1. About this Policy
This Privacy Policy describes how Solidflow B.V. (operating as Ardion) handles personal data when users access the Ardion browser extension and its associated services. The extension is designed for enterprise environments where employees use it under organizational agreements. Other Ardion products may have separate privacy notices.
2. Who We Are
Solidflow B.V. (trade name: Ardion), Klompenmakersstraat 3K, 8601 WR Sneek, The Netherlands (KvK 92757103) provides the Extension Services.
3. Enterprise Use and Roles
Organizations typically determine how personal data is processed for security and compliance purposes as the controller. Ardion generally acts as a processor under a Data Processing Agreement. In limited cases, Ardion acts as an independent controller for operational needs like billing and account administration.
4. What Data the Extension Processes
A. Identity and account data
- User identifiers for sign-in (work email addresses or user principal names)
- Authentication tokens stored in browser extension storage
B. Browsing context (URLs) for policy enforcement
The Extension reads active tab URLs to determine if a page is a supported AI tool and complies with organizational policy. The Extension does not collect your browsing history. Full URLs may be temporarily retained in memory for specific user flows.
C. Text entered into supported tools
When prompt controls are enabled, the Extension processes submitted text to classify and enforce organizational policy. Content is processed for classification but not stored as content in Ardion systems.
D. Files you attach or upload in supported tools
File attachments are processed for data loss risk classification. File content is not stored in Ardion systems as content.
E. Usage, interaction, and diagnostic data
- Event metadata including timestamps, tool identifiers, and policy actions
- Extension and service diagnostics
- Standard network metadata logged for security purposes
F. Administrator configuration and policy data
Administrators configure policies and settings in the Ardion admin environment, which the Extension retrieves and applies.
5. How We Use Personal Data
Processing occurs to:
- Provide Extension Services including sign-in and policy enforcement
- Perform automated classification for data loss risk detection
- Provide audit logs and reporting dashboards to administrators
- Maintain, secure, debug, and improve services
- Comply with legal obligations
6. Legal Bases
Under GDPR and similar laws, processing is justified through:
- Contract: necessary for providing Extension Services
- Legitimate interests: securing services and preventing abuse
- Legal obligation: where required by law
- Processor instructions: when acting as a processor under the DPA
7. Chrome Web Store User Data Policy and Limited Use
Ardion's use of information received from Google Chrome APIs complies with the Chrome Web Store User Data Policy and is limited to providing and securing the Extension Services.
8. Sharing and Disclosure of Personal Data
A. With your organization
Information like audit logs and classifications is made available to authorized administrators through dashboards and reports.
B. With service providers (subprocessors)
Vetted service providers operate the Extension Services under contracts with appropriate confidentiality and security obligations. Enterprise customers receive subprocessor details in the DPA.
C. Business transactions
Personal data may transfer as part of mergers, acquisitions, or asset sales with appropriate notice and protection obligations.
D. Legal requirements and protection
Data may be disclosed to comply with legal obligations, protect rights and safety, investigate wrongdoing, or enforce agreements.
9. International Transfers
Ardion's default processing for the Extension Services takes place within the European Economic Area (EEA). Transfers outside the EEA include appropriate safeguards like standard contractual clauses.
10. Data Retention
Data is retained only as long as necessary for described purposes. Text and file content sent for automated classification are processed transiently for automated analysis and are not stored by Ardion as content. Audit and security logs may be retained longer for compliance and investigations.
11. Security
The organization uses technical and organizational measures including encryption in transit, access controls, logging and monitoring, and secure development practices.
12. Your Rights and Choices
Users should direct privacy requests to their organization as the controller. Users can disable or uninstall the Extension from their browser. Certain information may be retained where legally required or necessary for legal claims.
13. No Sale; No Advertising Use; No Model Training
Ardion does not sell personal data. We do not use Extension data for targeted advertising. Personal data is not used to train AI models.
14. Relationship to Customer Agreements
For enterprise customers, the Data Processing Agreement, Service Level Agreement, End User License Agreement, and signed Terms govern the Extension Services. Signed agreements take precedence over this policy in case of conflicts.
15. Contact
Solidflow B.V. (trade name: Ardion), Klompenmakersstraat 3K, 8601 WR Sneek, The Netherlands, KvK 92757103. Support: info@ardion.io. Privacy: privacy@ardion.io.
16. Changes to this Policy
The policy may be updated periodically. Material changes receive notice through the Extension, website, or other appropriate means.
