Legal Neurlect Workspace
Privacy Policy
How the Neurlect Workspace browser extension and desktop app handle information.
At a glance
- Policy checks run on your device. The extension and the app decide on your computer whether a page opens normally, opens in the isolated browser, or is blocked, and check text against your organization’s rules.
- The extension does not send data to Neurlect. It communicates only with the Neurlect Workspace app on the same computer.
- What reaches Neurlect’s servers is limited. The app sends device registration, status reports, rule-level event counts, notice acknowledgements and, in versions that support it, prompt-submission policy records. These records have no fields for text you type or paste, web addresses, or file names.
- No selling, no advertising. We do not sell user data or use it for advertising.
1. Who we are
Neurlect Workspace is provided by Neurlect (“Neurlect”, “we”, “us”). You can reach us at hello@neurlect.com.
Neurlect Workspace is a workplace product. An organization—usually your employer—installs it on its employees’ computers and sets the policies it applies. In this policy, “your organization” means that organization.
2. What this policy covers
- The Neurlect Workspace extension for Google Chrome (the “extension”).
- The Neurlect Workspace desktop app (the “app”) that the extension works with on the same computer, including the isolated browser it runs.
- The Neurlect management service that the app connects to, and this website.
Websites you open—inside or outside the isolated browser—receive what you send them and handle it under their own policies.
3. How Neurlect Workspace works
The extension works together with the app installed on the same computer. They communicate through Chrome’s native messaging, which stays on the computer. Policy decisions are made on the device.
Your organization’s administrators set policies in Neurlect’s management console. The app downloads those policies as signed files and applies them. The extension needs access to all websites because your organization’s policy can apply to any page you open.
4. Information handled on your device
Most processing happens on your computer. Chrome Web Store rules treat this as handling user data even when nothing leaves the device, so we describe it here.
Web addresses of your tabs
The extension reads the web address (http and https) of pages you open in Chrome and of links you click to other sites, and checks it against your organization’s policy on the device. Depending on the policy, the page opens normally, opens in the isolated browser on your computer, or is replaced by a block notice.
When a page opens in the isolated browser, its full web address is passed to the app on the same computer. While an isolated session is open, the app also writes each decision—the site’s host name, the decision, and the time—to a log file on the device. On macOS, only your user account can read this file.
Text you enter on web pages
On regular web pages, the extension checks text you type, paste, or submit in text boxes and editable areas for types of personal information: national identification, foreigner registration, passport and driver’s license numbers; phone numbers; email addresses; payment card numbers; and Japanese My Number, residence card, passport and driver’s license numbers. Password fields and hidden fields are not read. The check runs inside the extension on your device. The extension does not store the checked text or send it anywhere.
The isolated browser
The isolated browser is a separate Chromium-based browser that the app runs on your computer and shows inside a Chrome tab. Your keystrokes, input-method text, mouse and scroll actions, and the screen image travel only between that tab and the app on the same computer. There is no Neurlect relay server. The isolated browser connects directly to the websites you open in it.
To apply your organization’s policy, the app checks text and images you paste or submit, and files you download, in the isolated browser. These checks run on your device.
Each isolated session normally starts with a fresh browser profile. So that you can stay signed in, the app keeps cookies and site storage for a fixed list of sites built into the app (such as major AI services and Google sign-in), and anti-bot clearance cookies for other sites, in an encrypted vault on your device. Passkeys you use in the isolated browser are kept in the same vault. The vault key is created by the extension and kept in Chrome’s extension storage. The extension itself does not read cookies.
On-device activity ledger
The app keeps a ledger on the device that links what enters and leaves the isolated browser—downloads, pastes, copies, prints, prompt submissions, and image attachments. It records fingerprints (cryptographic hashes), sizes, categories, and sensitivity grades of the content; destination categories; decisions; session identifiers; and the name of your computer user account. It does not record the content itself, web addresses, or file names.
Files you download in the isolated browser are kept in a protected area on the device so they can be checked before you open them.
Settings saved by the extension
The extension saves the following in Chrome’s extension storage: the vault key described above; your preferred website language; a copy of your organization’s notice and the notice version you have seen; the last site blocked by the threat list; display preferences and start-page favorites; and, while Chrome is running, which tabs belong to which isolated sessions.
Detection components and logs
If your organization uses them, the app downloads detection components—such as personal-information detection models and image text recognition—and runs them on your device. The app’s diagnostic logs are written on the device. The app does not upload them.
5. Information sent to Neurlect
The extension does not send information to Neurlect’s servers. The app connects to Neurlect’s management service only after it has been activated with an activation code issued by your organization’s administrator. It connects over HTTPS and signs each request with a key created on the device.
| Record | Contents | When |
|---|---|---|
| Device registration | A device identifier derived from a key created on the device, the device’s public key, and the app version. The token in the activation code authorizes the registration. | Once, at activation |
| Status report | Whether protection is working normally or is degraded (with a reason code), license status and version, the policy version in force, the app version, and the time. Newer versions can add which policy features the app supports. | About once a minute |
| Rule events | Time, rule identifier, severity, action taken (allow or block), and a count. Currently these come from safety checks on downloaded files. | When a rule applies |
| Notice acknowledgements | The version of your organization’s notice, your response (consent or acknowledgement), and the time. | When you respond to the notice |
| Prompt-submission records | Sequence numbers and time; destination category (AI service, other website, local, or unknown); whether the app confirmed an exact-content relationship; the action and kind of enforcement (for example, block or mask); the identifier of the detection rule that applied; the sensitivity grade; a count; and, when present, numeric watermark identifiers. Sent by app versions that support this feature. | When a prompt you submit in the isolated browser is blocked or contains top-grade sensitive information |
What these records do not contain. They have no fields for text you type or paste, prompts, file contents, file names, web addresses, or content hashes. Our server rejects any record that includes a field it does not expect.
Your organization’s administrator can link a device to an account identifier from your organization’s sign-in system, so that the console can show whose device it is. We do not store employee names for this link.
What the app downloads
The app downloads signed policy, license, and notice files and your organization’s list of work sites from the management service, and is notified when new versions are available. It downloads detection components, threat lists, and the isolated browser package from update.neurlect.com. These downloads do not include a device identifier.
Connection information
Like most online services, our servers and hosting providers receive standard connection information, such as IP addresses, request times, and requested paths, and keep access logs for security and operations.
6. How we use and share information
We use the information described above only to provide Neurlect Workspace: applying your organization’s information-protection policy to web work, showing your organization’s administrators the status and records of their devices, and keeping the service secure and reliable.
- We do not sell user data.
- We do not use or transfer user data for personalized advertising, and we do not transfer it to advertising platforms, data brokers, or other information resellers.
- We do not use or transfer user data to determine creditworthiness or for lending purposes.
Who receives information
- Your organization. Its administrators see the management records described in section 5 for their organization’s devices in the Neurlect management console.
- Service providers. Oracle Cloud Infrastructure hosts the management service in its Tokyo region (Japan). Cloudflare delivers this website and update.neurlect.com. They process information on our behalf to run the service.
- Services you reach through the product. (a) The websites you open. (b) Google Search, if you choose “Web search” on selected text in the isolated browser: a new tab opens Google Search with up to 256 characters of that text. (c) jsDelivr (cdn.jsdelivr.net): when the extension’s welcome or notice screen opens, Chrome downloads a font stylesheet and font files from jsDelivr, which receives standard request information such as your IP address.
- Others, only when necessary. When required by law; to protect against malware, spam, phishing, fraud, or abuse; or as part of a merger, acquisition, or sale of assets after obtaining your explicit prior consent.
Access by Neurlect personnel
Neurlect personnel do not read user data unless you explicitly agree to it for specific data (for example, to resolve a support request), it is necessary for security purposes such as investigating abuse, it is required to comply with law, or the data is aggregated and anonymized for internal operations.
7. Chrome Web Store Limited Use
The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.
Neurlect Workspace collects and uses information only for its single purpose described in this policy and on its Chrome Web Store page: applying your organization’s information-protection policy to web work on your device. Its handling of web browsing activity is limited to the user-facing features described in section 4—opening a page normally, in the isolated browser, or behind a block notice according to your organization’s policy.
8. Your organization’s role
Your organization decides whether to deploy Neurlect Workspace, which policies apply, which devices are activated, and which plan—and therefore which on-device retention period—applies. Its administrators can see the management records for their devices.
For management records, Neurlect acts on your organization’s behalf, and your organization is responsible for informing its employees about its workplace policies. If you have questions about how your workplace uses Neurlect Workspace, please contact your organization first; we will help your organization respond.
9. How long information is kept
- Extension storage: until it is changed or the extension is removed. Chrome deletes the extension’s stored data when the extension is removed. The list of which tabs belong to which isolated sessions is cleared when Chrome restarts.
- Isolated browser vault: saved cookies and site storage are kept until they expire or are replaced. If the extension is reinstalled, its new vault key cannot read the old cookies, and the app clears them.
- Decision log on the device: kept on the device. The app does not delete it on a schedule.
- Activity ledger on the device: deleted automatically according to your organization’s plan—after 30 days on trial plans and 365 days on standard plans. Enterprise plans have no automatic deletion period. If no license is installed, entries are not deleted automatically.
- Management records: kept while your organization uses Neurlect Workspace. We do not currently apply an automatic deletion period to them. An administrator can remove a device in the console, which deletes its registration and status reports. Your organization can ask us to delete its records at hello@neurlect.com.
- Access logs: kept for a limited period for security and operations.
10. Security
- The app accepts activation only for HTTPS management addresses (local test addresses on the same computer excepted), and signs each request with a key created on the device.
- Management records use closed formats. The server rejects unexpected fields.
- The isolated browser vault is encrypted (ChaCha20-Poly1305).
- On macOS, the decision log on the device can be read only by your user account.
No method of storing or transmitting information is completely secure, but we use these measures to protect it.
11. Your choices and rights
Because your organization manages Neurlect Workspace, requests to access, correct, or delete information are usually handled through your organization. You can also contact us at hello@neurlect.com. We will respond, or pass your request to your organization and tell you that we have done so.
Depending on where you live, you may have rights under local data protection law, such as the right to access, correct, or delete your personal information, or to object to or restrict its processing.
Removing the extension stops it from reading pages. On managed devices, your organization may require the extension to stay installed.
12. Children
Neurlect Workspace is a workplace product and is not intended for children.
13. Changes to this policy
We will update this page when our practices change and revise the effective date. Before Neurlect Workspace starts handling a new type of information, we will update this policy. If a change is significant, we will also notify the organizations that use Neurlect Workspace.
14. This website
neurlect.com is a static website delivered through Cloudflare. Our pages do not set cookies and do not load analytics or advertising scripts. Cloudflare processes standard request information to deliver the site. If you email us, we use your message and email address only to reply.
15. Contact
- Operator
- Neurlect
- Privacy contact
- Neurlect Privacy Team
- hello@neurlect.com
This policy is also available in 한국어 and 日本語. If the versions differ, the English version governs.