Porcia
All legal policies
Legal / Browser Extension Privacy

Privacy Policy Addendum - Browser Extension

Effective Date: September 12, 2026
Last Updated: October 15, 2026
Applies To: Porcia Browser Extension for Chrome and Edge

1. Introduction

This Privacy Policy Addendum supplements the Porcia Privacy Policy and applies specifically to the Porcia Browser Extension. This addendum describes what data the browser extension collects, how we use it, and your rights regarding this data.

Scope: This addendum applies only to data collected by the Porcia Browser Extension. For information about other Porcia services, please refer to our main Privacy Policy at porcia.org/legal/privacy.

2. Data Collection

2.1 What We Collect

The Porcia Browser Extension collects the following information. Your organization decides which detections run (see Section 7).

Activity Data:

  • Site names - The hostname of websites where sign-in or signup activity is detected (e.g., "slack.com", "github.com"), never the full web address
  • Timestamps and duration - When you start and stop using a site identified as an app, and for how long (in seconds)
  • Event type - Type of activity detected (login, signup, app usage, or security event)
  • Sign-in details - The sign-in method used (a password form, or Google, Microsoft or another provider), and whether a signup was for a trial
  • Work email used - Whether a work email domain was used
  • Sign-in email address - The email address used to sign in, where the page shows it. It is stored encrypted and used to find accounts shared between people
  • Page type - Whether a page looks like a product, marketing, support, documentation or event page. This is worked out in the browser, and only the category is sent

Account Security Data:

  • Password checks - Done in your browser: password strength, whether the password is reused (and on which sites), whether a password manager was used, and whether the password appears in known data breaches. The breach check sends only the first 5 characters of a SHA-1 hash of the password to Have I Been Pwned. Passwords are never sent to Porcia
  • Multi-factor authentication - Whether MFA or a passkey was used to sign in
  • OAuth consent - The app name, the permissions it requests, and whether access was granted

Security Events:

  • Phishing and attacks - Phishing pages, lookalike login pages and other attacks detected on a page, and the signals that triggered the detection
  • Policy actions - Whether a rule set by your organization warned about or blocked an action

AI Tools and Data Movement:

  • AI tool visits - Visits to AI tools such as ChatGPT or Claude
  • Sensitive data types - The family and type of sensitive data (secrets and credentials, personal information, financial data, or health information) detected in prompts, pastes, copies and uploads. The values themselves are never sent. Your organization can turn each family off; reports of a family that is off are dropped in the browser and again when they reach Porcia
  • Source of pasted or uploaded content - The site it came from, or that it came from outside the browser
  • Uploads and downloads - File type and size, the kind of site involved, and whether a policy warned about or blocked it
  • AI records - Tool and conversation metadata, send outcome, data types and counts, paste and upload metadata, and derived data-flow summaries. These records never contain prompt text, file contents, clipboard text, passwords, or full sensitive values
  • Prompt evidence - Only if your organization turns it on: masked values, and at the highest level a masked copy of AI prompt text, with sensitive values removed in the browser, stored encrypted for the period your organization sets
  • Feedback - "This isn't sensitive" reports contain only the type, tool and matching-check identifier, never who sent them. They are deleted after 90 days

Browser Data:

  • Installed extensions - Names, versions, permissions, and how each extension was installed
  • Browser and operating system - Browser name and version, and operating system
  • Incognito access - Whether the extension is allowed to run in incognito windows

Identifiers:

  • User identifier - Your Porcia user ID, or your identity in your organization's directory
  • Workspace identifier - Your organization's workspace ID
  • Installation identifier - An ID for this browser installation

2.2 What We DO NOT Collect

The extension does not collect:

  • Full URLs - We never collect paths, query parameters, or fragments
  • Page content - We do not read or store the text, images, or content of pages, except the masked prompt text described above when your organization turns on prompt evidence
  • Form contents - We do not store what you type in forms or search boxes, with the same prompt evidence exception
  • Passwords - Passwords are checked in your browser and never sent to Porcia
  • Personal messages - We never read your emails, chats, or direct messages
  • File contents - Files are checked in your browser; only the file type, size and the types of sensitive data found are sent
  • Clipboard contents - Copied and pasted text is checked in your browser; only the types of sensitive data found are sent
  • Screenshots - We never capture images of your screen
  • Browsing history - Sites are reported only when sign-in, signup or security activity is detected, or when they are known apps
  • Incognito browsing - The extension runs in incognito windows only if it is allowed to, by you or your organization

2.3 Example of Data Collected

What we collect:

Domain: slack.com
Event Type: login
Sign-in Method: Google
Start: 2026-01-27 10:00:00 UTC
End: 2026-01-27 10:15:00 UTC
Duration: 900 seconds (15 minutes)
Work Email Used: true
Sign-in Email: stored encrypted
User ID: usr_abc123
Workspace ID: wks_xyz789

What we DO NOT collect:

❌ Full URL: https://slack.com/messages/C123456/details?thread_ts=1234567890
❌ Page content: "Hey team, let's meet at 3pm..."
❌ Form inputs: "password123"
❌ Personal data: Names, emails, phone numbers in page content

3. How We Use Your Data

We use the collected data for the following purposes:

3.1 SaaS Application Discovery

  • Identify which business applications your team uses by detecting login and signup activity
  • Match domains to known SaaS vendors in our database
  • Build a comprehensive inventory of your software stack
  • Detect new tools being adopted by your team

3.2 Usage Analytics

  • Calculate time spent on each application
  • Generate usage reports and trends
  • Identify most-used and least-used applications
  • Track adoption of new tools through signup event detection

3.3 Shadow IT Identification

  • Detect unapproved applications being used through login/signup events
  • Alert administrators to potential security risks
  • Help maintain compliance with IT policies
  • Identify trial signups that may lead to unmanaged subscriptions

3.4 Security Protection

  • Warn about or block phishing pages, risky uploads and downloads, and sensitive data sent to AI tools, when your organization turns that on
  • Show your organization which AI tools are used and what types of sensitive data reach them
  • Find weak, reused or breached passwords and accounts shared between people

3.5 Cost Optimization

  • Identify unused or underutilized subscriptions
  • Recommend cost-saving opportunities
  • Support license optimization decisions

3.6 Compliance Monitoring

  • Track application usage for audit purposes
  • Ensure compliance with organizational policies
  • Support security and risk assessments

3.7 Workspace-Level Insights

  • Provide aggregated team usage statistics
  • Identify trends and patterns
  • Support data-driven decision making

We do NOT use your data for:

  • Advertising or marketing
  • Selling to third parties
  • Tracking personal browsing habits
  • Monitoring individual productivity
  • Any purpose unrelated to SaaS management and security

4. Data Storage & Security

4.1 Where Data is Stored

Geographic Location:

  • All data is stored in the United States

Storage Duration:

  • Raw events: 90 days from collection, then automatically deleted
  • AI conversation and prompt records: 90 days after the conversation's last activity, then automatically deleted
  • Masked prompt evidence: for the period your organization sets, from 1 to 90 days (30 by default)
  • "This isn't sensitive" feedback: 90 days, then automatically deleted
  • Sign-in records (your latest sign-ins to each app, derived from raw events): 90 days after the latest sign-in
  • Upload diagnostics (records of events Porcia refused): 30 days; delivery records: 7 days once delivered, 30 days if delivery failed
  • Daily usage statistics and AI data-flow summaries: 13 months, then automatically deleted, or sooner when you delete your browser data, your account is deleted, or your organization deletes its workspace
  • Identity checks your organization's helpdesk runs: 90 days
  • Settings: retained while account is active

4.2 Security Measures

Encryption:

  • In transit: TLS 1.2+ encryption for all data transmission
  • At rest: AES-256 encryption for database storage
  • Sign-in email addresses and prompt evidence are also encrypted in the database

Access Controls:

  • Role-based access control (RBAC)
  • Audit logging of changes in your workspace

Infrastructure Security:

  • Cloud security best practices

4.3 Data Retention

Automatic Deletion:

  • Browser activity data is automatically deleted after 90 days
  • You can delete your data manually at any time
  • Deleted data is permanently removed within 90 days, subject to the account recovery window and legal-retention exceptions

Aggregated Data:

  • Anonymized, aggregated statistics may be retained longer
  • Used for product improvement and benchmarking
  • Cannot be traced back to individual users

5. Data Sharing

5.1 Who Can See Your Data

Within Your Workspace:

  • Workspace administrators, and people whose role gives them an organization-wide view, can see each person's activity: the apps they use, the security and AI tool events recorded for them, and the extensions installed in their browser
  • Masked prompt evidence can be viewed only by people given the permission to view it

Workspace Isolation:

  • Your data is isolated to your workspace
  • Other Porcia workspaces cannot see your data
  • Strict access controls prevent cross-workspace access

5.2 Who We DO NOT Share With

We never share your browser activity data with:

  • Third-party advertisers
  • Marketing companies
  • Data brokers
  • Other Porcia customers
  • Social media platforms
  • Analytics services (except anonymized, aggregated data)
  • Government agencies (except as required by law)

5.3 Service Providers

We may share data with trusted service providers who help us operate the service:

  • Cloud infrastructure and database hosting
  • Have I Been Pwned receives only the 5-character hash prefix described in Section 2.1, directly from your browser

Requirements for Service Providers:

  • Sign data processing agreements
  • Comply with GDPR and CCPA
  • Use data only for specified purposes
  • Maintain equivalent security standards

We may disclose data if required by law:

  • Valid court order or subpoena
  • Legal obligation to prevent harm
  • Protection of our rights or property

We will:

  • Notify you if legally permitted
  • Challenge overly broad requests
  • Provide minimum necessary data

6. Your Rights

6.1 Right to Access

You can:

  • Export your browser activity data in JSON format
  • Request a copy of all data we hold about you

How to Exercise:

  1. In Porcia, go to Settings → Browser Extension
  2. Choose "Export data"
  3. Download the JSON file

If you don't have a Porcia account, ask your organization's administrator or email [email protected].

6.2 Right to Delete

You can:

  • Delete all your browser activity data
  • Request deletion of your entire Porcia account
  • Have data permanently removed

How to Exercise:

  1. In Porcia, go to Settings → Browser Extension
  2. Choose "Delete all data"
  3. Confirm deletion (cannot be undone)

What Happens:

  • Deleting your browser data removes your browser events, usage statistics, sign-in records, MFA observations, AI conversation and prompt records, AI data-flow summaries, masked evidence, upload diagnostics, identity checks your helpdesk ran (except one still in progress, which ends within minutes), and any events still waiting to be processed
  • "This isn't sensitive" feedback isn't linked to you, so it can't be deleted per person; it is deleted automatically after 90 days
  • Account data remains recoverable for up to 90 days for account recovery and export
  • Browser activity data is permanently deleted by the end of the 90-day recovery window, subject to legal-retention exceptions
  • Aggregated statistics may be retained only where they cannot be linked to an individual

6.3 Right to Opt-Out

You can:

  • Uninstall the extension, unless your organization installed it through device management. In that case, contact your administrator
  • Object to processing (see Section 6.5)

How to uninstall:

  1. Go to chrome://extensions/ (or edge://extensions/ in Edge)
  2. Find Porcia SaaS Discovery
  3. Click "Remove"

6.4 Right to Portability

You can:

  • Export your data in machine-readable format (JSON)
  • Transfer data to another service
  • Use exported data for your own purposes

Data Format:

{
  "events": [
    {
      "domain": "slack.com",
      "eventType": "login",
      "startTime": "2026-01-27T10:00:00Z",
      "endTime": "2026-01-27T10:15:00Z",
      "duration": 900,
      "workEmailUsed": true
    },
    {
      "domain": "notion.so",
      "eventType": "signup",
      "startTime": "2026-01-27T11:00:00Z",
      "endTime": "2026-01-27T11:05:00Z",
      "duration": 300,
      "isTrial": true,
      "workEmailUsed": true
    }
  ],
  "stats": {
    "totalApps": 25,
    "totalDuration": 86400,
    "totalLogins": 150,
    "totalSignups": 5
  }
}

6.5 Right to Object

You can:

  • Object to processing of your data
  • Request restriction of processing
  • Withdraw consent at any time

How to Exercise:

  • Email: [email protected]
  • Subject: "Data Processing Objection"
  • Include your user ID and workspace ID

7. Privacy Controls

7.1 Organization Controls

Your organization's administrators decide:

  • Which detections run, such as sign-in tracking, password checks, AI tool monitoring, clipboard, upload and download checks, and phishing protection
  • Which sensitive-data families are reportable: secrets and credentials, personal information, financial data, and health information. Turning a family off stops new reporting for that family
  • Whether each detection only records, warns you, or blocks the action
  • Whether prompt evidence is kept, at what level (metadata only, which is the default; masked values; or masked text), and for how long
  • Export and deletion controls cover raw browser events and the user-scoped AI projections derived from them

7.2 Your Choices

  • You can uninstall the extension, unless your organization installed it through device management
  • You can exercise the rights in Section 6 at any time

8. Compliance

8.1 GDPR Compliance (EU)

Legal Basis for Processing:

  • Legitimate Interest - SaaS management, security, and cost optimization
  • Contractual Necessity - Providing the service you signed up for
  • Consent - Where required, we obtain explicit consent

Your GDPR Rights:

  • Right to access
  • Right to rectification
  • Right to erasure ("right to be forgotten")
  • Right to restrict processing
  • Right to data portability
  • Right to object
  • Rights related to automated decision-making

Data Protection Officer:

8.2 CCPA Compliance (California)

Your CCPA Rights:

  • Right to know what data we collect
  • Right to delete your data
  • Right to opt-out of sale (we don't sell data)
  • Right to non-discrimination

We Do NOT:

  • Sell your personal information
  • Share for cross-context behavioral advertising
  • Discriminate based on privacy rights exercise

How to Exercise Rights:

8.3 Security Compliance

Security Standards:

  • Industry-standard security controls
  • Security reviews of the code, with findings tracked until fixed

Security Documentation:

8.4 Data Processing Agreements

For Enterprise Customers:

  • Standard Contractual Clauses (SCCs) available
  • Data Processing Addendum (DPA) upon request
  • HIPAA/PHI processing is not supported; Porcia does not offer a HIPAA BAA

Contact:

9. Children's Privacy

Age Requirement:

  • Porcia is not intended for users under 16 years old
  • We do not knowingly collect data from children under 16
  • If we learn we have collected such data, we will delete it immediately

Parental Consent:

  • Users aged 16-18 may require parental consent (jurisdiction-dependent)
  • Parents can request deletion of their child's data

How to Report:

10. Changes to Privacy Policy

10.1 Notification of Changes

How We Notify:

  • Email to all users
  • In-app notification
  • Banner on website
  • Update "Last Updated" date

Advance Notice:

  • 30 days notice for material changes
  • Immediate notice for legal requirement changes

10.2 Effective Date

Material Changes:

  • Take effect 30 days after notification
  • You can opt-out before effective date
  • Continued use = acceptance of changes

Non-Material Changes:

  • Take effect immediately
  • Clarifications or administrative updates
  • No action required

10.3 Version History

Current Version: 1.1.0 (October 15, 2026)

Previous Versions:

  • 1.0.0 (September 12, 2026)

Version history is maintained in this document.

11. Contact Information

11.1 Privacy Officer

Email: [email protected]
Mail: Porcia Privacy Officer
C/13 Mangalmurti Society, Ghatkopar West
Mumbai, Maharashtra, India

Response Time: Within 45 days

11.2 Data Protection Officer (EU)

Email: [email protected]
Mail: Porcia DPO
C/13 Mangalmurti Society, Ghatkopar West
Mumbai, Maharashtra, India

Response Time: Within 45 days

11.3 Support

General Questions:

Legal Inquiries:

  • Email: [email protected]
  • Mail: Porcia Legal Department
    C/13 Mangalmurti Society, Ghatkopar West
    Mumbai, Maharashtra, India

11.5 Filing Complaints

Supervisory Authority (EU):

  • Contact your local data protection authority
  • List: edpb.europa.eu/about-edpb/board/members_en

California Attorney General:

  • Website: oag.ca.gov/privacy
  • Phone: 1-800-952-5225

12.1 Legitimate Interest

Our Legitimate Interests:

  • Providing SaaS management and security services
  • Improving product functionality
  • Ensuring security and preventing fraud
  • Complying with legal obligations

Balancing Test:

  • Your privacy rights vs. our legitimate interests
  • Minimal data collection necessary
  • Strong security measures in place
  • Transparency in data use

12.2 Contractual Necessity

Service Provision:

  • Browser extension is part of Porcia service
  • Data collection necessary to provide features
  • Cannot provide service without this data

Your Agreement:

  • By using extension, you agree to data collection
  • Can opt out by uninstalling the extension, where your organization allows it
  • Can delete data at any time

Where Required:

  • Explicit consent for sensitive processing
  • Opt-in for marketing communications
  • Consent for cookies (where applicable)

Withdrawal:

  • Can withdraw consent anytime
  • Email: [email protected]
  • Effect: Processing stops immediately

13. International Data Transfers

13.1 Data Transfer Mechanisms

EU to US:

  • Standard Contractual Clauses (SCCs)
  • Adequacy decisions where available
  • Additional safeguards as required

Other Jurisdictions:

  • Appropriate safeguards in place
  • Compliance with local laws

13.2 Data Location

All data is stored in the United States.

Contact:

14. Automated Decision-Making

We Do NOT:

  • Use browser data for automated decisions affecting you
  • Use AI/ML for individual profiling
  • Make employment decisions based on browser data

We DO:

  • Use algorithms for SaaS detection (not about you)
  • Aggregate data for workspace insights
  • Provide recommendations (you decide)

Your Rights:

  • Right to human review of any decision
  • Right to contest automated decisions
  • Right to explanation of logic used

15. Acknowledgment

By installing and using the Porcia Browser Extension, you acknowledge that you have read, understood, and agree to this Privacy Policy Addendum.

Last Updated: October 15, 2026
Effective Date: September 12, 2026
Version: 1.1.0

© 2026 Porcia. All rights reserved.

For questions about this Privacy Policy Addendum, please contact:
Email: [email protected]
Website: porcia.org/legal/privacy