Who controls your data
Kona for Browser is an AI-usage governance tool that an organization (“your organization”) uses to evaluate KonaSense. Your organization is the data controller; KonaSense acts as a data processor on its behalf, under the agreement between KonaSense and your organization. For questions about how your organization uses this data, contact your organization’s IT/security team.
What the extension does (single purpose)
Its only purpose is to help your organization govern the use of AI/GenAI web applications: it detects when you use supported AI sites and evaluates the prompts you submit against your organization’s policies, which may redact, warn about, or block sensitive content before it is sent to the AI tool.
What we collect
When you activate the extension with your Organization ID and visit a supported AI site (currently: ChatGPT, Claude, Gemini, Microsoft Copilot, Perplexity, DeepSeek, Grok, Le Chat (Mistral), Poe, and Meta AI), the extension collects and sends the following to your organization’s KonaSense tenant (collect.konasense.com):
| Data | What it is | Why |
|---|---|---|
| Prompt content | The text you submit to the AI site | To evaluate it against your organization’s data-protection policies (detect / redact / warn / block sensitive data). This may incidentally include any information you type, which could contain personal, financial, health, or other sensitive information. |
| AI application & site | Which supported AI app/domain you used | Shadow-AI discovery and usage analytics |
| Your email (optional) | Only if you enter it during activation | To attribute activity to you in your organization’s dashboard |
| Sign-in email on the AI site | The email you are signed in with on a supported AI site, read from the site’s own session (email only - your session token is never read or transmitted) | To detect use of personal (non-corporate) accounts on AI tools (Shadow AI); your organization compares the email’s domain to its corporate domains |
| Organization ID | The tenant identifier you enter | To route data to your organization’s tenant |
| Interaction & usage metadata | Statistics about pasted text (length, entropy, counts of emails/secrets - never the text itself); file-attachment metadata (name, size, type - never the file contents); and session activity (which AI tool, duration, authenticated or not) | Detect risky exfiltration (large pastes, file uploads) and measure AI-tool usage/adoption |
| Device/browser metadata | Browser name/version, OS, language, timezone, extension version, and a locally-generated installation identifier (a public key) | Device context and de-duplication |
The extension does not run on non-supported sites, does not read your general browsing history, and does not collect passwords or your other extensions.
What we do NOT do
- We do not sell your data.
- We do not use or transfer your data for advertising, or for any purpose unrelated to the single purpose above.
- We do not use your data to determine creditworthiness or for lending.
Consent
The extension requests your affirmative consent before any collection begins (a consent checkbox during activation). You can withdraw consent at any time by clicking Reset extension, or by disabling or uninstalling the extension.
How data is handled
- In transit: all data is sent over HTTPS (TLS). Each request is cryptographically signed by a key generated and stored on your device.
- Storage on your device: your Organization ID, optional email, the signing key, and counters are stored locally in the browser’s extension storage. Clicking Reset extension deletes them.
- Retention on the backend: prompt content and events are retained by your organization’s KonaSense tenant according to your organization’s configured retention policy. KonaSense does not impose a fixed default; retention is set per tenant.
- Sub-processors / hosting: Amazon Web Services (AWS), US East (Ohio) region (us-east-2).
Your choices and rights
- Disable/uninstall the extension at any time (it is not tamper-resistant and can be removed by you).
- Reset clears all locally stored data and stops collection.
- To exercise data-subject rights (access, deletion, correction), contact your organization, or KonaSense at security@konasense.com.
Children
This extension is a workplace tool and is not directed to individuals under 18.
Changes
We may update this policy; the “Last updated” date will change and material changes will be communicated to your organization’s administrator.
Contact
KonaSense, Inc., 390 Northeast 191st Street, Miami, FL 33179, USA · Privacy: security@konasense.com · Support: konasense.com/kona-for-browser/support