Full policy (always current): https://admin.cenaly.com/digital-worker/privacy.html

Cenaly Digital Worker

Privacy Policy for the Chrome extension · Version 8 · Last updated: 2026-10-07

The extension does the web work you assigned in systems you are already signed in to and brings the result back into your own Cenaly account — in a visible tab, under your control. In worker mode only the results of your skill's steps are sent (never passwords read from pages, hidden fields, cookies or whole pages; account passwords you choose to save for sign-in leave only encrypted so that only your device can open them); it can also record a routine you demonstrate yourself — including your spoken explanations, if you ask for it — only while the recording indicator is lit. In the collection modes you start yourself, it sends the pages you chose for your knowledge base, review pages about your business, and the storefront of your own shop when you move it to Cenaly.

Single purpose

The extension has one purpose: to be the browser helper of your Cenaly account — it performs and collects what you, the account owner, assigned to it in your account, inside web systems you are already logged into, on your own device and under your control, and returns the result into that same account. Its modes are functions of that one purpose, not separate products:

• Worker — routine operations defined as declarative “skills”; teaching a routine by demonstrating it yourself is how a skill gets authored;
• Knowledge base & reviews — transferring pages you chose into your knowledge base, and reading review pages about your business for review monitoring;
• Move a shop — reading the storefront of your own shop to import it into Cenaly.

There is no other functionality — no browsing analytics, no background collection without a task you set, no code execution received from a server.

Who does what

• You choose the target system, install a skill, set its parameters, start the run and confirm anything irreversible. You are the account holder in the target system and the party to its terms of service.
• Cenaly provides the tool and processes the data on your instruction. We do not choose target systems, do not start runs on our own initiative, and never hold the credentials of your target systems in readable form: if you save an account password for sign-in (“Account passwords” below), we store only an encrypted record we have no key to open.
• Where the pages contain personal data of other people (guests, clients, candidates), you are the controller of that data and Cenaly is the processor acting on your instruction.

How the extension works

1. Pairing. You paste a single-use connection string from your Cenaly admin panel. The extension receives a worker token and stores it in chrome.storage.local of this browser. The token is not linked to your identity in any target system.
2. One step at a time. The extension receives one step of a declarative skill from the Cenaly backend and executes it with a fixed, bundled interpreter.
3. Result back. It returns the values the skill asked to read, plus an outcome code if the step failed.
4. Records a training session, when you ask it to. You perform a routine yourself and the worker records what you did — and, if you tick the box, what you said about it. See “Training by demonstration” below.
5. Collects for your account, when you start it. Knowledge-base pages, review pages and the storefront of the shop you move. See “Collection for your account” below.

What leaves your browser

Sent to your Cenaly account Example

The values explicitly listed in the skill's read / extractList steps “order number”, “confirmation text”
Technical fields of the run: run id, step number, lease (fence) number, outcome code wait_timeout, identity_mismatch
The page host (not the full URL) for the audit log cabinet.example.com
Version 0.6.0 does not capture or send screenshots; a screenshot step requests human help screenshot_unavailable
Worker status (idle / working / need-you / paused, a pause may say “panel closed”) and last-seen time heartbeat
Extension version and skill-interpreter version — so that a skill this version cannot run is not handed to it 0.6.0, 1.1.0
Device and network information for the device registry: device name, environment, installation ID, public device key, browser session ID, coarse network, signed-in marks — see “Device and network information” below “Reception laptop · K7Q2”, Chrome 129 · Windows 11, subnet 203.0.113.0/24
Only when you press “Report a problem”: the last 20 lines of the panel log (step numbers, error codes, run id — no field values), posted to the worker's channel in your team chat “Step #2 failed: element_not_found”
In training mode: the actions you perform, with the candidate selectors of the element and the shape of the field values click on “Confirm”; text input of length 12
In training mode with voice: ~20-second audio chunks of your spoken explanations — for transcription only, deleted once transcribed “if the status is pending, I confirm it”
Knowledge base & reviews mode, during a session you started: the rendered markup of each page of the session, its title, links, image addresses and image files, and the page's path (breadcrumbs) a policy page from your supplier portal
Same mode, for a review-monitoring task you set up: the rendered markup of a review page about your business your venue's page on a maps service
Only if you turn on “Account passwords”: the encrypted record with the account login and password — only this device's key can open it (in the Russian contour the record does not leave the device at all); salted hashes of the allowed site addresses; signatures; a grant request for each sign-in and a report of the entry — without any values “record cred_… · generation 1 · filled”
Move a shop mode, after you press Start: the pages of your own storefront (markup, layout measurements, newsletter pop-ups, product cards and their platform product JSON, text pages and legal documents) home page, products, “Refund policy”

All of the above goes to your own Cenaly account — a private storage bucket of your brand, not a shared pool and not a third party.

What never leaves your browser

• Passwords. input[type=password] and fields with autocomplete=current-password/new-password are neither read nor filled: read steps return null for them and a fill attempt returns protected_field.
• Hidden fields (input[type=hidden], including CSRF tokens) — likewise null.
• Cookies, localStorage, sessionStorage, request headers. The interpreter does not read them and has no code capable of reading them.
• Whole page HTML — in worker mode. Skill steps send only the values addressed by the skill's selectors — never the markup. Whole pages are sent only by the collection modes you start yourself, and only the pages of their task.
• Readable logins and passwords of your accounts. By default the worker runs on top of the session you already opened and knows no credentials. If you turn on “Account passwords” (below), only an encrypted record leaves the browser; the key that opens it cannot be exported from this device, and the plain password reaches only the site you allowed, at the moment of sign-in.
• One-time codes, two-factor seeds and recovery codes. The worker neither stores nor types them: you always enter the second factor yourself.
• Device keys. The signing key (device registry) and the password decryption key are created non-exportable; only their public halves are sent.
• Your other tabs. The worker touches exactly one work tab, which it opens itself, and only on the hosts declared by the active skill.
• Files. Downloading and uploading files are absent from the step set.
• Browsing history, bookmarks, clipboard. Not requested; the corresponding permissions are not in the manifest.

These are not declarations: the dangerous primitives are absent from the interpreter by construction, and a guard test scans its source and fails if any of them appear.

Account passwords (0.9.0–0.10.0)

This feature is switched off and is currently enabled only on test accounts. It will be opened to customers after a legal review of its texts; until then this section describes how it works.

Why. So that the worker can sign in to an account itself when the session has expired, without calling you to type the password. Without the feature the worker stops at that point and asks you to sign in yourself (your own password manager is fine), then continues.

• You type the login, password, record name and site address in the extension window on this device, not in the admin panel: the admin panel never sees the values. The exact site address (https://…, no wildcards), the skill and the sign-in flow are chosen there too.
• The extension encrypts the record to a non-exportable key of this device and signs the usage rules with your owner key. Only the encrypted record goes to the cloud. Neither the cloud, nor our support, nor AI can open it — we do not have the key. In the Russian contour the encrypted record stays on the device only; the cloud only issues permissions and keeps the log.
• The password is typed into the site form by a separate operation and only when all of this holds at once: the site is exactly the one you allowed; the run is live and pinned to this device; you confirmed the sign-in in the extension window; the cloud issued a single-use, 15-second permission and logged it before issuing it.
• While the tab shows the page where a password was typed, the extension collects nothing from it: no read steps, no self-healing hints, no training recording, no problem report, no collection modes. The extension takes no screenshots at all.
• Every use is shown to you in the Passwords tab of the Digital Worker section. The usage log (time, record, device, run, outcome — no values and no addresses) is kept for 180 days.

What we cannot promise. The site you allowed does receive the password — that is what signing in means — and its own scripts can see it. An infected device or its administrator can intercept the password at the moment of entry. Revoking a record stops new sign-ins but does not end sessions already open on the site and does not invalidate a password already copied — change the password on the site itself. We cannot recover the password or access to the record: if the device is lost or the extension removed, the password is entered again or reset on the site.

Deletion. A deleted or revoked record stops being issued immediately. Its encrypted copies in the cloud are deleted within 24 hours; there are no backups of encrypted records. The copy on the device stays encrypted to its key and cannot be used without the cloud's permission; it is erased together with the extension (automatic erasure on the cloud's command comes in the next extension version). A report of your records — without the passwords themselves — is available on request to privacy@cenaly.com.

Who and where. Only the account owner (staff with manager or admin roles get no rights to passwords), only when all locations of the account are in countries where the feature is open, and not for government bodies or critical infrastructure.

Device and network information (device registry)

Since 0.8.0 each connected browser profile is a device in your Cenaly account: you see the list in the Digital Worker section (Devices tab), name devices, find them, pause, move or revoke them. So that you can tell two identical laptops apart and so that a copied connection can be spotted, the extension reports the following when you connect it and while it works:

What Why How long

The device name you type when connecting (suggested: “Chrome · Windows 11”) and a 4-character device code derived from the device ID to recognise the device in the list and on its own screen while the device is in your account
Environment: operating system and version, browser brand and version (from navigator.userAgentData, including the User-Agent string), CPU architecture, device model if the browser reports it, time zone, language, screen size, extension and interpreter versions, capabilities, and where the extension was installed from (Chrome Web Store, an archive loaded unpacked, your organisation’s policy, or the Cenaly bridge — reported by the browser itself, no extra permission) a label that tells devices apart; “please update” hints, and a hint to move a copy that does not update itself to the Web Store version. It is never used to authorise anything latest value, while the device is in your account
A random installation ID (stored in the extension’s local storage) and a device key: a non-extractable ECDSA P-256 key pair created in the browser; only the public key is sent, and every request of the extension is signed with the private key a reconnect of the same installation stays the same device (no duplicates); a leaked token is useless without the key while the device is in your account; the private key never leaves the browser and is removed with the extension
A random browser session ID (changes when the browser restarts) if one connection is proven to run in two places at once (a copied browser profile or token), the connection is revoked as a copy and you are asked to connect the device again the last few session IDs
Coarse network: subnet (/24 for IPv4, /48 for IPv6), country and city. Country is derived from the request IP using a built-in offline database (IP geolocation by DB-IP, CC BY 4.0) — no external lookup; city only when our CDN provides it. The full IP address is cut to the subnet in memory and is never stored, including in logs “where is the device now”; an anomaly such as a token suddenly used from another country current value plus history of network changes for 30 days (at most 20 entries)
Signed-in marks per site of your installed skills: “signed in / not signed in / unknown”, judged by the skill’s own sign-in checks. Reported from version 0.11.0 as a by-product of the worker’s own steps on the skill’s site (reached a sign-in form — “not signed in”, a step passed — “signed in”, not checked for a while — “unknown”); no cookies are read and no extra visits are made send a task to a device that is signed in to the site latest value

We do not collect the browser profile’s e-mail address (the extension has no identity permission), canvas / WebGL / audio fingerprints, IMEI, serial numbers or MAC addresses. Cookies are not read for the signed-in marks. These data stay in your account’s private bucket and are visible to you in the Devices tab; a revoked device stays in the list (you can hide it) until the account is deleted, or earlier on request to privacy@cenaly.com. This disclosure is shown as an addendum to your consent in the window where you connect a device.

Browsers: Firefox and Safari (0.14.0)

The extension is also built for Firefox (and prepared for Safari). The data and the purpose are the same; the differences:

• Firefox built-in data consent. On installation Firefox shows what the add-on transmits: website content, your actions on websites in training mode, the hosts of pages it works on and encrypted password records — all of it only on your actions and only to your own Cenaly account (see above). Device details (browser, OS, install source, time zone, language, screen) are a separate optional consent in Firefox: until you give it (the “Share device details” button in the popup or the add-on settings in Firefox), the extension does not send them, and the device is listed only under the name you gave it.
• Install source in Firefox: “store” is a signed Firefox Add-ons package, “temporary” is an installation via about:debugging that lasts until the browser restarts.
• Safari: the worker does not type account passwords (Safari cannot close the session storage to page scripts the way Chrome and Firefox do) — you sign in yourself.
• There is no Cenaly bridge update channel in Firefox and Safari: updates come from the browser’s store.

AI processing: the “decide” step

Some skills contain a decision step — for example, “which of the rows found is the request we need”. That step is executed by the cloud, not by the browser:

• only a structured extract limited to the variable names declared in the step itself is sent to the model, with a size cap — never raw HTML and never “the whole run context”;
• the request goes through our model-access provider (the polza.ai aggregator; default model openai/gpt-4o-mini), acting on our instruction;
• the request and the answer are stored, truncated, in the AI interaction log of your account, which we keep for cost accounting and incident review;
• on the Russian contour (cenaly.ru) the decision step is disabled, because the aggregator's catalogue currently offers no model with confirmed Russian data-residency compliance. Skills that need it are unavailable there.

Collected data is not used to train our models and is not sold.

Training by demonstration (recording your actions and voice)

A separate feature of the “Digital worker” section: you perform the routine with your own hands while the worker does nothing on the page — it only watches and listens, so that a draft skill can be assembled from the recording afterwards. It is gated by a separate consent accepted in your Cenaly account: allowing the worker to act is not the same as allowing it to record you.

• Only while REC is lit. Recording starts with a button in the panel and stops with a button, by closing the panel, or on a silence timeout. The indicator is visible the whole time. The microphone is opened when the recording starts and closed when it stops — there is no background listening, no wake word and no automatic restart anywhere in the code.
• What is recorded from actions: the action itself (click, input, selection, form submit, navigation, tab switch, copy/paste), the candidate selectors of the element, a short description of it (tag, role, name, visible text up to 80 characters), and the host and page URL without the query string. A field's value is not recorded by default — only its “shape” (type and length) travels. Recording actual values requires an explicit per-session toggle, shown with a warning.
• What is never recorded: passwords, hidden fields, payment fields (autocomplete=cc-*), and the values of any field without that toggle. There is no keystroke logging at all — only the field's final value after it loses focus. This is a property of how the recorder is built, and a guard test scans its source on every build.
• The voice of your explanations is captured only while the recording runs and only if you ticked “Spoken explanations”. It is sent to our backend for transcription only, in ~20-second chunks, into the private bucket of your own account, and is deleted once transcription succeeds — the timestamped text remains. It is never used to identify anyone by voice, not sold, and not handed to third parties for their own purposes. Declining microphone access is a supported outcome: training simply continues without sound.
• Where it lives and how it disappears. Events, audio chunks and the transcript are stored in your account and visible only to you. Deleting a session in the admin panel deletes its events, audio and transcript with it; deleting the account removes everything at once.

The microphone is not an extension permission. It is not in the manifest: the panel page asks for it with an ordinary getUserMedia call, so the browser shows its own prompt and its own recording indicator, and access can be revoked in the site settings — exactly like for any web page.

Risk classes and consent

Every skill carries a risk class, and the class is a set of enforced technical limits rather than a label:

Class What it means Mode

green our own surfaces, or platforms where automation is allowed scheduling allowed; at least 0.4 s between actions
amber the platform's rules neither allow nor forbid automation explicitly separate consent; at least 1.5 s between actions; confirmation before anything irreversible
red the platform explicitly forbids automation separate consent that names the risk of your account being blocked; attended runs only; no background scheduling; at least 3 s between actions

We say this plainly. If a platform's terms forbid automated access, using a worker there breaches your agreement with that platform, and the platform may block your account. We cannot dispute or reverse that. This is why such skills require a separate, explicit consent, run only while you are present, and are never put on a schedule.

Consents are accepted in your Cenaly account and recorded with their version, timestamp and user agent. They can be withdrawn by revoking the paired browser.

Permissions and why they are needed

Permission Why

storage Store the worker pairing token, skill cache, checkpoint, result awaiting acknowledgement, next step and panel settings; separately, the knowledge-base pairing token and the address of the last shop-migration connection.
tabs Create and navigate the dedicated work tab (worker) or capture window (collection modes) and detect when a page has finished loading.
scripting Inject bundled files into that tab: the worker's interpreter and adapter, or the page-capture scripts of a collection mode. Files-based injection only — never code strings, never remote code.
sidePanel Show the worker panel as a browser side panel.
alarms Drive the polling loop. MV3 service workers are short-lived and we deliberately do not hold a permanent keep-alive.
notifications One OS notification when the worker is blocked and needs you (CAPTCHA, logged out, a host permission to grant, a confirmation question). No business data in it — only the reason and an “Open panel” button; repeated at most once every five minutes. Can be switched off in the panel.
host access Not granted at install time. Requested at runtime, per origin, only for the hosts declared by the skill you installed (in training mode, for the site you are demonstrating on; in collection modes, for the site of the session, a review platform, an image host or the shop being moved), and only after you click the grant button.
microphone Not a manifest permission at all. The panel page requests it with getUserMedia, and only when you tick “Spoken explanations” before a training recording.

What the extension will never do

• Bypass captcha or anti-bot protection. A captcha or a dropped session is detected and the worker stops and asks you — it never attempts a bypass.
• Pass MFA on your behalf, or store two-factor seeds and recovery codes. It stores account logins and passwords only if you turned on “Account passwords”, and only encrypted so that your device alone can open them.
• Disguise itself — no fingerprint spoofing, no IP rotation, no headless farms, no server-side runs without you.
• Execute code sent from a server. A skill is data (a JSON spec, pinned by sha256); the interpreter is fixed and shipped with the extension.
• Work behind your back. Close the panel and the worker leaves its shift; the run is paused.
• Record you silently. Action and voice recording happen only in training mode, only after an explicit start, and only while the indicator is lit; closing the panel stops the recording and releases the microphone.
• Sell your data, share it with data brokers, use it for advertising or for creditworthiness and lending decisions.

Chrome Web Store Limited Use disclosure

The extension's use of information received from users complies with the Chrome Web Store Limited Use policy. Data the extension accesses is used solely to provide the stated feature — performing the task the user defined, recording the routine the user demonstrates, or collecting the pages the user chose for their knowledge base, review monitoring or shop migration, and reporting the result back into the user's own Cenaly account. The data is transferred only to the user's own Cenaly account and, strictly to deliver the decision step of a skill, the transcription of a training recording and the knowledge-base search and answers, to the model-access, speech-to-text and AI providers named on this page, acting on our instruction. We do not use or transfer it for advertising, creditworthiness, or any purpose unrelated to the feature, and do not use it to train our own artificial intelligence models.

Payment fields (cc-*), one-time codes and hidden ancestors are protected by the same filter during extraction, filling, recording and co-drive. Hidden descendants are excluded from extracted text.

Collection after sign-in (0.6.0)

Your skill can collect bounded lists, move through pages and open detail cards in one work tab. Permitted fields are sent with collection time, skill version and completeness metadata: rows found and returned, truncation and the reason collection stopped. Source page URLs omit query strings and fragments; card links are restricted to the skill's hosts and safe query parameters. Conversion errors contain field names and reason codes.

Session expiry or MFA requires your manual sign-in, followed by another account check. A shared action budget may pause collection for your decision. No new permissions for cookies, file downloads or interception of third-party request headers are introduced.

Collection for your account: knowledge base, reviews, shop migration (0.7.0)

These modes used to live in a separate knowledge-base collector extension; since 0.7.0 they are part of Cenaly Digital Worker. They have their own pairing, their own pages and their own rules; they do not share the worker's loop, and worker skills cannot invoke them.

• Knowledge-base pairing — a separate connection string from Knowledge base → Sources; its token is stored in its own namespace, and each pairing has its own “Disconnect”.
• Knowledge base. Works only during a collection session you started in the admin panel (after accepting its separate terms) and only on that session's site; pages open in a separate visible window, with progress, a log, Pause and Stop in the panel. It sends the rendered markup of each page (the page as you see it, including what it displays), its links, images and path, and — if you turned on “load files” when starting — the document files (PDF, Word, Excel, CSV, TXT) that the session's pages link to; each becomes a document in your base. Cookies, passwords, history and other tabs are not read. Before sending, secrets in the markup are blanked: values of password, one-time-code and payment fields, hidden fields named like a token/CSRF/session, and CSRF <meta> tags.
• Reviews. While this mode's panel is open, it picks up the review-monitoring tasks you configured in Reviews: it opens a review page about your business and returns its markup. A site without a granted permission is not read — the task is closed with an error and the panel shows a grant button.
• Move a shop. A separate single-use connection string from the Migrate section; after you press Start, the extension walks the storefront of your shop (home page, products, collections, text pages, legal documents) and hands the pages to the import. This mode's token is not stored in the browser. Newsletter pop-ups of the storefront are captured before they are dismissed, so that the import can recreate them for you.
• AI processing inside Cenaly. Knowledge-base pages and your questions about them are processed by AI — that is how search, answers and summaries work: on our international infrastructure (cenaly.com, meni.ge, masamenu.tr, menugo.al; AWS us-east-1, United States) by OpenAI and, for the guest AI menu assistant, Google; on our Russian infrastructure (cenaly.ru; Yandex Cloud ru-central1) by Yandex Cloud. We do not train our own models on this content and do not sell it; with these providers we rely on their standard API terms, under which API data is not used to train their models by default.
• Deletion. Knowledge-base documents are deleted in the admin panel, where you can also revoke a connected browser. What survives a document's deletion (AI interaction log, answer cache, training materials) is described in the Knowledge base terms.

Storage and deletion

• In the browser: the pairing token, cached skill specs, the checkpoint of the last step, status and panel settings. Step results (including permitted extracted values) stay locally until acknowledged, then are replaced with the next step. Each pairing has its own namespace. “Disconnect” removes the local token and stops the old panel; it does not revoke the server token. Old caches and unfinished results remain isolated locally for investigation and are never sent through a new pairing. Legacy data without pairing ownership are not used. Uninstall the extension to erase all its local data.
• Work-tab/window IDs and per-domain pacing counters are also stored locally in the pairing namespace. They contain no passwords or cookies.
• Page and card results, queues and partial results are stored in the Run. Incremental collection also keeps a cloud dataset by stable key and content hash; subsequent runs update records. This dataset and cloud pacing counters are not automatically removed when a single run is deleted and currently have no automatic expiry. Request complete erasure at privacy@cenaly.com.
• In the cloud: the run, its variables and the audit log live in the private bucket of your account. You can revoke a specific device from the admin panel (Digital Worker → Devices), after which its token stops working immediately.
• Device registry: device and network information as described in “Device and network information”: network history for 30 days, the full IP address never.
• The audit log records what the worker did (host, action, outcome) and contains no field values and no message texts.
• Account passwords: the encrypted record lives in the storage of the “Account passwords” feature (in the Russian contour — on your device only), the usage log for 180 days; a deleted record is removed within 24 hours, with no backups of encrypted records. We cannot recover a password.
• Training recordings (events, audio, transcript) live in the same private bucket of your account and are deleted together with the session or with the account. The audio also deletes itself as soon as transcription succeeds.
• Deleting a run does not purge the AI interaction log described above; it has its own retention. Full erasure is available on request to privacy@cenaly.com. Content already sent to a model provider while serving your request cannot be recalled.

Whom we share data with

These recipients only, and only to make the feature work: your own Cenaly account (including its knowledge base, review monitoring and shop import); the model-access provider for the decision step and for turning a training recording into a draft skill, in the volume of a structured extract; the speech-to-text service of our cloud provider (Amazon Transcribe, inside the same AWS account that already stores your data) for the voice explanations of a training session; and the knowledge-base AI providers (OpenAI and Google internationally, Yandex Cloud in Russia) for the text of knowledge-base pages and your questions about them. All act on our instruction. No one else; nothing is sold. Account passwords are given to no one except the site you allowed, at the moment of sign-in.

Changes

We may update this policy. Material changes to what the consent covers increment the consent version in the product, and you will be asked to accept the terms again in your Cenaly account. Disclosures that concern only connecting a device (such as the device and network information above) are shown as an addendum in the window where you connect a device. “Account passwords” has its own separate consent, accepted in your Cenaly account before the first record is saved.

Contact

Privacy questions: privacy@cenaly.com.

Cenaly · cenaly.com · This page is served at https://admin.cenaly.com/digital-worker/privacy.html and is referenced by the extension's Chrome Web Store listing.