Jarel
Legal
Last updated: August 2026
The Jarel extension reads the web page you ask it to work on. That is a meaningful thing to hand to software, so this page states plainly what it can reach, what leaves your browser, and what never does.
This policy covers the Jarel browser extension for Google Chrome. It sits alongside our main Privacy Policy, which continues to govern your Jarel account, your workspace, and everything you do in the Jarel web and mobile apps. Where the two differ, this document is the more specific one for anything the extension does inside your browser.
Bizlution AB ("Jarel", "we", "us") is the data controller, incorporated in Sweden and headquartered in Gothenburg. Our contact for data protection matters is privacy@jarel.se.
On installation the extension has access to no website at all. It requests permission for one origin at a time, at the moment you first ask it to work on a page there, through Chrome's own permission prompt. Access is remembered so you are not asked repeatedly, and you can withdraw it for any site at any time from Chrome's extension settings. The extension does not read your browsing history, does not run in the background on sites you have not approved, and does not observe pages you have not asked it to work on.
When you give the extension an instruction, it sends our servers: the address and title of the tab you are working on; that page's visible text, capped at roughly 24,000 characters; a list of the interactive elements on the page with their roles and labels; and the outcome of the previous action it took. This is sent so our systems can decide what the assistant should do next. It is sent over TLS and is not shared with advertisers, data brokers, or any third party outside the processing described in section 6.
The extension detects password fields, card number fields, CVV, IBAN, national identity number and similar credential and payment inputs. Their contents are never included in what is sent to us, and the assistant is refused permission to type into them — you are asked to fill those in yourself. The extension also never reads cookies, never reads site storage such as localStorage, never sends pages from sites you have not granted, and never sends the contents of tabs other than the one being worked on.
Page content is passed to our model provider through Vercel AI Gateway as part of producing the assistant's next action, on the same terms and safeguards described in our main Privacy Policy and Security page. Provider processing is configured not to train on customer content where supported by provider terms. The extension itself contains no analytics, advertising, tracking or telemetry software of any kind.
Page content is used to determine the next action and is not retained as page content. What is retained is the audit record in your workspace: which actions the assistant took, against which address, and when. That record exists so that your organization has a durable, tamper-evident account of what was done on a client matter, and it is subject to the retention terms of your Jarel account.
The extension holds your Jarel session token in Chrome's session storage. It is cleared when you close your browser and is never written to disk. Your email address is stored alongside it so the panel can show which account is in use. You can disconnect at any time from the extension, which discards both immediately.
You can revoke any site's access individually, disconnect your Jarel account from the extension, or uninstall the extension entirely — each takes effect immediately. Your rights under GDPR, including access, correction, erasure, restriction, objection and portability, apply to data processed through the extension exactly as they do to the rest of the Service. Section 9 of our main Privacy Policy explains how to exercise them.
The extension acts under your supervision. Anything consequential — submitting a form, sending, paying, filing, deleting, or leaving a site for one you have not approved — pauses and asks you before it happens. Completing an electronic signature, filing to a court system, and entering credentials or payment details are refused outright. You should read those confirmation prompts before approving them: web pages can contain text written specifically to mislead an automated assistant, and while we treat all page content as information rather than as instructions, your judgement is the final safeguard.
We will update this policy when the extension's behaviour changes in a way that affects what it accesses or sends. Material changes are announced in-product before they take effect, and the revision date at the top of this page always reflects the current version.
For questions about this policy or the extension's handling of your data, contact privacy@jarel.se or write to: Bizlution AB, Gothenburg, Sweden. We aim to respond within 72 hours.
Questions about this policy? Contact privacy@jarel.se. See also our Privacy Policy and Security Policy.