Browser Privacy Notice

Halo Browser Security inventories and governs AI use on enrolled browsers. Which of the categories below are collected depends on the browser, the websites the extension can access, and the collectors the deploying organization has enabled.

• Page domains. The domain of pages visited, so that visits to recognized AI applications can be matched and the organization’s domain policy applied. Domains that do not match an application in Halo’s AI catalog are not transmitted as navigation telemetry. Full URLs, page paths, and query strings are not included in the browser telemetry payload.
• Content on recognized AI application pages only. Prompts, pasted text, upload metadata, and responses are evaluated against the organization’s sensitive-data rules. Depending on the organization’s configuration, prompt and pasted text may be transmitted to Halo; otherwise only content-derived metadata, such as a SHA-256 hash and byte length, is transmitted. Upload file contents are not collected. Content is not read on pages that are not a recognized AI application.
• Page-structure diagnostics and detection health. Structural and status information about AI application pages, used to keep Halo’s detection working. Section 2 describes this.
• AI application account classification. For supported interactions, Halo Browser Security may infer whether the active AI application session appears to be a work account, personal account, or unknown, and transmits that classification with the interaction event. It does not transmit the account’s username or login credentials.
• Connected AI tools. Connectors, plugins, skills, and MCP servers linked to AI applications, read from a fixed allowlist of those applications’ own inventory endpoints.
• Browsing history. The preceding 30 days, summarized per AI application (application, visit count, first and last visit). Full browsing history is not uploaded.
• Cookie presence. Only whether a cookie exists for a known AI application domain, as a signal that the user is signed in. Cookie values are not inspected, used, stored, or transmitted.
• Other installed extensions. The identifier, name, version, and declared permissions of installed extensions whose names match an AI-related pattern.
• Installation and health data. An installation identifier, browser and operating-system name and version, extension version, website access, collector and policy status, and error information.

Halo delivers interaction profiles to the extension: configuration that describes where controls such as prompt fields, send buttons, and responses appear on AI applications. To keep this detection working as applications change, the extension may produce the information below, which is used to maintain detection.

The deploying organization’s Halo administrator, not the individual user, controls how the extension behaves. An administrator can configure:

• Whether browsing-history, cookie-presence, and installed-extension discovery run.
• Whether prompt and pasted-text capture is enabled, independently of the discovery collectors above.
• Domain-level and application-level policy, including what is allowed, audited, warned, or blocked.

In Chrome and Edge, these collectors run under permissions the browser grants at install time, so enabling a collector in policy activates it. In Safari, they run on the websites the extension may access in Safari Settings, which you or your organization manage.

Where an organization deploys Halo Browser Security, that organization is responsible for configuring the applicable collectors, notifying its personnel, and meeting any notice, consent, or works-council obligations that apply where they work. We process this data on that organization’s instructions and cannot alter or delete it on an individual’s request.

If you want to know what is collected about you, or wish to access, correct, or delete it, please contact your employer or the administrator who deployed Halo. If you contact us directly, we will refer you to them.

You can disable or remove the extension in your browser and, in Safari, change its website access in Safari Settings. Your organization may manage these settings.

Data queued for transmission is stored on the device only until it is sent successfully, or until a newer observation of the same item replaces it. Once received by Halo, browser data is retained while the account is active and for up to 90 days after account closure for export, unless a different period is required by law or agreed in an applicable Data Processing Addendum, as described in the Data retention section of our Privacy Policy.

Uninstalling the extension removes its locally stored data. On macOS, removing the Halo Browser Security app removes the Safari extension and its local data. Disabling the extension stops collection while it is disabled. Neither action deletes data already received by the deploying organization’s Halo tenant; that data follows the server-side retention period described above.

Page-structure diagnostics are deleted sooner, as described in Section 2.

If what Halo Browser Security collects or how it is used changes, we will update this Notice and, where the change is material, give notice as described in our Privacy Policy.

Privacy questions and requests: legal@omnitrusthalo.com. If Halo was deployed by your employer, please contact that organization first.