Klyra Shield Privacy Policy

1. Overview

Klyra Shield is a browser extension that helps organisations prevent sensitive information from being sent to AI tools (such as ChatGPT, Claude, and Gemini). This policy explains exactly what data the extension handles, where it goes, and what we store.

Our guiding principle: we never receive or store the content of what you type. Detection of sensitive content happens either in your own browser or on infrastructure your organisation controls, never on Klyra's servers.

2. How detection works, and where your data goes

The extension checks your messages for sensitive content before they are sent to an AI tool. There are two layers:

Local checks (in your browser)

Pattern-based checks for structured sensitive data (such as API keys, card numbers, and NHS numbers) run entirely within your browser. This content never leaves your device for these checks.

Smart detection (optional, when enabled by your organisation)

If your organisation enables smart detection, your message is sent to a detection service that runs on your organisation's own infrastructure for analysis. This service is operated by your organisation, not by Klyra. Your message content is analysed there and is never sent to Klyra and never leaves your organisation's environment. It is processed in memory and is not stored.

3. What Klyra receives and stores

When the extension detects sensitive content, or logs activity, it sends metadata only to Klyra. Specifically:

• Which AI platform was used (e.g. "ChatGPT")
• The category of any finding (e.g. "email address", "NHS number") — never the actual detected value
• The risk level (low / medium / high)
• The action taken (allowed / warned / blocked)
• Whether the user chose to proceed past a warning
• Your enrolment identifiers: a device identifier, your assigned user identifier, and the name provided at enrolment

We never receive the content of your messages, and we never receive the specific sensitive values that were detected (for example, we log that "an email address was detected", never the email address itself).

4. Data retention

Activity metadata is retained for 90 days, after which it is automatically deleted. Message content is never stored at any point.

5. Where data is stored and who we work with

Metadata is stored using the following infrastructure providers, who process data on our behalf:

• Supabase — database hosting
• Vercel — application hosting
• Stripe — payment processing
• Resend — transactional email

We do not use analytics, advertising, or tracking services, and we do not sell your data. We do not share the metadata described in section 3 with any third party other than the infrastructure providers listed above.

6. Cookies

The dashboard uses essential cookies to sign you in and keep you signed in. These are strictly functional: we do not use cookies for analytics, advertising, or tracking.

7. Your organisation's role

Klyra Shield is deployed by your organisation, which controls its configuration, including whether smart detection is enabled and where its detection service runs. Your organisation is the data controller for your use of the extension; Klyra acts as a data processor.

The processor is Klyra Labs Ltd, a company registered in England and Wales, contactable at hello@klyralabs.com. Requests to exercise your data protection rights should normally be made to your organisation as data controller; we will assist them in responding.

8. Contact

hello@klyralabs.com