, rectification, erasure, restriction, objection. As the customer is the controller, these rights are exercised first with the customer, usually its HR department or data protection officer. Ontik assists the customer in responding.

For any question about this policy: privacy@ontik.be.

Anyone may lodge a complaint with the Belgian Data Protection Authority (APD/GBA), Rue de la Presse 35, 1000 Brussels, www.dataprotectionauthority.be.

9. Store rules, versions and changes

Ontik Guard's use of data complies with the rules of the extension stores, including the Chrome Web Store "limited use" requirements: the data serves only the protection function described here, is neither sold nor transferred to third parties except under a legal obligation or for processing necessary to the service, and is not used for creditworthiness assessment or advertising.

This policy is dated and versioned: its version number and date appear at the top of the page, and the address of this page does not change. We may update it; each update carries a new date, and the version history is provided on request at privacy@ontik.be. In the event of a significant change, customers are notified in advance by e-mail.