Exactly what the Extension collects, where it goes, and everything it never touches.
Last updated: June 10, 2026
This policy explains exactly what data the Governance 1st Browser Extension (the "Extension") collects, where that data goes, and what is not collected. The Extension is published and operated by HR Rebooted LLP ("we," "us," "our"). Contact for privacy questions: info@hrrebooted.com.
Plain-English summary. By default, the Extension stores everything on your computer and sends nothing anywhere. Two situations, both opt-in, will cause data to leave your device:
The Extension watches what you type into supported third-party AI chat sites, ChatGPT, Claude, Gemini, Microsoft Copilot, Bing Chat, Perplexity, DeepSeek, Meta AI, and Grok, and what those sites send back. Before a prompt is submitted, the Extension scans it locally against a configurable library of sensitive-data patterns (Social Security numbers, credit cards, API keys, medical record numbers, etc.) and either lets it through, redacts the matched portions in place, or warns you. If you have enabled Behavior Monitoring, the Extension also audits the AI's responses for thirteen governance behavior categories (hallucination, dangerous medical, legal, financial, safety advice, bias, jailbreak compliance, misinformation, and others).
The Extension contains no third-party advertising, analytics, fingerprinting, or session-recording code.
The Extension uses your browser's chrome.storage.local API to keep the following on your computer only:
This local data does not leave your computer unless one of the two situations described in the "Plain-English summary" above applies.
If you paste a Google Gemini API key into the Extension's options page and turn on Behavior Monitoring, the Extension will send the text of each AI response you receive on a supported site, along with the prompt you sent, to Google's Gemini API for a thirteen-category behavior audit. The call goes directly from your browser to generativelanguage.googleapis.com; we do not see, intercept, proxy, or log it.
Each call is bounded: your prompt is truncated to 4,000 characters and the AI response to 8,000 characters before being sent. The audit call is made under your own API key, meaning you (or your organization) pay Google directly for the call, and the data-handling relationship for that text is between you and Google.
Google's treatment of submitted content is governed by your relationship with Google. On the free tier of the Gemini API, Google may use submitted content to improve their models. On paid Gemini API tiers (billing-enabled Google Cloud projects), submitted content is not used for training. The Extension displays a clear privacy warning in its options page when free-tier mode is selected. If the content you audit is confidential, use a paid Gemini key.
You can disable Behavior Monitoring at any time by clearing the API key field or toggling the feature off in the options page, or by toggling the floating "GOV 1st" master switch in the lower-right corner of any AI chat page to OFF. Once disabled, no further calls to Gemini are made.
If your employer's IT department uses Chrome Enterprise, Google Workspace, or Microsoft Intune to push a managed configuration that points the Extension at our compliance backend, the Extension will send a daily report to that backend. The default ingestion endpoint, used when an organization buys a commercial license, is https://api.hrrebooted.ai/ingest. Each daily report contains:
We do not receive and never store the actual text of any prompt or any AI response. Only the items above are transmitted. This is enforced in the Extension's source code and verifiable by inspecting the upload payload.
When your organization stops using the service, or asks us to delete its data, we delete all reports associated with that tenant within thirty days.
For transparency, here is how each Chrome Web Store data-collection category applies to this Extension:
The Extension itself does not set cookies. If you visit our company website at hrrebooted.ai or our tenant compliance dashboard, those pages may use a single session cookie for the duration of your login session. We do not use tracking or advertising cookies.
Because we do not collect information that identifies you personally, we generally have no individual record of you to disclose, correct, or delete. If you are an employee whose organization deploys the Extension under a managed configuration and you wish to know what counters have been reported about your installation, contact your organization's IT or compliance team, they have full access to their tenant's data through the compliance dashboard.
If you are a paying customer (the organization), you can export, correct, or delete your tenant's data at any time by contacting info@hrrebooted.com.
The Extension is intended for use in workplace and professional settings. It is not directed at children under thirteen, and we do not knowingly collect data from children.
All network traffic from the Extension, to Google Gemini and to our compliance backend, is encrypted in transit via HTTPS. The authentication token used by enterprise-managed installs is transmitted only over HTTPS and stored only in Chrome's managed-storage area, which is read-only to the Extension. The Extension ships unobfuscated and unminified so its behavior can be independently inspected.
If we materially change what data is collected or where it goes, we will update this page and increment the "last updated" date at the top. Because the Extension does not have a built-in update notification, material changes will also be reflected in the Extension's Chrome Web Store and Microsoft Edge Add-ons listing notes at the time of the version release that introduces them.
Privacy questions and requests: info@hrrebooted.com
General company contact:
HR Rebooted LLP
PO Box 326
Colebrook, NH 03576
United States
© 2026 HR Rebooted LLP. All rights reserved. Patent pending.