Jarel
Legal
Last updated: August 2026
The Jarel extension reads the web page you ask it to work on. That is a meaningful thing to hand to software, so this page states plainly what it can reach, what leaves your browser, and what never does.
This policy covers the Jarel browser extension for Google Chrome. It sits alongside our main Privacy Policy, which continues to govern your Jarel account, your workspace, and everything you do in the Jarel web and mobile apps. Where the two differ, this document is the more specific one for anything the extension does inside your browser.
Bizlution AB ("Jarel", "we", "us") is the data controller, incorporated in Sweden and headquartered in Gothenburg. Our contact for data protection matters is privacy@jarel.se.
On installation the extension has access to no website at all. It requests permission for one origin at a time, at the moment you first ask it to work on a page there, through Chrome's own permission prompt. Access is remembered so you are not asked repeatedly, and you can withdraw it for any site at any time from Chrome's extension settings. The extension does not read your browsing history, does not run in the background on sites you have not approved, and does not observe pages you have not asked it to work on.
When you give the extension an instruction, it sends our servers: the address and title of the tab you are working on; that page's visible text, capped at roughly 24,000 characters; a list of the interactive elements on the page with their roles and labels; and the outcome of the previous action it took. If you add an image or choose “Take a screenshot”, it also sends that one image. A screenshot requested by the assistant is sent only after you approve it. Images are decoded and re-encoded locally as bounded JPEGs before sending, which removes filenames, EXIF and GPS metadata, animation, and trailing data. This is sent so our systems can decide what the assistant should do next. It is sent over TLS and is not shared with advertisers, data brokers, or any third party outside the processing described in section 6.
The extension detects password fields, card number fields, CVV, IBAN, national identity number and similar credential and payment inputs. Their DOM values are never included in the structured page snapshot, and the assistant is refused permission to type into them — you are asked to fill those in yourself. An image can nevertheless contain anything visibly rendered on the page, including sensitive information, so review its preview or screenshot confirmation before sending. The extension also never reads cookies, never reads site storage such as localStorage, never sends pages from sites you have not granted, and never captures a tab other than the active tab it was bound to; a capture is discarded if that tab changes during the operation.
Page content is passed to our model provider through Vercel AI Gateway as part of producing the assistant's next action, on the same terms and safeguards described in our main Privacy Policy and Security page. Provider processing is configured not to train on customer content where supported by provider terms. The extension itself contains no analytics, advertising, tracking or telemetry software of any kind. Jarel's use and transfer of data received from Chrome complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. We use and transfer it only to provide or secure the browser-assistant feature described here; never for advertising, creditworthiness, lending or unrelated profiling. Humans do not read it except with your specific consent or when required for security or law.
Page content and image pixels are used to determine the next action and are not retained as page content. An image is supplied to one model step only and is not placed in conversation history, tool results, extension storage, logs, or the audit record. What is retained is the audit record in your workspace: which actions the assistant took, against which address, and when, together with non-content image metadata such as source, byte size and dimensions. That record exists so that your organization has a durable, tamper-evident account of what was done on a client matter, and it is subject to the retention terms of your Jarel account.
The extension holds your Jarel session token in Chrome's session storage. It is cleared when you close your browser and is never written to disk. Your email address is stored alongside it so the panel can show which account is in use. You can disconnect at any time from the extension, which discards both immediately.
You can revoke any site's access individually, disconnect your Jarel account from the extension, or uninstall the extension entirely — each takes effect immediately. Your rights under GDPR, including access, correction, erasure, restriction, objection and portability, apply to data processed through the extension exactly as they do to the rest of the Service. Section 9 of our main Privacy Policy explains how to exercise them.
The extension acts under your supervision. Anything consequential — submitting a form, sending, paying, filing, deleting, or leaving a site for one you have not approved — pauses and asks you before it happens. A screenshot requested by the assistant also pauses for approval. After the assistant sees any image, every action other than a pure observation is raised to confirmation, and the prompt shows the exact typed value, selected value, key, tab or destination. Completing an electronic signature, filing to a court system, and entering credentials or payment details are refused outright. You should read those confirmation prompts before approving them: web pages and images can contain text written specifically to mislead an automated assistant, and while we treat all page content and pixels as information rather than as instructions, your judgement is the final safeguard.
We will update this policy when the extension's behaviour changes in a way that affects what it accesses or sends. Material changes are announced in-product before they take effect, and the revision date at the top of this page always reflects the current version.
For questions about this policy or the extension's handling of your data, contact privacy@jarel.se or write to: Bizlution AB, Gothenburg, Sweden. We aim to respond within 72 hours.
Questions about this policy? Contact privacy@jarel.se. See also our Privacy Policy and Security Policy.