Privacy & Security

This page describes what the product does. The legally binding text is the Privacy Policy, and where the two ever disagree the policy is right and this page is a bug.

What Appilot reads from the page

There are two situations here and they are genuinely different, so they are described separately. Most descriptions of assistants blur them, and that is how a page ends up claiming something untrue.

While you are just browsing

The extension reads the shape of the page: field labels, field types, placeholders, headings, buttons and interface text. This happens on your own machine, on every page you open, so that the assistant is ready if you open it.

No field value is read. The scanner records that a field exists, what it is called and what type it is, and never what is in it. Checkbox and radio state and the current selection of a dropdown are read, because those are part of the page's shape rather than something you typed.

One thing leaves your browser at this point: the site address, without the path, so we can answer whether your organization has configured Appilot here. That answer is not stored on our side.

When you ask the assistant something

Now the assistant can read what is on the screen, including values you have already typed into the form. That is how it checks the field you asked about, tells you what is missing, and fills in the rest. Filling in a form is the product; it cannot be done blind.

Four kinds of field stay unreadable even then:

Withheld	How it is recognised
Passwords	type="password", or autocomplete of current-password / new-password
One-time codes	autocomplete="one-time-code"
Payment card fields	any cc- autocomplete token, so number, expiry and security code
Hidden fields the page sets for itself	type="hidden", which carries CSRF tokens and record ids

For those the assistant is told the field exists and whether it is filled, and never the value. The rule lives in one place in the code so that every reader and every action consults the same list. It matches real form controls, so a site that builds a password box out of a rich-text editor would not be recognised, which is worth knowing if you administer such a site.

Everything the assistant reads during a turn goes into the question sent to the AI provider and is stored with that turn as conversation history. So does anything you pinned as Always Present in My Context, which travels with every question you ask whatever the question is about.

A turn reads the tab you asked from. The tab is fixed at the moment you press send and every read and action during that turn goes to it, so switching to another tab while the assistant is thinking does not redirect it there. If that tab closes, or navigates to a different site, the assistant refuses the read rather than falling back to whatever is in front of you.

What Appilot does not capture

• Your browsing. No history of the pages you open, no search terms, no record of the fields you click into. What is recorded is what you do with Appilot: opening the panel, asking a question, letting it run an action.
• Passwords and payment details, as above, inside a turn as much as outside one.
• Anything for advertising or analytics. There is none in the product.

Where Appilot does not appear at all

Some sites are documents rather than applications, and there is nothing for an assistant to operate on them. Every Appilot host is in that category, and the extension stays off all of them: the public site, this documentation, the downloads page, and the consoles you administer Appilot from, which are My Account and the Backoffice. The same applies to l3.eu, the site of a product built on Appilot. Suppression covers subdomains, so one entry covers a whole site.

For any other site you can switch it off yourself: right-click the page and choose Pause Appilot on this site. The same menu brings it back.

PII masking

When your organization uses a third-party AI provider (for example a cloud model), Appilot masks sensitive details in your message before they reach that provider. It detects and replaces patterns such as:

• Email addresses
• Phone numbers
• Social security numbers
• Credit card numbers
• Street addresses

Each masked value is replaced with a neutral placeholder, so the provider receives your question without the sensitive detail.

When you see a "hidden for privacy" marker

If a value in your message was masked, the assistant shows a small 🛡️ hidden for privacy marker where that value used to be, with a short note beneath the message. This is intentional and explains why part of your wording was set aside before the question was sent to the AI provider. It is also visible to your administrators when they review a conversation, so a masked value is never a silent change.

If you ever notice the assistant ignoring part of your request, check for this marker: a detail you typed may have matched a sensitive pattern and been masked.

Sovereign / on-premise deployments

When your organization runs Appilot against its own on-premise AI model (sovereign mode), your message never leaves your organization's infrastructure. There is no third party to shield, so the server-side sanitizer is skipped and the model works with your exact wording.

The browser extension is a separate story, and this is the part the docs used to get wrong. The extension masks on its own side before the request leaves your browser, and it does not know which provider your organization uses, so it keeps masking either way. In practice that means you can still see "hidden for privacy" markers on an on-premise deployment when you use the extension. The widget has no client-side masking, so on the widget a sovereign turn carries no markers at all.

Detection is conservative. Masking only triggers on clearly sensitive patterns: it will not hide an ordinary number such as "reply in under 40 words" or "wait 5 minutes". Only structured data (a full email, a street address with a street name, a card number) is masked.

Privacy controls

In the extension settings, you can:

• Enable or disable PII masking (on by default, but configurable)
• Review what's captured: see the page context that Appilot detects

Outside settings, the page context menu carries Pause Appilot on this site, which stops the assistant from loading on that site entirely. The choice follows your browser profile.

What is stored on your device

The extension and the widget keep things in your browser so the product works and does not forget your settings. Nothing here is read by anyone but Appilot, and nothing is sent anywhere for advertising or measurement.

Stored	Cleared when
Session token and the profile shown in the panel	You sign out
The map from a redaction marker back to the value it hides	You sign out, or 24 hours pass
Language, theme, panel position and size, dismissed notices	You clear browser storage
A copy of the current conversation, kept per site so the panel can restore it after a reload	You start a new conversation on that site
The list of sites you paused Appilot on, synchronised across your signed-in browsers	You resume Appilot on that site
A short cache of the current site's Appilot configuration, and up to 100 Appilot events whose upload failed	The cache expires or the retry succeeds

Two details worth knowing.

The conversation cache and a few preference keys name the site they belong to, so your own device holds a partial record of where you have used Appilot. Our servers do not.

The extension's panel runs inside the page you are visiting, so a few of its preferences are written into that site's own browser storage rather than into the extension's. A site could read those keys. They hold a dismissed-notice flag and a layout choice, never your token and never your conversation.

Who can read your conversations

You can, in your own history. Two other groups can, and it is better to know this before you type something into the assistant than after.

• An administrator of your organization can open the conversations held under that organization and read them: the questions, the answers, and the record of what the assistant did. That is what the organization's audit surface is for, and it is how an administrator investigates a wrong answer. The prompt record beneath a turn, which is the full text the model was given, needs the admin role specifically; belonging to the organization is not enough. What you saved in My Context is redacted out of those prompt records, each statement replaced by a note giving its length and nothing else. The conversation itself is not redacted.
• Appilot staff on a small number of platform administrator accounts can read any conversation on the platform, to debug the product during the beta.

Aggregated analytics across an organization are restricted to administrators of that organization. Being a member of the organization is not enough.

How long it is kept

• Assistant turns, meaning your questions, the answers and the prompt records beneath them, are deleted 90 days after they were created, by a job that runs daily. An organization can agree a shorter period, and can also ask for its turns to be kept indefinitely.
• Request logs are kept for seven days, swept daily. A log line records that a request happened: the method, the path without its query string, the status, how long it took, the request reference you see in an error message, and which account and organization made it. The bodies and headers of requests are not written at all unless the deployment switches capture on, and when it is on they pass a redaction step first.
• Refused turns are kept for 90 days. When the assistant cannot answer, for example because an allowance ran out, the refusal is recorded with its reason code, the surface, the path and the reference you were shown, and nothing you typed. The Appilot team uses it to find and lift what stopped you. A request for more allowance you send from the panel or My Account stays until it is resolved and goes with the account.
• Everything else lives as long as the account: your profile, your saved context, your conversation titles and your usage counts. Deleting the account removes them in the same transaction.

Getting a copy, or deleting it

Both live in My Account, under Profile.

Download my data produces a single JSON file holding what the account owns: your profile, your saved context, your conversations and the turns inside them, your requests, your notifications and your credit history. The file opens with a manifest naming every table it contains, how many rows each one holds, and where something was held back. Two things are held back on purpose, and the manifest says so: the bodies of request logs, and the stored snapshot of the page a turn ran on. Both can carry other people's data.

Delete my account erases what the account owns and cannot be undone. An account with a password confirms with that password. An account that signs in with Google or through a company identity provider has no password to give, so it confirms by typing its own email address instead.

An administrator of an organization has a third control on the same page, Delete organization, which removes the organization and everything under it. Members keep their own accounts and lose their membership; anyone who belonged to no other organization cannot sign in afterwards.

Data isolation

• Your organization's data is isolated from other organizations.
• Your conversations are private to you and to the administrators described above.
• Your My Context entries are used only in your own interactions.

Enterprise compliance

For organizations with strict compliance needs:

• Configurable AI providers, including a model on your own infrastructure, which is the only configuration where prompts do not leave your premises. The default is DeepSeek, picked because it is the cheapest engine that handles the assistant's tool use well and because its weights are open, so the same engine can run on your own hardware later. During the closed beta it points at DeepSeek's managed API, which processes in China, so an organization with data residency obligations changes this before it deploys.
• Audit-ready activity logging and conversation review.
• Role-based access controls.
• An Art. 28 data processing agreement, which we sign before any deployment on real data. Ask for it at hello@appilot.space.