Privacy Policy — AI Act Register Pilot

Last updated: 2026-07-10

AI Act Register Pilot helps organizations inventory the AI systems they use and build an EU AI Act register. It is built so that your data never leaves your browser — that is the product's core design, not a marketing line.

Who we are

The extension is published by Leandro Sierra. For any question relating to this policy, contact contact@leandro-sierra.com.

What the extension processes locally

• Detected AI systems — when a tab finishes loading, the extension compares the tab's domain name (hostname) in memory against its built-in catalog of known AI tools and services. If the domain matches a known AI system, only the system's identifier and dated counters are stored locally. Full URLs are never stored. Page content is never read (the extension contains no content script). Domains that are not known AI systems leave no trace.
• Your AI register — organizations, AI system records, risk classification (unacceptable / high / limited / minimal), transparency obligations and settings are stored locally using the browser's chrome.storage.local API.
• Exports (CSV, JSON, printable register, transparency notices) are generated locally in your browser and saved to your device. Imports (JSON restore) read a file you pick from your device, entirely in the browser.
• Review reminders (paid plans) — a local system notification when an AI system review date is overdue, computed from your local register. It is never triggered by the network and contains nothing beyond the record's name.

None of the above is transmitted anywhere. No personal data is collected: the register is an inventory of AI systems and their risk classification, not a record of individuals.

The only network call: license check

• License key — an opaque, randomly generated identifier (UUID) created on your device. It is sent to our licensing backend (https://aiactpilot.leandro-sierra.com) only to check whether a Solo or Agency subscription is active. It is not linked to your identity by the extension and contains no personal data.

We do not collect: your name, email, address, browsing history, page content, or any personally identifiable information.

What we do NOT do

• We do not sell or rent any data — there is nothing to sell.
• We do not use advertising or analytics trackers inside the extension.
• We do not read or inject anything into web pages (no content scripts, and host_permissions is empty).

Permissions we request

• storage — stores your AI register, detection counters and settings locally in the browser.
• tabs — used only to read the domain (hostname) of tabs so that known AI systems can be recognized against the built-in catalog. Full URLs are never stored and page content is never accessed.
• alarms — periodic refresh of the subscription verdict and daily check of AI system review due dates (the Manifest V3 service worker is event-driven).
• notifications — local reminder shown when an AI system review is overdue. It is computed entirely from your local register.

The website (aiactpilot.leandro-sierra.com)

The website is separate from the extension. It collects personal data only when you choose to give it:

• Waiting list — if you ask to be notified when the extension is published on the Chrome Web Store, we store your email address, optionally your name and organization size. Legal basis: your consent. Used solely to send that one announcement. Unsubscribe at any time by writing to us.
• Free register template — if you request the AI system register template, we store your email address (and optional name) and email you the download links. Legal basis: your consent.
• Billing email — when you subscribe, Stripe passes us the billing email so we can deliver and, on request, resend your licence key. Legal basis: performance of the contract.
• Audience measurement — a self-hosted GoatCounter instance counts page views without cookies and without any personal identifier. It runs on the website only, never in the extension.

These records are stored in a PostgreSQL database hosted in Germany (European Union). They are never sold, rented or shared with advertisers. Waiting-list and template entries are deleted on request, and at the latest twenty-four months after collection.

Payments

Solo and Agency subscriptions are processed by Stripe. Payment details are entered on Stripe's hosted checkout and handled entirely by Stripe — the extension never sees or stores them. See Stripe's privacy policy for how they process payment data.

A 14-day Solo trial requires no card and no personal data: it is attached to the opaque licence key of your installation.

Data location & retention

• Local data (chrome.storage.local) lives on your device. You can clear detection history from the settings page at any time; uninstalling the extension removes everything.
• The licensing backend stores only the license key, its subscription status (Stripe customer/subscription identifiers), the billing email and the trial start date, hosted in the EU (Germany).
• Website leads (waiting list, template requests) are stored in the same EU database and removed on request.

Your choices & rights

• Clear detection history: Settings → Local data → "Clear detection history".
• Delete everything: uninstall the extension.
• Cancel a subscription: use the Stripe-hosted portal from your checkout confirmation email, or contact us.
• Because we hold no personal data beyond an anonymous license key, requests to access, rectify or erase can be honored by cancelling and clearing local data — write to us if you need help.

Contact

Questions about privacy: contact@leandro-sierra.com