Privacy Policy

Chado AI is a workplace data-loss-prevention (DLP) tool. Employers deploy it on company devices to see which AI tools are used at work and to stop confidential data being pasted into them. It is not a consumer product and cannot be usefully installed by an individual: it does nothing until an administrator enrolls it with an organization token.

The employer that deploys Chado AI is the data controller. They decide what is collected and how long it is kept, and they are responsible for telling their staff that monitoring is in place. Veganext operates the service on their behalf as a processor.

• Prompt content on AI tools. When a request is sent to a recognized AI service, its text is examined for sensitive data — credentials, API keys, and personal data such as email addresses or card numbers.
• AI usage activity. Which AI tool was used, on which device, at what time, and what the policy decided (allowed, warned, redacted, or blocked).
• Device and identity. Hostname, operating system, browser, and the employee name recorded at installation, so an incident can be attributed to a device and a person.

Detection is scoped to AI services. On ordinary websites the extension observes request shapes only to recognize AI APIs on unknown or white-labeled domains; it does not read page content, and typing is never captured on non-AI sites.

• Browsing history unrelated to AI tools.
• Passwords, or content from your password manager.
• Personal email, messages, or files outside AI prompts.
• Location, financial account data, or health data.
• Anything at all before the extension is enrolled by an administrator.

Collected data is sent over an encrypted connection to the Chado AI backend and stored against the organization the enrollment token belongs to. By default that backend is the deployment operated by Veganext at chado.vegax.ai. Organizations that self-host Chado AI point their devices at their own deployment, in which case the data never reaches Veganext at all.

We do not sell data, share it with third parties, or use it for advertising, credit decisions, or training AI models. It is used only to operate the product for the deploying organization.

Each organization chooses how prompt text is retained: stored in full, stored as a one-way hash, or discarded entirely. Discarding is the default — in that mode the detection result is recorded, but the prompt text is dropped at ingestion and never written to storage.

Because your employer controls this data, requests to access, correct, or delete it should go to them first — they can action them directly in their Chado AI console. If you are unsure who to contact, or your employer directs you to us, write to privacy@veganext.com.

Depending on where you live you may have rights under the GDPR, the CCPA, or similar laws, including access, correction, deletion, and objecting to processing. We support the deploying organization in honouring those requests.

Data is encrypted in transit. Each device authenticates with its own short-lived credential rather than a shared secret, so one device cannot read another's data or another organization's. Access to the console is authenticated and scoped to a single organization.

If we change what is collected, this page is updated before the change ships, and the Chrome Web Store data-use disclosure is updated with it.

Veganext — privacy@veganext.com