ClickNext AI Security Monitor

1. Overview

This Privacy Policy describes how the ClickNext AI Security Monitor Chrome Extension ("Extension") collects, uses, and protects information when installed and used by employees of ClickNext Co., Ltd. ("Company").

This Extension is an internal enterprise security tool. It is not intended for public consumer use. It is deployed exclusively by the Company's IT department to monitor AI tool usage across company-managed devices in compliance with corporate security policies.

1.1 Supported AI Platforms

As of version 2.0.0, the Extension monitors the following web-based AI platforms:

The Extension does not monitor desktop AI applications (e.g., Cursor IDE, VS Code Copilot, Codex CLI) as these operate outside the browser environment.

2. What Data Is Collected

The Extension collects the following information when employees interact with supported AI platforms:

2.1 Password Vault (Optional Feature)

The Extension includes an optional Password Vault — a personal, opt-in credential store (similar to a team password manager). It is entirely separate from the security-monitoring described above and behaves as follows:

• Deliberate entry only: Credentials appear in the Vault only when the employee explicitly types and saves them. The Extension never captures, reads, or records passwords entered into login forms on any website — there is no automatic password capture of any kind.
• Encrypted at rest: Each stored password is encrypted with AES-256-GCM before being written to the database. The encryption key is held only in the gateway server's environment, never in the database itself.
• Owner-only access: A Vault entry can be read back only by the employee who created it (verified by their signed-in session). IT/security administrators cannot read employees' stored passwords — the Vault is deliberately designed so it can never become an employer credential-surveillance tool.
• Sign-in required: The Vault is locked unless the employee is signed in to the organization dashboard. Every reveal of a stored password is recorded in the employee's own audit trail.
• Autofill runs on all sites, but only fills — never monitors: To offer autofill, the Extension's Vault component runs on all websites. On sites other than the supported AI platforms in §1.1 it does nothing except show your saved entries and fill them when you choose. The security monitoring (prompt / image capture in §2) still happens only on those AI platforms — no browsing, form input, or page content from any other site is ever read, collected, or transmitted.
• Item categories: Vault items can be organized into categories — Logins, Secure Notes, API Keys, and Cards. This is only an organizational grouping of items you deliberately save yourself; every category is encrypted and owner-only in exactly the same way, and none of it changes what the Extension monitors or collects.
• Shared / Team Vault (separate, deliberate sharing): Alongside the owner-only personal vault, there is an optional shared store for work credentials an employee chooses to share with a team or with specific email addresses. Unlike personal entries, a shared entry is — by design — readable by the people it is shared with, the person who shared it, and IT/super-admin (for company governance such as off-boarding). This is a deliberate, company-managed feature, not covert surveillance: sharing only ever happens when the credential holder initiates it, and every access to a shared entry (including super-admin reads) is recorded in the audit log. It does not affect personal entries above, which stay owner-only and unreadable by administrators.

3. What Data Is NOT Collected

• AI responses or outputs generated by AI platforms
• Full-resolution images or the original uploaded files (only a downscaled, JPEG-compressed copy is retained — see the table above)
• Browsing history unrelated to supported AI platforms
• Passwords or credentials typed into third-party websites — the Extension never captures, monitors, or records what you enter into login forms on any site (the optional Password Vault in §2.1 stores only credentials you deliberately save yourself, encrypted and readable only by you)
• Payment card information
• Personal communications, emails, or messages outside AI platforms
• Location data (GPS or IP-based geolocation)
• Biometric data of any kind

4. How Data Is Used

All collected data is used exclusively for the following corporate security purposes:

• Real-time DLP (Data Loss Prevention): Scanning prompts for sensitive patterns such as API keys, credit card numbers, internal connection strings, proprietary code, and internal business data (e.g., business plans, salary information) before they are sent to external AI services.
• Security Audit Trail: Maintaining a time-stamped record of AI tool usage per employee for compliance with internal IT security policies.
• Incident Response: Identifying and flagging security policy violations for investigation by the IT Security team.
• Monthly Usage Reporting: Generating aggregated usage reports for management review of AI tool adoption and risk posture.

5. Data Transmission and Storage

Collected data is transmitted via HTTPS to the organization's own security gateway — by default clicknexttest.biz; organizations running an isolated instance are served by their own dedicated subdomain configured through managed browser policy. All data is:

• Transmitted over encrypted HTTPS connections (TLS 1.2+)
• Stored in a secured SQLite database on a company-controlled server
• Kept per-organization in a separate database — one organization's data is never combined with another's
• Accessible only to authorized IT Security administrators (except Password Vault entries, which are readable only by the employee who created them)
• For Password Vault entries: additionally encrypted with AES-256-GCM, with the decryption key held only in the server environment and never stored in the database
• Not shared with any third parties, vendors, or AI platform providers
• Never used for advertising, profiling, or any commercial purpose

6. Data Retention

Activity logs are retained for 90 days from the date of collection. After this period, records are automatically and permanently deleted from the server. Employees who leave the company may request immediate deletion of their data by contacting the IT Security team.

7. User Rights (PDPA / GDPR)

Employees have the following rights regarding their data:

• Right to Access: Request a copy of all data collected about you.
• Right to Deletion: Request permanent deletion of your activity records (Right to be Forgotten).
• Right to Correction: Request correction of inaccurate personal data.
• Right to Object: Object to processing of your personal data in specific circumstances.

To exercise any of these rights, contact: it@clicknext.com

8. Consent

This Extension is deployed via organization-level Chrome management (Google Admin Console Managed Settings). By using a company-managed device with this Extension installed, employees acknowledge and consent to the monitoring activities described in this policy, as disclosed in the Company's Employee IT Acceptable Use Policy.

9. Security

The Company implements technical and organizational measures to protect collected data, including TLS encryption in transit, access control on server infrastructure, and regular security audits of the gateway system. Password Vault credentials are encrypted at rest with AES-256-GCM and can be decrypted only by the employee who created them; administrators have no ability to read them.

10. Changes to This Policy

This policy may be updated periodically. Employees will be notified of material changes via internal communication channels. Continued use of company-managed devices after changes constitutes acceptance of the updated policy.

11. Changelog

12. Contact Information

For questions about this privacy policy or data handling practices, contact:

• Organization: ClickNext Co., Ltd.
• IT Security Team: it@clicknext.com
• Website: clicknexttest.biz