Lustena AI DLP extension privacy policy

2. Who decides about the data

• Configured by an organisation: the employer organisation is the controller of its employees' data. It decides to install the extension, which devices take part, whether content capture is on, the legal basis and how long the data is kept. Lustena is its processor: it processes the data on the organisation's behalf and under its instructions, to provide the contracted service.
• Connected by the person: the person decides to connect, to disconnect and which label to enter. The administrators of the chosen workspace decide whether content capture is on, on which legal basis, and how long the data is kept.
• Local mode: no data reaches Lustena. The findings stay only in the person's browser.
• In every case, Lustena does not sell this data, does not use it for advertising and does not use it to train AI models.

3. What the extension does on the device

When the person types, pastes, attaches or drops content into one of the AI apps above, the extension classifies that content on the device itself, looking for data such as Brazilian identity documents, email addresses, phone numbers, card numbers and credentials such as API keys. Each occurrence becomes a “finding” that records only the kind of data, never the data itself.

The extension only observes: it does not block, warn or change what is sent to the AI app. Findings are kept in the extension's local storage (500 at most), and the person can see them by clicking the extension's icon.

4. What leaves the device by default

While the browser is connected to a workspace, the extension sends Lustena's server (api.lustena.ai), for that workspace, metadata only, with no text:

• Findings: the kind of data found, its severity and confidence, how many times it occurred, the detector and its version, and a fingerprint of each value. The fingerprint is an HMAC-SHA256 keyed with a random secret generated at install: the same value seen twice on the same device gives the same fingerprint, but the value cannot be recovered from it.
• Destination and channel: which AI app and its domain, whether the content was typed, pasted or attached, and the date and time.
• Attached files: the file type, its size and a fingerprint of its name. Never the name or the contents.
• Conversations and turns: when each conversation starts and ends, the number of each message sent and which finding it produced. A conversation is identified by a code derived irreversibly from its id (an HMAC keyed with the install secret), from which the original id cannot be recovered.
• The custom GPT or project a conversation runs in, if any: whether it is a GPT or a project, and a code derived irreversibly from its id with a key shared by the workspace's devices, so the same GPT counts once across a team. Its name is never read, and its id is never sent.
• Device and sensor: a random install identifier, the extension and detection catalog versions, the operating system and browser, the extension's status on each app, and counts of messages and conversations since the last report.
• Person label (optional): the label set with the connection, by the organisation in its configuration (usually the corporate email) or by the person in the Conexão panel. The extension never reads it from the browser.

5. What never leaves the device

• The raw text of prompts, of pasted text and of AI answers. Only the redacted text of section 6 can leave, and only if content capture is on.
• Files and file names.
• Conversation ids, GPT and project ids and names, page addresses (URLs) and page titles.
• Anything typed or read on sites other than the AI apps above. The extension does not run on other sites.

6. Redacted content capture (optional)

Content capture is off by default. Only an administrator of the workspace the browser is connected to can turn it on, in the Lustena platform, and doing so requires recording the legal basis and a retention period of 1 to 365 days (30 by default). Every change is recorded: who changed it, when and what changed.

• For each message sent, the extension keeps the text the person sent and the AI's answer to it, up to 8,000 characters of input and 16,000 of answer.
• Before storing or sending anything, the extension replaces each recognised value on the device with a marker, for example “my email is [pii.email]”. Raw text is never stored or sent. Only the kinds of data the extension recognises are replaced: names, addresses and other personal data it does not recognise stay in the text as written.
• The redacted text is stored encrypted (AES-256-GCM) on Lustena's server and can be read only by the workspace's administrators, signed in to the platform. Every read is recorded in an audit log.
• It is deleted automatically at the end of the retention period set in the workspace, and the administrator can delete all captured content at any time.
• While capture is on, the extension's page shows the person the notice “Captura de conteúdo: ATIVA (texto redigido)” (content capture: on, redacted text), and the Conexão panel shows it too. When capture is turned off, the extension stops capturing and discards what it had not sent.

7. Legal bases

When an organisation configures the extension, it is for the organisation, as controller, to determine the legal basis and inform its employees of it, under Brazil's General Data Protection Law (LGPD) and, where applicable, the GDPR. Organisations usually rely on their legitimate interest in protecting their own and their customers' information (LGPD art. 7, IX; GDPR art. 6(1)(f)) or on a legal or regulatory obligation (LGPD art. 7, II; GDPR art. 6(1)(c)). Lustena processes the data as a processor, within the organisation's instructions (LGPD art. 39; GDPR art. 28).

To turn content capture on, the platform requires the workspace administrator to record the chosen legal basis, also when it was the person who connected the browser.

8. Retention

• On the device: up to 500 findings in the local list and, while the server cannot be reached, an upload queue. Redacted content stays on the device only until it is sent, and is erased when capture is turned off. Disconnecting erases the enrollment token, the device token and the queue of what was not sent; the local list of findings stays. Uninstalling the extension erases everything it stored in the browser.
• Redacted content on the server: for the period set in the workspace (1 to 365 days), then deleted automatically.
• Findings and conversation metadata on the server: they follow the workspace's retention settings. After the customer company's account ends, workspace data can be exported for thirty days; it is then deleted.
• After disconnecting: what was already sent stays in the workspace that received it, under that workspace's retention, and the device stays listed there until an administrator revokes it.

9. Security and where data is processed

• The extension talks only to https://api.lustena.ai, over HTTPS. Any other configured address is refused before anything is sent.
• Each device gets its own token, which can only send data, gives no access to data already sent, and expires after 90 days. The workspace's administrators can revoke a device at any time.
• On the server, each workspace's data is logically separated from the others', and access in the platform is restricted by role.
• Data may be processed outside Brazil and the European Economic Area under appropriate safeguards (LGPD arts. 33 to 36). Our subprocessors are listed in the Trust Center.

10. Your rights

Under the LGPD and the GDPR you can ask to confirm that processing takes place, to access, correct, anonymise, block or delete your data, to learn with whom it is shared, and to object to processing. You can also complain to Brazil's ANPD or to your data protection authority in the European Union.

If the extension was configured by the organisation you work for, it is the controller: exercise these rights with it first, through its data protection officer or the team in charge, and Lustena helps it answer. If you connected the browser yourself, contact that workspace's administrators; the Conexão panel shows which workspace it is. In local mode nothing is sent, and uninstalling the extension erases the data.

To reach Lustena about this policy, or if you do not know whom to ask: contato@lustena.ai, with the subject Privacy. We answer within fifteen days and forward requests to those responsible for the workspace.

11. Changes to this policy

When the extension changes how it handles data, this page is updated before the new version is published, and the date at the top changes. Material changes are communicated to customer organisations, which inform their employees.

12. Chrome Web Store: Limited Use

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements (https://developer.chrome.com/docs/webstore/program-policies/limited-use). This covers everything the extension receives through Chrome APIs. In practice:

• The data is used only for the extension's single purpose: detecting sensitive data sent to AI apps and reporting those findings to the workspace the browser is connected to.
• The data is never sold, never used or transferred for advertising, and never used to determine creditworthiness or for lending.
• The data is transferred only to the workspace the browser is connected to, through Lustena, and to the infrastructure providers needed to run the service. In local mode nothing is transferred.
• Humans do not read the data, except the workspace's administrators, who can read redacted content only if they turned content capture on (section 6), with the notice shown to the person, and where necessary for security or to comply with the law. The metadata of section 4 contains no text.