Privacy Policy — Chrome Extension

This policy covers the Aquara browser extension. It describes exactly what the extension sends, stores, and shares. Contact: admin@aquara.ai.

What the extension collects

1. Account information

When you create an account we collect your email address and your phone number, both of which are required, and optionally the organization name you select. These are handled by Supabase Auth, our authentication provider.

The phone number is stored on your account record and used to contact you about your account. It is not used for SMS marketing, and it is not used to sign you in.

2. Domains of pages you visit

Once you are signed in, the extension runs on every http/https page you open. For each page it takes the domain only — for example example.com — and sends it to our backend to look up whether that company is in Aquara's database.

We send: the domain (hostname).

We do not send: the full URL, path, query string, page content, form data, keystrokes, cookies, or anything you type — with one exception described below.

Because this happens on every page while signed in, the record of domains reaching our servers constitutes browsing history. It is used to answer the lookup and is not sold, rented, or used for advertising or profiling.

3. Page metadata — only when you ask

The extension reads the standard <meta> tags of the page you are on (title, description, site name) locally, in your browser. This information is only transmitted if you click "Save this company" on a site that is not yet in our database.

4. Stored on your device only

The following live in your browser's local extension storage and are never transmitted to us:

Your session tokens (so you stay signed in)
Cached company lookups — up to one hour for a company we hold, five minutes otherwise — all deleted when you sign out

Cached lookups can include the names, job titles, email addresses, and phone numbers of business contacts, which is why the cache is erased on sign-out.

What we never collect

Full URLs, page paths, or query strings
Page content, text you select, or text you type
Passwords or form input
Cookies or data belonging to sites you visit
Analytics, telemetry, or advertising identifiers — the extension contains no analytics SDK and no tracking pixels

The extension contains no remote code. All executable code is contained in the published package.

Who else receives data

Supabase

Backend and authentication provider

What they receive

Your email address and phone number, plus organization if given; the domains you look up

When

Account creation, and every lookup
Google

Public favicon service

What they receive

The domain of a company already in the Aquara database

When

Only when the site you are on matches a company we hold, or when you expand Transaction History

On a site that is not in our database — which is most ordinary browsing, including internal tools, private staging sites, and anything personal — no logo request is made to Google at all. The extension reads the icon the page already declares for its own browser tab, which your browser has fetched anyway, so nothing new is disclosed to anyone.

Logos for the companies and news sources listed under Transaction History are only requested if you actually expand that section.

Requests to Google are made by your browser directly, carry no account information from us, and carry no identifier linking them to you.

We do not sell personal information, and we do not share it with data brokers or advertisers.

Business contact data in Aquara

Aquara is a business-intelligence tool. Its database contains professional contact information about people at companies — names, job titles, work email addresses, and phone numbers — sourced from third-party data providers and public sources. This information is shown only to authenticated Aquara users.

If you are a professional whose details appear in Aquara and you want them corrected or removed, email admin@aquara.ai and we will action the request.

Your choices and rights

Restrict which sites the extension runs on. Chrome controls this directly: right-click the Aquara toolbar icon and choose "This can read and change site data", or open chrome://extensions, click Details on Aquara, and set Site access to On click or On specific sites. On a site you exclude, the extension does not run at all — no panel, and no automatic lookup of that domain. Opening the toolbar popup still performs a lookup for the tab you are on, because that is something you have explicitly asked for.
Sign out. This stops all lookups and erases the local cache.
Uninstall. Removing the extension deletes all locally stored data.
Access, correction, deletion, portability, or objection. Email admin@aquara.ai. We respond within 30 days. Depending on where you live, these rights may arise under the GDPR (EU/UK) or the LGPD (Brazil).

Our legal basis for processing under the GDPR is legitimate interest in providing a business-information service, and contractual necessity for operating your account.

Retention

Account data: for as long as your account exists, then deleted on request.
Domain lookups: retained only as long as needed to operate and secure the service.
Local cache: up to one hour, or until sign-out.

Children

The extension is a professional tool and is not directed to anyone under 16. We do not knowingly collect data from children.

Changes

Material changes to this policy will be reflected in the "Last updated" date above and, where the change is significant, noted in the extension's Chrome Web Store listing.