Privacy Policy — Kollavo Chrome Extension

When you click the Kollavo toolbar icon on a website, the extension reads the current tab’s domain (for example example.com), sends a check request to our backend, and shows whether AI assistants cite or recommend that brand for its category, plus competitors that appear instead. Checks currently use ChatGPT (OpenAI) with web search. Gemini / Google AI may appear in the UI but can show as unavailable when that provider is not configured.

The extension requests only:

• activeTab — To read the URL of the active tab only when you click the extension icon, so we can derive the domain to check. We do not get ongoing access to your tabs.
• storage — To store a random install ID, optional email, optional backend URL override, and a short list of recent local check summaries on your device.

The extension does not use host permissions, content scripts, the tabs permission for browsing history, or remote code. All extension logic is packaged with the extension.

3.1 Sent when you run a check

• Domain (normalized hostname only; no path, query, or full URL) — required — identify which site to check
• Install ID (random UUID generated on install; not your Google account) — required — rate limits, email gate, abuse prevention
• Optional brand / category you type — override auto-detection
• Optional email — after your first 2 fresh checks per install — continue free fresh checks; Kollavo updates about your checks and the product
• IP address — collected by the server from the request — per-IP rate limits and abuse prevention

Cached checks (results younger than about 7 days for the same domain/category) do not count toward daily fresh-check limits or the email gate.

3.2 Stored on your device (chrome.storage.local)

Install ID; optional email; optional API base URL (Settings); up to 20 recent check summaries (domain, score, timestamp, check id).

3.3 Stored on our servers

Check records (domain, install id, IP, status, score, timestamps, profile, engine statuses, prompts, snippets, citations, competitors, and server-side raw model answers); a ~7-day shared cache; rate-limit and daily budget counters; install id ↔ email when submitted.

We do not collect: full page URLs, page HTML from your browser, browsing history, passwords, payment card data, precise location, or the contents of other sites you visit without clicking the extension.

3.4 Server-side fetch of the checked domain

To detect brand and category, our backend may fetch the homepage of the domain you asked us to check, extract title/meta/H1/short text, and send a short excerpt to OpenAI for profiling. That fetch is performed by our servers, not by reading the DOM of your open tab.

Run and score AI-visibility checks; cache shared results (~7 days); enforce rate limits and a daily API budget; require email after the free fresh-check allowance; improve the product and prevent abuse; if you gave an email, send Kollavo updates related to checks and GEO/citation services; optionally power future public report or directory pages on kollavo.com that show aggregate or domain-level check results (not your install id or email).

We do not sell your personal data.

• Supabase — hosts Edge Functions and Postgres for the extension API
• OpenAI — ChatGPT web-search checks; small-model brand/category and competitor extraction
• Google (Gemini API) — optional when configured; may be unavailable
• Chrome Web Store / Google — distribution

Shared check cache about 7 days (TTL); underlying check rows may remain longer for history and future report/directory use; day-keyed rate-limit counters may be cleaned periodically; install emails until you ask us to delete them; on-device storage until you clear extension data or uninstall; operational logs aimed at no longer than 30 days where available.

Deletion requests: email hello@kollavo.com from that address (or include the email/install context you used).

The extension is not directed at children under 13.

API keys for model providers live only in server secrets, never in the extension package. Transmission uses HTTPS.

• Do not click the icon on sites you do not want checked;
• decline the email gate (fresh checks stop after the free allowance; cached results still work);
• clear extension data or uninstall;
• email hello@kollavo.com for access or deletion requests.

We may update this policy. The effective date will change on https://kollavo.com/extension/privacy.

hello@kollavo.com · https://kollavo.com
Sacha Redler, Kollavo