Acuna Extension Privacy Policy

Effective 1 September 2026. Applies to the Acuna browser extension for Google Chrome and Microsoft Edge, version 0.12.0.

This notice covers the browser extension. The Acuna platform privacy policy covers the web application and this site, and applies to anything not addressed here.

This notice explains what the Acuna browser extension does with data on your device and what it sends to Acuna servers. It complements the Acuna web application privacy policy at https://acunagrc.com/en/privacy rather than replacing it. For matters not covered here, the main Acuna policy applies.

If you have questions about this notice, or want to exercise any of the rights described below, contact privacy@abilene.ch.

1. Who we are

The data controller is Abilene Group SA, a company incorporated in Switzerland, operating the Acuna GRC platform. Our Data Protection Officer can be reached at privacy@abilene.ch.

The extension is published by Abilene Group SA on the Chrome Web Store and the Microsoft Edge Add-ons store.

2. What the extension does

The extension shows you the compliance items that are waiting on you in Acuna, meaning tasks, controls, approvals, reviews and deadlines, in a small popup next to your browser's address bar, and lets you act on them without opening the web application: record that a task or control is done, optionally attach a file as evidence, approve or reject an item, or confirm a review. It also shows a count on its icon and a desktop notification when something new is assigned to you.

It does this by talking to your Acuna account. The web pages you visit stay outside its reach.

3. What the extension reads from your browser

The extension reads the following, and only when you explicitly trigger it:

When	What it reads
You paste into the evidence area of a completion form (Ctrl+V or Cmd+V)	The image on your clipboard at that moment, if there is one. Text and anything else on the clipboard is ignored. The extension reads your clipboard at no other time.
You choose a file in the evidence area	The file you selected.
You sign in with Microsoft	A short-lived sign-in window opens so Microsoft can confirm your identity. The extension receives only the resulting Acuna session, and never your Microsoft password.
You click an item, a notification, or an "Open in Acuna" link	The extension opens a new tab at the corresponding page of the Acuna web application.

The extension takes no screenshots, and reads neither the content of any web page nor the address or title of any tab. Your browsing history, cookies, form data and keystrokes all stay outside its reach. A small helper script is loaded on pages of the Acuna web application itself and nowhere else; it currently does nothing beyond announcing that it loaded.

4. What the extension sends to Acuna servers

All communication goes to two places only: the Acuna web application (app.acuna.ai) and Acuna's authentication and storage provider, named in section 7. The extension is technically prevented by its own security policy from contacting any other domain.

When you sign in: your email address and password, or the result of the Microsoft sign-in, plus the one-time code from your authenticator app if your organisation requires one. These go to Acuna's authentication service, which returns a session for your account.

Every five minutes, and whenever you open the popup: your session credentials, so the Acuna web application can return the list of items assigned to you in each of your workspaces. This request carries nothing from your browser.

When you record a completion: the completion date, the notes you typed, and, for controls measured against a target, the value you entered. If you attached evidence, the file itself together with its filename, type and size. A pasted screenshot is stamped in its bottom-right corner with the date and time (UTC) and your Acuna email address before it is sent, so that it can later be traced to the person who captured it. An uploaded file is sent unchanged. Evidence files are limited to 10 MB and to document, image, spreadsheet, presentation and plain-text formats.

When you approve, reject or confirm a review: your decision and the optional comment you typed.

With every request: your browser's User-Agent string, which browsers send automatically as part of every HTTPS request.

Everything sent is associated with your authenticated Acuna account and stored in the workspace it belongs to, exactly as if you had done the same action in the web application.

5. What the extension stores locally in your browser

The extension uses your browser's extension storage (chrome.storage.local) to keep:

Your Acuna session (access and refresh tokens), so you stay signed in between popup opens and across browser restarts. Cleared when you sign out and when you uninstall the extension.
Your view preferences: the workspace you last selected, if you belong to more than one, and the time window you last chose for the list.
Notification bookkeeping: an identifier for each item the extension has already notified you about, so you are told about the same item only once; the time of the last check; and, for each notification shown, the Acuna page it should open when clicked.
A short-lived technical flag noting that in-popup approval was temporarily unavailable, so the extension offers a link to the web application instead for the next few minutes.

This data stays on your device, with one exception: the session, which is presented to Acuna servers to identify you as described in section 4. The extension uses no other storage on your device.

6. What we do not collect

We want to be explicit about the boundaries of what the extension does:

It takes no screenshots and reads no web page.
Tab addresses, tab titles and browsing history are never read.
Keystrokes and form data stay in the page you typed them into.
Your clipboard is read only for the paste you perform yourself in the evidence area.
It carries no analytics, tracking pixels, or telemetry about how you use it.
Your device is never fingerprinted.
No data from this extension reaches advertising networks or analytics platforms.

7. Third-party processors

Your data is processed by:

Supabase Inc., acting as our infrastructure provider for authentication, database and file storage. Supabase hosts Acuna data on AWS infrastructure in the eu-central-1 region (Frankfurt, Germany). Supabase has signed a Data Processing Agreement with Abilene Group SA covering GDPR Article 28 obligations.
Microsoft, only if you choose to sign in with your Microsoft work account. The sign-in itself is handled by Microsoft Entra ID under your organisation's agreement with Microsoft; Acuna receives a confirmation of your identity and your email address.

The processors of the Acuna web application, which the extension calls, are listed in the main Acuna privacy policy. These are the only recipients of your data from this extension. The extension carries no analytics, advertising, or tracking SDKs.

8. Retention

Completions, decisions and evidence are retained according to the retention policy of your Acuna workspace, which your organisation's Acuna administrator sets. The default for compliance use cases is seven years, to satisfy ISO 27001, NIS2, and DORA audit-trail requirements.
Your session stored locally is kept until you sign out or uninstall the extension, whichever comes first.
View preferences and notification bookkeeping are kept until you uninstall the extension. They stay on your device throughout.

9. Your rights

Under the Swiss Federal Act on Data Protection (nFADP) and, where applicable, the EU General Data Protection Regulation (GDPR), you have the right to:

Access the personal data we hold about you
Rectify inaccurate data
Erase your data, the right to be forgotten
Restrict or object to the processing of your data
Portability, receiving your data in a machine-readable format
Withdraw consent at any time, which leaves the lawfulness of past processing intact

You can exercise these rights either:

Directly in the Acuna web application at https://app.acuna.ai (Settings, then Data export or Account deletion), or
By emailing privacy@abilene.ch. We respond within 30 days.

If you believe your rights have not been respected, you may lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, in the EU, with your national supervisory authority.

10. Why each browser permission is requested

The Web Store requires us to declare every permission. The extension requests four, plus access to two domains. Below is the exact justification for each, in plain language:

Permission	Why we need it
storage	Remember your signed-in session and your view preferences across popup opens and browser restarts, as described in section 5.
alarms	Schedule the check for new items every five minutes, and keep your session refreshed while the browser is open. Without it the extension could only work while the popup is open.
notifications	Show you a desktop notification when a new item is assigned to you. You can turn these off in your browser's or operating system's notification settings.
identity	Open the secure Microsoft sign-in window and receive the result. Used only when you choose to sign in with Microsoft.
Access to *.supabase.co	Sign you in, refresh your session, and store evidence files.
Access to app.acuna.ai	Fetch your items, record completions and decisions, and open the right page when you click a link. Your browser may describe this as the ability to "read and change your data on app.acuna.ai". That is the standard wording for any extension allowed to talk to a site, and the extension uses it only for the requests described in section 4.

The extension requests no permission to read tabs, take screenshots, run code on web pages, or access any site other than the two above.

11. Children

The Acuna extension is a business productivity tool for compliance professionals. It is not directed to children under sixteen, and we do not knowingly collect personal data from anyone under sixteen.

12. Changes to this policy

We may update this notice when the extension's permissions, data flows, or processors change. The version number at the top of this page is the version of the extension this notice describes. Material changes are communicated to existing users through the extension's release notes and through the Acuna web application.

13. Contact

Privacy questions and rights requests: privacy@abilene.ch
Postal address: Abilene Group SA, Switzerland. The full address is available on request.
Acuna web application support: help@acunagrc.com

This notice is published at https://acunagrc.com/en/extension-privacy, and mirrored at https://abileneadvisors.ch/privacy/acuna-extension.

Effective 2026-09-01