Privacy Policy

Last updated: 29 September 2026

Nesgate protects sensitive data from being pasted or uploaded into AI tools. It is built so that we — and your organization — never need to see what you type. This policy explains what the Nesgate browser extension, the Nesgate console (app.nesgate.com) and this website process, and why.

1. The short version
2. Detection happens inside your browser. The text you type and the files you upload are checked on your device and are never sent to Nesgate.
3. When the extension is connected to a console, it sends findings: the type of data found (for example “card number”), the action taken, the AI site, and a masked preview such as 4111 •••• •••• 1111.
4. The extension only runs on AI apps (ChatGPT, Claude, Gemini, Copilot, DeepSeek, Perplexity, Grok, Mistral, Meta AI and apps your organization adds). It does not record your browsing history.
5. We do not sell data, do not use it for advertising and do not use it to train AI models.
6. The browser extension

Without signing in, the extension works fully offline on your device and sends nothing to us.

After you sign in or join an organization, the extension sends to your console:

• Your account email, or the email of your browser’s work profile when your organization deploys Nesgate.
• Browser details: browser and operating system name and version, extension version and a random installation ID.
• Findings: data type, detection rule, severity, action (masked, warned, blocked or allowed), AI site address without query string, time, and a masked preview.
• For attachments: file name, file type, size and a SHA-256 fingerprint of the original and the masked copy — never the file content.
• Daily counts of visits to AI apps on your organization’s list, so it can approve or block “shadow AI” tools.

The extension also downloads your organization’s policy (which data types to protect and how).

1. The console

For console accounts we store your email, a password hash (bcrypt — we cannot read your password), two-step verification secrets (encrypted) and passkey public keys. For security we log sign-ins and administrative actions with IP address, browser details and the approximate location (country and city) derived from the IP address. Organizations see the findings and audit log of their own members only; they are isolated from every other organization.

1. The website

This website does not use analytics cookies or trackers. Fonts are loaded from Google Fonts, which receives your IP address when the page loads.

1. Why we process data
2. To provide the service you or your organization signed up for (contract).
3. To keep accounts and the service secure, detect abuse and investigate incidents (legitimate interest and legal obligations).
4. To send account emails: verification, password reset, invitations and security notices.
5. Organizations and employees

When an organization deploys Nesgate, the organization decides which data is protected and who can see findings; it is the controller of that data and Nesgate processes it on its behalf. Employees can ask their organization — or us — which findings are linked to them.

1. Where data is stored and who helps us

Data is stored in our PostgreSQL database on DigitalOcean servers and reaches them through Cloudflare. Our email provider delivers account emails. When you pay online, our payment partner processes the payment — card numbers never reach Nesgate. These providers process data only on our instructions. Backups are encrypted with a key that is not stored on the servers, and an encrypted copy is kept in DigitalOcean Spaces in a separate location.

1. How long we keep data
2. Findings: as long as your organization’s retention setting (30 days to 5 years, or until deleted), then deleted automatically.
3. System and security logs: 180 days.
4. Your organization’s audit log: as long as the organization exists, so its tamper-evident record stays verifiable.
5. Encrypted backups: 14 days on the server, 35 days for the separate off-site copy.
6. Invoices and payment records: 10 years, as required by Indonesian tax law.
7. Records of which version of our terms and policies you accepted: as long as the account exists.
8. Account data: until the account is deleted.
9. Your rights

Under Indonesia’s Personal Data Protection Law (UU PDP) and, where applicable, the GDPR, you can ask to access, correct, export or delete your personal data, or object to processing. Write to privacy@nesgate.com. We answer within 3 × 24 hours as required by UU PDP for most requests.

1. Security

Encryption in transit (TLS 1.2+), secrets encrypted at rest, least-privilege database access, tamper-evident audit logs, two-step verification and passkeys for accounts, and no open server ports — all traffic passes through Cloudflare.

1. Changes

We will update this page and the date above when this policy changes, and notify console administrators of important changes by email.

1. Contact

Nesgate · privacy@nesgate.com

Full policy: https://nesgate.com/privacy.html