Privacy policy
Effective 2 November 2026
Bruno is a data protection tool that companies give their employees. It checks what employees send to AI chat tools and stops company and personal data from leaving. This policy covers the Bruno browser extension and the Bruno service behind it, both made by ByteCorp.
Who is responsible
Your employer decides to use Bruno and sets its policies, so your employer controls the data Bruno collects about your work. ByteCorp runs Bruno for your employer and handles that data only on its instructions. Questions about how your employer uses Bruno go to your company’s IT or security team.
What the extension collects
- Your work email. You type it once to connect the browser to your company. Bruno emails you a sign-in code, then stores a device key in the browser.
- What you send to AI chat tools. On ChatGPT and Claude, Bruno checks the messages you send and the files you upload. Simple checks (ID numbers, keys, card numbers) run in your browser first. The rest are sent to Bruno’s server, where a model checks them.
- Messages and files that are stopped or flagged. When Bruno blocks something, asks you for a reason, warns you, logs it under a company policy, or can’t check it in time, it stores the full message or file, your reason if you gave one, the site and the time, so your company’s admins can review it. These can contain anything you typed, including personal, health, financial or login details.
- Which AI tools you use. Bruno notes the address of AI tools you visit and the AI services other sites call, with the time, so your admin can approve or block them. It does not record what you read or do on other websites.
Messages and files that are simply allowed are checked and not kept: Bruno stores no copy of an allowed message, and an allowed file is deleted within a day.
What Bruno does not do
- It does not sell your data or share it with advertisers.
- It does not send your messages or files to AI companies for its checks. The model that checks them is an open model running on servers ByteCorp rents and controls, and it is not trained on your data.
- It does not collect your location.
- It does not use your data for anything except protecting your company’s data, as this policy describes.
Bruno’s use of data complies with the Chrome Web Store User Data Policy, including its Limited Use requirements.
Who can see it
Your company’s Bruno admins can see stored messages and files, your reasons, and the AI tools in use. ByteCorp staff access this data only to run, secure and support the service, or when the law requires it.
Where it is stored and who helps us
- Google Cloud, United States: Bruno’s server and database.
- RunPod, United States: the GPU servers that run the checking model. They handle messages and files only while checking them.
- SendGrid: sends sign-in codes and admin alerts by email.
Data travels over encrypted connections (HTTPS) and is encrypted at rest by our cloud provider.
How long it is kept
- Stopped and flagged messages and files: 30 days, then deleted.
- Allowed files: deleted within a day. Allowed messages: not stored.
- Sign-in codes: expire after a few minutes.
- Your work email and device: for as long as your company uses Bruno, or until your admin removes your device.
Your choices
Your employer requires Bruno on work browsers, so to see, correct or delete your data, ask your company’s IT or security team first. You can also write to us. Removing the extension stops it collecting anything, and your admin is told it was removed.
Changes
If this policy changes, we update this page and the date at the top. Bigger changes are announced to your company’s admins before they take effect.
Contact
ByteCorp, for Bruno Security: info@bytecorp.io