Privacy Policy —
CLOAK Browser Extension

The extension is a workplace tool. It is deployed and configured by your employer or the organisation that manages your device (“your organisation”). Your organisation is the data controller: it decides why and how data is collected and processed, and it operates the CLOAK server that receives it.

Wardline Technologies provides the CLOAK software. Wardline does not operate your organisation's CLOAK server and has no access to the data the extension collects.

The extension only works when it is connected to your organisation's CLOAK agent on the same computer, which supplies the address of your organisation's server. The extension contains no built-in server address and cannot send data anywhere else.

The extension communicates with exactly two places:

• Your organisation's CLOAK server — hosted on your organisation's premises or in infrastructure under its control. All collection, analysis, storage and reporting happens there.
• The CLOAK agent on your own computer — reached only at the local loopback address (127.0.0.1), used to sign you in automatically and to receive policy settings. Nothing sent to the agent leaves your computer through this connection.

Detection of sensitive information (for example identity numbers, card numbers or source code) runs on your organisation's server, and some checks run directly in your browser. When the extension checks text in your browser, the text does not leave your computer for that check.

What is collected depends on the policy your organisation sets. The extension can collect the following:

The extension does not collect passwords you type into websites, form contents other than AI prompts, cookies, browsing data from private/incognito windows unless your organisation enables the extension there, or the contents of pages you read.

Data is collected only to protect your organisation's information, specifically to:

• warn you, or stop the action, when sensitive information is about to be shared with an AI service or website;
• keep an audit record of these events for your organisation’s security and compliance team;
• apply your organisation’s policies, such as blocking file uploads, code pasting, downloads or website categories;
• show that protection is installed and working on your device.

It is not used for advertising, profiling unrelated to security, credit decisions, or any purpose other than the above.

The extension keeps a small amount of data in your browser's extension storage: your session token, your organisation's current policy, its server address and company name, and a random browser identifier. If your organisation's server cannot be reached, records of up to 50 checks (each with at most the first 500 characters of the prompt) are held temporarily and sent once the server is available again, so that the audit record has no gaps. Removing the extension deletes this data.

The data is shared only with your organisation, through its CLOAK server, and is visible to the people your organisation authorises (for example its security team). Neither the extension nor Wardline sells data or shares it with third parties for their own purposes. The only exception is the detection service described in section 2, if your organisation chooses the hosted option; it receives data solely to return a result and keeps nothing.

Your organisation may be required to disclose data where the law requires it; any such disclosure is made by your organisation, under its own policies.

Your organisation sets how long audit records are kept on its server. Uploaded file contents are never kept. Data held in the extension is removed when it has been sent to the server, when you are signed out, or when the extension is removed.

• Data is sent to your organisation’s server over HTTPS. The CLOAK agent only accepts an unencrypted server address when the server is on your organisation’s private network.
• Prompt excerpts are encrypted when stored on the server.
• Your session token stays inside the extension’s background process and is never shared with the websites you visit.
• Access to the CLOAK console is limited to accounts your organisation authorises, with role-based permissions and optional multi-factor authentication.
• The extension runs only code packaged within it. It does not download or execute code from the internet.

Because the extension is managed by your organisation, it may be installed and kept installed according to your organisation's policy, and you may not be able to switch it off yourself.

Depending on where you work, data protection law (such as the EU/UK GDPR or India's Digital Personal Data Protection Act) may give you rights to access, correct or delete personal data about you, or to object to its processing. Your organisation is responsible for responding to these requests. Contact your organisation's IT, security or data protection team.

The extension is a workplace tool and is not intended for use by children.

If the data the extension collects or how it is used changes, this policy will be updated and its effective date changed. Your organisation will inform you of significant changes.

For questions about how your data is used, or to exercise your rights, contact your organisation's IT, security or data protection team.

For questions about the CLOAK software itself: Wardline Technologies — get in touch.