Privacy policy
How EAISight handles personal data: for people who use the console, for staff whose AI use is recorded, and for the browser extension.
Last updated: 4 November 2026
Who we are
EAISight is provided by Fulcrum IT Services Ltd, a company registered in England and Wales (company number 03741699), registered office Techsperience Ltd, 91 Brick Lane, London, E1 6QL, United Kingdom.
Contact us about privacy or data protection at help@eaisight.com.
"We", "us" and "our" in this policy mean that company. "EAISight" means the service: the console at this website, the Windows agent, the browser extension and their APIs.
Our two roles
EAISight is used by organisations (our customers' client organisations) to see how their staff use AI tools on work devices. Client organisations usually buy EAISight through an IT provider (a partner).
- For monitoring data (what the agent and extension record about AI use on a work device), the client organisation is the controller: it decides to monitor, why, and what is recorded. Its IT provider and we act as processors on its instructions. If you are a member of staff with a question about monitoring at your workplace, your employer is the right first contact.
- For console accounts, billing, support and this website, we are the controller.
Console accounts, billing and this website
What we collect
- Account details: your name, email address and the organisations and roles you hold.
- Sign-in security: a salted hash of your password (never the password itself), authenticator-app and passkey registrations, and, if you sign in with Microsoft, your Microsoft tenant and object identifiers.
- Activity records: an audit log of changes made in the console (who changed what and when), views of captured prompt text.
- Billing: organisation names, billing contacts, device counts per month and invoices. Card and bank details are handled by Stripe; we never receive or store full card numbers.
- Technical data: IP addresses and request details in server logs, kept for security and fault-finding.
- Correspondence: emails you send us.
Why, and our lawful basis
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Providing the console and the service you or your organisation signed up for | Contract |
| Keeping accounts secure: sign-in, second factors, audit log, abuse prevention | Legitimate interests (security of the service and of our customers' data) |
| Billing and accounting records | Contract; legal obligation (tax and accounting) |
| Service emails (invitations, sign-in links, security and billing notices) | Contract; legitimate interests |
| Answering enquiries and support | Legitimate interests |
We do not use your data for advertising, we do not sell it, and we do not make decisions about you by automated means.
Monitoring data (AI use on work devices)
We process this data for the client organisation, under its instructions and our agreement with it (or with its IT provider). What is recorded depends on the organisation's settings:
- Always (metadata): which AI tool from our catalogue was used, on which device and by which Windows user; when and for how long; how many prompts were sent where this can be observed; whether a business, personal, free or API-key account was used, with its plan and email domain; model names and token counts where the tool's own local logs record them; and when Google or Bing showed an AI-generated answer (not the search itself).
- Only if the organisation turns on prompt capture: the text typed into AI tools in the browser, and the search terms of Google or Bing searches that showed an AI-generated answer. Passwords, keys, card and bank numbers, National Insurance numbers, email addresses and phone numbers are removed on the device first. Captured text is encrypted with a key specific to the organisation and month, and deleted automatically after the organisation's retention period (7 to 730 days; 90 by default).
- Only if the organisation turns on account identification: the email address of the AI account. Otherwise only its domain and a keyed hash are kept.
- Only if the organisation turns on warnings and blocking: when the browser extension showed a warning or block page instead of an AI tool, the reason chosen by someone who continued anyway, and access requests with the note the person wrote. Requests are emailed to the organisation's administrators and those of its IT provider.
- Never: AI responses, files or attachments, screenshots, keystrokes outside AI tool composers, other websites or applications, passwords, cookie values or sign-in tokens.
The full staff-facing description is on our monitoring notice. Requests from staff to see or delete their data should go to their employer; we help the employer answer them.
The EAISight browser extension
The EAISight Browser Monitor extension for Chrome and Edge is installed by an organisation on the devices it manages. It works only together with the EAISight agent on the same device; installing it on any other device does nothing.
- What it handles: the address of the current tab, compared on the device against our list of AI tools; time spent and requests made on those AI tools; whether a sign-in cookie for those AI tools exists (the cookie's value is never read); the signed-in account's email, plan and organisation as shown by the AI tool, used to tell company from personal accounts; on Google and Bing result pages, whether an AI-generated answer is shown; and, only where the organisation has turned on prompt capture, the text typed into those AI tools and the related search terms.
- Where it goes: only to the EAISight agent on the same device, through the browser's native messaging channel. The agent applies the organisation's settings (for example removing the email address unless account identification is on) and sends the result to the organisation's EAISight service. The extension itself sends nothing to the internet.
- Warnings and blocking: where the organisation has turned this on, the extension asks the agent whether an AI tool is approved for this person and account, and if not shows its own page instead (with a choice to continue, switch account or request access). The address of that tab is kept in the browser's memory only, so "continue" can return to it, and is never sent.
- What it does not do: it does not run on websites outside its list of AI tools and search result pages, does not record browsing history, and does not load code from the internet.
- Use: data from the extension is used only to provide EAISight to the organisation that installed it. It is not sold, not used for advertising or credit decisions, and not transferred to anyone else except as described in Sharing. Our use of information received from the extension complies with the Chrome Web Store User Data Policy, including its Limited Use requirements.
Cookies
This website uses only cookies that are strictly necessary for it to work. There are no analytics, advertising or tracking cookies, so we do not ask for cookie consent.
| Cookie | Purpose | Lifetime |
|---|---|---|
eaisight.console | Keeps you signed in | Up to 12 hours |
eaisight.2fa | Remembers a sign-in waiting for its second factor | 5 minutes |
.AspNetCore.Antiforgery.* | Protects forms against cross-site request forgery | Session |
.AspNetCore.Correlation.*, .AspNetCore.OpenIdConnect.Nonce.* | Complete a "Sign in with Microsoft" | 15 minutes |
eaisight.viewas | EAISight staff only: previewing the console as a customer role | Up to 8 hours |
Who we share data with
We use a small number of service providers (sub-processors), listed with what they do on our security page. Each is bound by a contract that limits its use of the data to providing its service to us. We also share data:
- within the service as it is designed: a client organisation's data is visible to that organisation's console users and to its IT provider, and to our own staff where needed to operate and support the service;
- when required by law, or to protect the rights, property or safety of our customers, ourselves or others.
EAISight is hosted in the United Kingdom. Where a provider processes data outside the UK (for example Stripe for payments), the transfer is covered by UK adequacy regulations or the UK International Data Transfer Agreement or Addendum.
How long we keep data
- Console accounts: while the account is active; removed when the user is removed or asks us to delete it, apart from audit-log entries kept to show who made changes.
- Monitoring metadata: for as long as the client organisation uses EAISight, unless it asks us to delete it sooner. When an organisation leaves, we delete its monitoring data on request and in any case within 90 days of the end of the agreement.
- Captured prompt text: the organisation's retention period (7 to 730 days, 90 by default), then deleted automatically.
- Billing records: six years, as UK tax law requires.
- Server logs: a short period for security and fault-finding.
Security
Data is encrypted in transit, access to the console needs a second factor for administrator roles, every administrative change is logged, and captured prompt text is encrypted with per-organisation keys. More detail is on our security page.
Your rights
Under UK data protection law you can ask for a copy of your personal data, ask us to correct or delete it, object to or restrict our use of it, and ask for it in a portable format. For monitoring data, contact your employer, which decides how that data is used; for everything else, contact us at help@eaisight.com. We will reply within one month.
If you are unhappy with how your data has been handled, you can complain to the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to put things right first.
Changes to this policy
We will update this page when our practices change and show the date at the top. Significant changes will be notified to console administrators by email.