CircleScope Privacy Policy

Endpoint Compliance Agent browser extension — effective August 19, 2026

What CircleScope is

The CircleScope Endpoint Compliance Agent is enterprise software installed on company-managed devices by an organization's IT provider, using managed browser policy. It is not a consumer product and is not intended for personal devices. If it is installed on your browser, your organization chose to deploy it, and your use of that device is governed by your organization's acceptable-use policy.

What the extension collects

On a specific list of AI services (ChatGPT, Claude, Microsoft Copilot, Google Gemini, Perplexity), the extension records:

• Prompt text submitted to those services, and metadata about file uploads (name, size, type)
• The site, timestamp, and a conversation reference
• The device name and the signed-in workplace username (UPN), as configured by the IT provider

Before anything leaves the device, the extension redacts sensitive patterns — Social Security numbers, payment card numbers, and API keys are replaced with redaction tokens on the endpoint and are never transmitted or stored.

What it does not collect

• No browsing history — the extension runs only on the AI sites listed above and has no access to other tabs or sites
• No keystrokes outside prompt submissions on those sites
• No passwords, cookies, screenshots, microphone, camera, or location data

How the data is used

Collected activity is transmitted over HTTPS to CircleScope's backend (hosted on Supabase in the United States), where it is scored for policy risk and made available to the deploying organization's authorized administrators for compliance review and employee coaching. Data is used solely to provide this service to the deploying organization. It is never sold, never used for advertising, and never used to train AI models. Automated risk scoring is performed by an AI classification service under agreements that prohibit training on the data.

Retention and deletion

Each organization sets its own retention window (7–365 days; 90 by default), after which event data is purged. Organizations may request deletion of their data at any time via their IT provider or by contacting us.

Contact

Questions about monitoring on your device should go to your IT administrator, who controls the deployment. For questions about this policy or CircleScope's data handling, contact privacy@circlescope.ai.