What is stored, and what is not

BeeSensible processes text to detect sensitive data. That text is not stored. What we do keep are counts and attributes, without content and without a user ID. Below is what that means in practice, checked against the code of version 6.0 of the product (14 October 2026).

#What is not stored

• The text someone types in an AI tool, email, chat or document. It is checked in working memory, discarded immediately and never written to disk.
• The content of documents being anonymised. Only the number of items removed is counted.
• Which placeholder stands for which value. If your organisation uses Keep context, the extension keeps track of this for each conversation, on the device itself. BeeSensible never receives it.
• The content of prompts. The first prompt of a conversation is sorted into a use-case category, such as "summarising", and then discarded. Only the category is counted.
• Who did something. No behavioural table holds a user ID; see below.

The extension does not request access to browser history or the clipboard. It runs only on the websites in its permission list. Beyond that, it only uses the permissions needed to store settings and sign you in.

#What is stored

Realtime Privacy. One row per highlight, recording the organisation, the type of data, the level (standard or critical), the app or website, the channel, the detection engine and how confident it was, the time, what was done with it (masked by hand or automatically, removed, or nothing) and whether the message was sent anyway. Each row also holds a technical check value, so the same highlight is not counted twice within an hour; how that value is produced is explained below.

AI use. Counters only: which AI domains were visited, per organisation per day; how many prompts per tool fell into each use-case category, per day; how many browser extensions used each tool, per month; and how many people fall into each usage frequency (daily, weekly, occasionally, not active), per month. The extension determines that frequency on the device itself and reports it as a single category. The underlying daily data stays on the device. For every notice at an AI tool (not allowed, limited use, no decision yet), we count that it was shown and what happened next: the alternative was opened, or the user continued anyway.

AI register. What your organisation records itself: for each tool, the decision (who, when, an optional internal reason, the condition and the alternative), the use cases, the people responsible (a member, or a name with a role), the type, status, date and link of each document (never the file itself), the review date, any deviations from the masking policy and the history of every change. Tools an admin has declared and the frozen Accountability reports are kept here too.

Custom terms. Your organisation's list of custom terms, stored encrypted. A highlight records only the term's category, never which term it was.

Document anonymisation. One row per document with the organisation, the time, the number of items removed and, if the document was added to a conversation, whether that was in ChatGPT, Claude or Gemini.

Department, if your organisation switches it on. With department insights enabled, the server adds the user's department to each of the rows above. The user's identity is not stored anywhere. The dashboard only shows a department once it reaches a minimum group size (5 people by default), and only over a period of at least 7 days. Smaller departments, archived departments and people without a department fall under "Other".

Account and organisation. Name, email address, language, time zone, sign-in method and Inbox mail preference of each user; roles, seats, subscription and billing details of the organisation; and per member the installation status of the extension and the desktop app (version, last seen, managed or not), so an admin can track the rollout. Admin actions, such as verifying a domain, linking an identity provider, changing the masking policy or switching the sandbox or evaluation mode on, go into an audit log with the admin's email address, the action and the time.

Technical logs. For each request to the API: the IP address, the method, the path including any parameters, the status code and the duration. Never the request contents. See Logging.

#No user ID in behavioural data

For highlights, documents and notices, we do not record who was involved. There is no field to write it to, so it cannot be looked up later either. The most that is stored is the department, and only when your organisation has switched on department insights. The AI counters hold nothing about individuals either. The dashboard has no per-employee view of any kind. Figures only appear once 5 or more users are active, and in a small organisation a combination of filters can still point to one person. See Roles and responsibility.

#The check value

To stop the same highlight being counted twice within an hour, each row carries a technical key.

We already receive the text for detection, so our servers compute that key as a cryptographic hash (SHA-256) of the type and the detected value. We do not store the value itself. For short, predictable values such as a national identification number, a hash like this can in theory be reversed. That is why we treat it as personal data, not as anonymous data.

If your organisation would rather not have that hash at all, we can set up detection on the device itself. A random reference is then sent instead of a hash of the value. Email hello@beesensible.euCopy to arrange this.

#Retention

• Highlights, document rows and notices: at most 24 months. A daily cleanup removes anything older.
• The AI counters and the AI register: for as long as the organisation exists.
• Account and organisation data: the contract term plus seven years, as Dutch law requires. If you delete your account or organisation, you can undo that for 30 days; after that, it is final.
• The audit log of admin actions: kept in full until a retention period is set.
• Database backups: seven days.
• Technical logs: the period is stated in the privacy policy.

For formal retention periods, the legal documents are authoritative: the data processing agreement (DPA) and the DPIA. Email trust@beesensible.eu for the current versions.