Browser privacy notice
This notice covers the AIVA Co-Work extension for Chrome and Microsoft Edge, operated by Alyasra. It supplements the AIVA Privacy Policy, which describes the organization’s data handling, service providers, rights and contact details.
Your AIVA workspace
The home screen offers Chat, Data Mode, ERP Mode, Co-Work and Content Hub. Selecting an option displays AIVA’s web application in an isolated embedded page. These workspaces use your normal AIVA session and permissions. Messages, uploaded files, connected business data, creative requests, generated images and videos are processed and stored by the same AIVA services as on the website, under the main AIVA Privacy Policy. Installing the extension does not grant access to organizational data.
The web application uses its normal browser cookies and site storage. Its authentication token is not sent to the extension shell. Microsoft sign-in and additional tool consent are completed in a normal AIVA tab. Each fresh opening starts at the home screen. The extension no longer saves a preferred workspace; any preference from an older version is ignored.
What you share from a website
Add current page asks for access to the selected HTTPS website and places bounded page text, title and source address in your chat draft. Review or remove it before sending. This button does not submit the draft or send page text to AIVA’s backend by itself.
In Browser tools, you choose a tab with Use current tab. When you send a request or continue a task, AIVA sends the selected page’s URL, title, readable text, selected text and supported control labels to Alyasra’s AIVA backend and its configured AI service. Your prompt, recent conversation and approved action details are included so AIVA can respond in context. Without a shared tab, browser tools send your conversation without reading a page.
Pages may contain personal or confidential information, including information about other people. Share only content you are authorized to use. Password, payment, hidden and file inputs are excluded from the supported controls. Ordinary text displayed on a page may still contain sensitive information; these exclusions are not a general secret detector.
Purpose and access
The extension uses this information to answer questions, summarize and draft content, and perform browser steps that you approve. It does not sell data, include advertising or analytics trackers, or read your full browsing history. The backend uses existing AIVA authentication, service permissions and operational monitoring. Authorized organizational administrators and service providers may have access under the main AIVA Privacy Policy.
Use of information obtained through the extension is limited to providing and improving its disclosed user-facing features, security, and applicable legal obligations. It is not used for personalized advertising, creditworthiness or lending decisions. AI-provider retention and processing are governed by the organization’s configured provider agreements and the main AIVA Privacy Policy.
Where information remains
- Web workspace: submitted conversations, Co-Work tasks and Content Hub media are saved by AIVA and remain available through its normal history and gallery. Their retention and deletion follow the main policy. Unsaved drafts may be lost when the sidebar closes.
- Browser tools conversations: kept in the open sidebar’s memory. Closing the sidebar or starting a new browser conversation clears this local history. Saving a browser conversation creates a text file on your device.
- Co-Work results: selecting Return result to Intelligence saves the result, source URL and recent action summary in your existing AIVA task. Task retention and deletion follow the main AIVA Privacy Policy.
- Connections: the server stores account and installation references, connection times, usage counters and credential hashes. Access credentials expire within four hours. With Keep me connected enabled, a rotating renewal credential stays in this browser’s extension storage for up to seven days. It is not synchronized to other devices and content scripts cannot read it. Otherwise, the credential stays in browser-session storage and is removed on browser restart.
- Expired records: browser-session rows older than eight days are removed when a new AIVA companion connection is created. Without new connections, these expired rows remain inactive until maintenance removes them. Local expired renewal credentials are removed on the next connection check. Operational records and provider processing follow the main policy.
Browser permissions
| Permission | Purpose |
|---|---|
| Side panel | Show AIVA alongside the website. |
| Storage | Keep the scoped browser-tools connection and an explicitly handed-off task ID. No page text is stored using this extension permission. AIVA’s embedded website uses its own site storage. |
| Active tab and tabs | Identify the tab you choose, read its address/title and detect navigation or closure. The extension does not enumerate your browsing history. |
| Scripting | Run the extension’s packaged reader and approved actions on the shared page, in an isolated context. |
| AIVA backend access | Connect securely to the organization’s AIVA service over HTTPS. |
| AIVA website access | Display the isolated AIVA web workspace and enable its normal authenticated browser session. The extension does not request the cookies API or receive the website’s authentication token. |
| Optional website access | Ask permission for each HTTPS website you choose. This permission does not by itself share a page or authorize an action. |
Your controls
Stop cancels a running chat request. In browser tools it also clears pending approval; an action already sent to a website may have completed. Co-Work jobs and Content Hub generation use AIVA’s normal task controls; closing the sidebar is not a cancellation request for a server job. Remove in browser tools stops sharing the selected tab; remove persistent site permissions through the browser’s extension settings.
Disconnect in browser tools removes that tool connection’s local credentials and requests server revocation. It does not sign out of the embedded web workspace. Use the AIVA profile menu to sign out of that workspace. You can also revoke browser-tools connections from AIVA’s browser connections page. If offline, use that page from another connected device to confirm revocation.
Uninstalling the extension removes its local storage. Disconnect before uninstalling to revoke its server credential immediately. Otherwise, server expiry still applies. The extension cannot operate in private browsing windows.
Contact
For support, privacy questions or deletion requests, contact aiva@alyasra.com. Do not include passwords, access tokens or confidential page contents in a support message.