Jarel
Legal
Last updated: August 2026
This policy covers the Jarel browser extension for Google Chrome. It sits alongside our main Privacy Policy, which continues to govern your Jarel account, your workspace, and everything you do in the Jarel web and mobile apps. Where the two differ, this document is the more specific one for anything the extension does inside your browser.
Bizlution AB ("Jarel", "we", "us") is the data controller, incorporated in Sweden and headquartered in Gothenburg. Our contact for data protection matters is privacy@jarel.se.
On installation the extension has access to no website at all. It requests permission for one origin at a time, at the moment you first ask it to work on a page there, through Chrome's own permission prompt. Access is remembered so you are not asked repeatedly, and you can withdraw it for any site at any time from Chrome's extension settings. The extension does not read your browsing history, does not read or act on sites you have not approved, and does not observe pages you have not asked it to work on. The one thing it does in the background is the check for remote tasks described in section 8, which reads no page.
When you give the extension an instruction, it sends our servers: the address and title of the tab you are working on; that page's visible text, capped at roughly 24,000 characters; a list of the interactive elements on the page with their roles and labels; and the outcome of the previous action it took. If you add an image or choose “Take a screenshot”, it also sends that one image. A screenshot requested by the assistant is sent only after you approve it. Images are decoded and re-encoded locally as bounded JPEGs before sending, which removes filenames, EXIF and GPS metadata, animation, and trailing data. This is sent so our systems can decide what the assistant should do next. It is sent over TLS and is not shared with advertisers, data brokers, or any third party outside the processing described in section 6.
The extension detects password fields, card number fields, CVV, IBAN, national identity number and similar credential and payment inputs. Their DOM values are never included in the structured page snapshot, and the assistant is refused permission to type into them — you are asked to fill those in yourself. An image can nevertheless contain anything visibly rendered on the page, including sensitive information, so review its preview or screenshot confirmation before sending. The extension also never reads cookies, never reads site storage such as localStorage, never sends pages from sites you have not granted, and never captures a tab other than the active tab it was bound to; a capture is discarded if that tab changes during the operation.
Page content is passed to our model provider through Vercel AI Gateway as part of producing the assistant's next action, on the same terms and safeguards described in our main Privacy Policy and Security page. Provider processing is configured not to train on customer content where supported by provider terms. The extension itself contains no analytics, advertising, tracking or telemetry software of any kind. Jarel's use and transfer of data received from Chrome complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. We use and transfer it only to provide or secure the browser-assistant feature described here; never for advertising, creditworthiness, lending or unrelated profiling. Humans do not read it except with your specific consent or when required for security or law.
Page content and image pixels are used to determine the next action and are not retained as page content. An image is supplied to one model step only and is not placed in conversation history, tool results, extension storage, logs, or the audit record. What is retained is the audit record in your workspace: which actions the assistant took, against which address, and when, together with non-content image metadata such as source, byte size and dimensions. That record exists so that your organization has a durable, tamper-evident account of what was done on a client matter, and it is subject to the retention terms of your Jarel account.
When you are signed in, the extension registers your browser as a device on your Jarel account so you can send it tasks from your phone or the web app. To do that it sends Jarel a device id, a short label such as “Chrome on macOS” and your browser's user-agent string, and it checks in about every five minutes. While you are signed in it also asks Jarel for waiting tasks about every 30 seconds, using your Jarel session; that check reads no web page. A task runs in your browser only when it comes from your own signed-in account. It works in a new background tab in a tab group called Jarel, only on sites you have approved, and it stops and waits at anything that needs your confirmation (section 11). What it does is recorded in your workspace audit record as described in section 7. The extension keeps the device id in Chrome's local storage so your browser is not registered again on every start. To stop it, choose Sign out in the extension's panel menu, which ends the checks at once, or uninstall the extension, which removes the stored device id. There is no screen in the Jarel app yet for removing a registered device from your account; write to privacy@jarel.se and we will remove it.
The extension holds your Jarel session token in Chrome's session storage. Chrome keeps session storage in memory, so the token is cleared when you close your browser and is not written to disk by the extension. Your email address is stored alongside it so the panel can show which account is in use. You can disconnect at any time with Sign out in the extension's panel menu, which discards both immediately. The extension does keep two things in Chrome's local storage, which persists on disk: the list of sites you have approved, and the device id described in section 8.
You can revoke any site's access individually, disconnect your Jarel account from the extension, or uninstall the extension entirely — each takes effect immediately. Signing out also stops the remote-task check on that browser. Your rights under GDPR, including access, correction, erasure, restriction, objection and portability, apply to data processed through the extension exactly as they do to the rest of the Service. Section 9 of our main Privacy Policy explains how to exercise them.
The extension acts under your supervision. Anything consequential — submitting a form, sending, paying, filing, deleting, or leaving a site for one you have not approved — pauses and asks you before it happens. A screenshot requested by the assistant also pauses for approval. After the assistant sees any image, every action other than a pure observation is raised to confirmation, and the prompt shows the exact typed value, selected value, key, tab or destination. Completing an electronic signature, filing to a court system, and entering credentials or payment details are refused outright. You should read those confirmation prompts before approving them: web pages and images can contain text written specifically to mislead an automated assistant, and while we treat all page content and pixels as information rather than as instructions, your judgement is the final safeguard.
We will update this policy when the extension's behaviour changes in a way that affects what it accesses or sends. Material changes are announced in-product before they take effect, and the revision date at the top of this page always reflects the current version.
For questions about this policy or the extension's handling of your data, contact privacy@jarel.se or write to: Bizlution AB (org. no. 559264-7050), Kalvhagen 7, 427 50 Billdal, Sweden. We aim to respond within 72 hours.
Questions about this policy? Contact privacy@jarel.se. See also our Privacy Policy and Security Policy.