BeeSensible processes text to detect sensitive data. That text is not stored. What we do keep are counts and attributes, without content and without a user id. Below is exactly what that is, verified against the product's code on 2 September 2026.

#What is not stored

• The text someone types in an AI tool, email, chat, or document. In on-device mode that text never leaves the machine. In cloud mode it is checked in working memory and discarded at once.
• The content of documents being anonymised. The document is processed temporarily; only the number of items removed is counted.
• The content of prompts. In cloud mode the first prompt of a conversation in an AI tool is sorted into a use-case category, such as "summarising"; the text is then discarded and only the category is counted. In on-device mode the desktop app does that sorting on the machine itself.
• Who did something. No behavioural table holds a user id; see below.

The extension does not request access to browser history or clipboard contents. It only runs on the websites in its permission list and otherwise uses only the permissions needed to store settings and sign the user in.

#What is stored

Realtime Privacy. One row per marking with: the organisation, the type of data found, the level (standard or highly sensitive), the app or website, the detection engine used, the time, what was done with it (replaced, masked, removed, or nothing), and whether the message was sent anyway afterwards. Plus a technical check value so the same marking is not counted twice within an hour; how that value is produced is explained below.

AI Governance. Counters only: which AI domain was visited, per organisation per day; how many prompts per tool fell into which use-case category, per day; and per month how many people fall into which usage frequency (daily, weekly, occasionally, not active). The extension determines that frequency on the device itself and reports it as a single category; the underlying daily data stays on the device. For every notice about an AI tool (not allowed, limited use, no decision yet) we count that it was shown and how it ended: alternative opened, or continued anyway.

Document anonymisation. One row per anonymised document with the organisation, the time, and the number of items removed.

Department, if your organisation switches it on. With department insights enabled, the server stamps the reporter's department on each row above at the moment of writing. Who it was is stored nowhere; the dashboard shows departments only above a minimum group size (5 people by default) and over a period of at least 7 days. Smaller departments, archived departments, and people without a department are folded into "Other".

Account and organisation. Name, email address, language, and time zone of each user; roles, seats, subscription, and billing details of the organisation; and per member the installation status of the extension and the desktop app (version, last seen, whether the installation is managed), so an admin can follow the rollout. Admin actions that decide who can sign in, such as verifying a domain or linking an identity provider, go into an audit log with the admin's email address, the action, and the time.

#No user id in behavioural data

For markings, documents, and notices, who it was is not recorded. There is nowhere it could be written, so it cannot be looked up or reconstructed afterwards either. At most the department is stored, and only when your organisation has switched on department insights. The AI Governance counters hold nothing about individuals either. The dashboard has no per-employee view of any kind.

#The check value

So the same marking is not counted twice within an hour, each row carries a technical key.

• On-device mode. The device mints a random reference unrelated to the detected value and sends only that reference. The detected value, and any cryptographic derivative of it, never leaves the device.
• Cloud mode. Since the text is already with us for detection, our servers compute the key as a cryptographic derivative (SHA-256) of the type and the detected value. We do not store the value itself. For short, predictable values such as a national identification number such a derivative is in theory reversible, so we treat it as personal data rather than as anonymous data. If your organisation would rather avoid this altogether, on-device mode is the answer.

#Retention

• Markings, document rows, and notices: at most 24 months. A daily cleanup removes anything older.
• The AI Governance counters: for as long as the organisation exists.
• Account and organisation data: the contract term plus seven years, as Dutch law requires. If you delete your account or your organisation, that can be undone for 30 days and is final after that.
• The audit log of admin actions: kept in full until a retention period has been set.

For formal retention periods, the data processing agreement, or a DPIA, the legal documentation is authoritative. Email trust@beesensible.eu for the current documents.