Privacy Policy
Last updated: October 9, 2026
Introduction
Shadow Defend, LLC, 7901 4th St N, Suite 300, St. Petersburg, FL 33702, United States ("Shadow Defend," "we," "our," or "us") provides enterprise AI governance and monitoring services. This privacy policy describes how the Shadow Defend browser extension ("Extension") and the associated monitoring service (the "Service") collect, process, and handle data when deployed by an employer or other organization.
This policy applies to the Extension and the Service. It does not describe our public website or any other software that is not deployed under this policy.
Who is responsible: This Extension is deployed and configured by your employer or organization. Your organization decides which sites are monitored, which detection rules apply, and whether content such as prompt text is collected. In data protection terms, your organization generally acts as the data controller and Shadow Defend acts as a data processor on your organization's behalf. In limited respects necessary to operate our business (for example, billing, service security, fraud prevention, and compliance with law), Shadow Defend acts as an independent controller. For questions about what is collected in your workplace and why, please contact your IT or compliance department.
Data Collection Begins with Enrollment
No device is monitored, and no data is transmitted from any device to Shadow Defend, until your organization enrolls it. Enrollment requires a deployment token issued by an administrator and is performed either automatically through your organization's device management system or through an enrollment link or token your organization provides to you.
The Extension can send data only to your organization's Shadow Defend backend. That destination is fixed in the software itself: it cannot be changed by a device user or through device management settings, and the Extension rejects any endpoint that is not on its built-in allowlist.
Before enrollment, the Extension performs some analysis locally on your device. Nothing from that period is transmitted to us, stored by us, or visible to your organization.
Data We Collect
After enrollment, the Extension monitors use of AI tools on designated AI sites. Leading public AI assistants are monitored by default, and additional sites can be monitored under your organization's plan and configuration. What is collected depends on your organization's configuration and includes:
Monitored AI activity
- • The AI provider you interact with (the site hostname of the monitored provider, not the full web address) and the time of each monitored interaction
- • The prompts and messages you submit to AI tools, but only if your organization has enabled prompt collection (see "Prompt Content Settings" below)
- • The outcome of the local risk analysis of each monitored interaction: risk scores, detected sensitive-data patterns, policy violations, and enforcement actions taken
- • Enforcement metadata when content is blocked or flagged: the rule, category, or pattern that matched and the positions of matched text
- • Any justification you type when a warning asks you to explain an action. Your justification is recorded with the event and is visible to your organization at every enforcement level, including when prompt text is not collected.
- • Attachments you add to an AI tool: the filename, file type, and file size. If your organization has also enabled file content inspection, excerpts of matching file content may be collected (see "Files and clipboard inspection" below).
- • Text you paste into a monitored prompt, which is evaluated as part of the prompt under the same settings
Identity and account data
- • An assigned identifier or work email address that your organization attaches to your device at enrollment
- • The email address of the account you are signed into on a monitored AI site, when detectable. This email is always reported to your organization when found; it is not affected by any prompt-collection setting.
- • Work-account identifiers available in your browser profile, such as the account provider and account identifier, in some enrollment flows
Device and technical data
- • A random device identifier, a machine identifier supplied by your organization, and a device profile ID used to recognize the same browser profile across reinstalls
- • A cryptographic key pair generated on your device and used to authenticate every request. The private key is generated inside non-exportable device storage and never leaves it; only its public half, and the token bound to it, are transmitted.
- • Browser fingerprinting attributes collected at enrollment, such as platform, hardware resources, screen metrics, time zone, language settings, and graphics adapter attributes. Both a one-way hash and the raw attributes are recorded.
- • Your browser and operating system versions, the extension version, and your browser user agent string
- • Your device IP address, which is stored on the server side
- • Session identifiers used to group and deduplicate signals within a browsing session
Files and clipboard inspection (only where enabled)
- • Metadata for attachments you add to an AI tool: filename, file type, and file size
- • Where your organization has enabled file content inspection, an excerpt of matching content from those attachments, passed through redaction and truncation before storage
- • If your organization has additionally enabled full content collection, matching file text is transmitted for evaluation, but what is stored is still the redacted excerpt, not the full file text
Reporting beyond monitored sites (limited cases)
- • Attribution on unlisted pages: when you submit a prompt, message, or form on a page that is not monitored, the site hostname and any account email address detectable from that page are reported to your organization for attribution
- • Automatic discovery, where your organization's plan enables it: the site hostname and AI-detection signals of a page the Extension identifies on its own as a candidate AI site are reported
- • Site challenges: when an unlisted page shows signs of hosting an AI feature, the site hostname and related interaction metadata are reported, and a site challenge can be presented
Not collected
- • AI-generated replies: the responses that AI tools return to you are never read, captured, or transmitted
- • Conversation or thread history: conversation identifiers, thread identifiers, and conversation titles are not collected
- • Your general browsing: full page addresses and browsing history are not collected. Outside monitored sites, reporting occurs only in the limited cases described under "Reporting beyond monitored sites" above.
- • Keystrokes and screenshots: prompt text is transmitted only when submitted, never stored or sent while you type, and your screen is never captured
Prompt Content Settings
Whether the text of your prompts is collected is governed by your organization's settings. These settings are enforced on your device and re-verified on our servers, so a non-compliant or misconfigured endpoint cannot loosen them:
- • Default, metadata only: prompt text does not leave your device and is not stored in the Service. Records contain the AI provider, timing, risk signals, and enforcement metadata.
- • Redacted: prompt text is processed against your organization's detection rules on your device before anything leaves it. Only redacted text, with sensitive matches removed, is transmitted, together with markers showing where redactions occurred. Raw prompt text never leaves your device in this mode.
- • Full: prompt text is transmitted in full for evaluation. Before anything is stored, our server applies your organization's redaction rules to it, so stored records contain the redacted text; unredacted prompt text is never persisted.
Fail closed: If a setting is missing or cannot be read, the most restrictive setting applies. Where the default is metadata only, prompt text is discarded entirely. Your organization's individual policies can make collection more restrictive than its baseline, but never looser.
How Data Is Used
Collected data is used by your organization to:
- • Monitor compliance with organizational AI usage policies
- • Detect and prevent data leaks or security incidents
- • Enforce content policies (e.g., blocking sensitive data from being sent to AI tools)
- • Generate compliance reports and audit trails
- • Provide real-time risk assessments and user warnings
- • Authenticate devices and verify the integrity and origin of each event
Content Analysis Details
The Extension analyzes content locally in your browser to detect:
Sensitive Data Types
- • Social Security Numbers
- • Credit card numbers
- • Email addresses
- • Phone numbers
- • IP addresses
Security Risks
- • API keys and tokens
- • Passwords and credentials
- • Private keys and certificates
- • Database connection strings
- • Custom regex patterns
Analysis rules are configured by your organization. Detected sensitive data may trigger warnings, block actions, or generate alerts to administrators.
Data Storage & Security
Storage Location
All collected data is stored within your organization's dedicated Shadow Defend tenant. Your organization's administrators control access to the tenant, user permissions, and data management policies. Your organization can also run the backend in infrastructure it operates itself, in which case event data stays entirely within systems your organization controls. Where Shadow Defend hosts the Service, we access customer data only as necessary to provide, maintain, secure, support, or comply with legal obligations related to the Service.
Data Security
Data is transmitted using HTTPS/TLS, and every request from the Extension is authenticated with a cryptographic proof bound to your device (a DPoP-bound token). The Extension's API destination is fixed and allowlisted in the software itself. Your organization is responsible for managing user accounts, access permissions, security policies, and any integrations configured within your tenant.
How Data Is Shared
Shadow Defend does not sell data and does not use it for advertising. Monitored content is transmitted only to your organization's own Shadow Defend backend. The Extension contains no advertising technology and no telemetry or analytics components, and it does not send content to any AI provider for machine-learning analysis. Content analysis is performed locally in your browser by rule-based detection and, on the hosted Service, by rule-based processing on our servers.
Service providers we use
When your organization uses the hosted Service, we rely on standard service providers performing functions at our direction: network delivery, protection, and web performance measurement services, font delivery, email delivery services for invitations, verification messages, and the notification emails your organization configures, and billing processors for subscription payments. These providers may change over time; this section describes the categories. Notification emails can include prompt previews, but only where your organization has enabled prompt collection and permitted it for that channel. None of these providers is used to analyze monitored content.
Destinations your organization chooses
Your organization may connect the Service to destinations it selects, such as Slack, generic webhooks, or security information and event management systems (including Splunk and CEF/syslog feeds). Data sent to those destinations, including user identifiers and, where enabled, prompt previews, is sent under your organization's instructions and is then governed by that destination's own terms.
Legal requirements
We may disclose data to the extent required by law or legal process, and would direct legal demands concerning customer data to your organization where the law permits us to do so.
Data Retention
Monitored event and audit log records are deleted automatically on a schedule. The applicable retention period is determined by the plan your organization licenses, as documented at purchase, and can be set to a different period by agreement between your organization and Shadow Defend. Where an agreement changes the applicable period, the previously applicable period continues to apply for a brief transition before deletion resumes on the new schedule.
These windows cover event and audit records only. Device and identity records, including device identifiers, key identifiers, fingerprint attributes, IP addresses, and assigned and detected email addresses, are retained while a device remains enrolled, because the Service needs them to function and to keep an accurate inventory of enrolled devices. When a device is removed, the remaining tombstone record, which carries the bound user email and machine labels, is deleted automatically after a fixed cleanup period.
When your organization connects external systems as notification channels, any data transmitted to those systems is retained according to the independent retention policies of those systems, which your organization administers. Shadow Defend does not impose or extend retention periods beyond those established by your organization's plan or agreement. The retention period applicable to your organization is documented in that plan or agreement. For organization-specific retention requirements, contact your IT or compliance department.
Your Rights
Since Shadow Defend acts as a data processor on behalf of your organization, your rights regarding personal data are exercised through your organization. You may have the right to:
- • Request access to personal data collected about you
- • Request deletion of your data (subject to legal/retention requirements)
Note: To exercise these rights, contact your organization's data protection officer or IT department. Shadow Defend cannot directly process data subject requests without authorization from your organization.
Contact & Support
For questions about this Extension or privacy practices:
Your Organization
Contact your IT department or data protection officer for questions about data collected by your organization, access requests, or policy concerns.
Shadow Defend, LLC
7901 4th St N, Suite 300, St. Petersburg, FL 33702, United States
For technical support or questions about this policy: [email protected]
Changes to This Policy
We may update this privacy policy from time to time as our practices, services, or legal requirements change. The current version is always the one posted on this page, with its "last updated" date, and it applies to processing that occurs after it is posted. We encourage organizations deploying the Extension and users to review this page periodically. The terms of your organization's subscription or other agreement with Shadow Defend are separate from this policy; where this policy and that agreement describe the same subject differently, the agreement controls.