CircleScope Privacy Policy

Endpoint Compliance Agent browser extension and Microsoft 365 connection — effective August 19, 2026

What CircleScope is

CircleScope is a service of Circle Twice, LLC. The CircleScope Endpoint Compliance Agent is enterprise software installed on company-managed devices by an organization's IT provider, using managed browser policy. It is not a consumer product and is not intended for personal devices. If it is installed on your browser, your organization chose to deploy it, and your use of that device is governed by your organization's acceptable-use policy.

What the extension collects

On a specific list of AI services (ChatGPT, Claude, Microsoft Copilot, Google Gemini, Perplexity), the extension records:

• Prompt text submitted to those services, and metadata about file uploads (name, size, type)
• The site, timestamp, and a conversation reference
• The device name and the signed-in workplace username (UPN), as configured by the IT provider

Before anything leaves the device, the extension redacts sensitive patterns — Social Security numbers, payment card numbers, and API keys are replaced with redaction tokens on the endpoint and are never transmitted or stored.

What it does not collect

• No browsing history — the extension runs only on the AI sites listed above and has no access to other tabs or sites
• No keystrokes outside prompt submissions on those sites
• No passwords, cookies, screenshots, microphone, camera, or location data

Microsoft 365 connection

Separately from the extension, an organization’s IT provider may connect its Microsoft 365 tenant to CircleScope. A Global Administrator of that tenant has to approve the connection in Microsoft’s own approval screen, every permission is read-only, nothing is installed, and the approval can be withdrawn at any time in Microsoft Entra under Enterprise applications.

When connected, CircleScope reads:

• Microsoft 365 Copilot activity — who used Copilot, when, from which app, and which files or sites Copilot read on their behalf (names, links, and any sensitivity labels on them)
• The list of third-party apps that have been given access to the organization’s Microsoft 365 data, and who approved them
• Users, their display names, and their license assignments
• For users licensed for Microsoft 365 Copilot, the text of the prompts they typed into Copilot

Where redaction happens is different here. The extension redacts on the device, before anything is sent. Microsoft, by contrast, delivers Copilot prompt text to CircleScope’s backend in full, so the same redaction — Social Security numbers, payment card numbers, API keys — is applied on our servers, at the moment the prompt arrives and before it is written to storage. The unredacted text is never stored. Copilot’s responses are never collected at all.

One thing outlives the rest: the record of which documents and sites Copilot read, and how they were labelled, is security posture information rather than prompt content, so it is kept beyond the organization’s prompt-text retention window. Prompt text is purged on the organization’s schedule as described below.

How the data is used

Collected activity is transmitted over HTTPS to CircleScope's backend (hosted on Supabase in the United States), where it is scored for policy risk and made available to the deploying organization's authorized administrators for compliance review and employee coaching. Data is used solely to provide this service to the deploying organization. It is never sold, never used for advertising, and never used to train AI models. Automated risk scoring is performed by an AI classification service under agreements that prohibit training on the data.

Retention and deletion

Each organization sets its own retention window (7–365 days; 90 by default), after which event data is purged. Organizations may request deletion of their data at any time via their IT provider or by contacting us.

Contact

Questions about monitoring on your device should go to your IT administrator, who controls the deployment. For questions about this policy or CircleScope's data handling, contact privacy@circlescope.ai.