GatePass Extension Privacy Notice

This notice covers the Infraista GatePass browser extension ("the extension") and the GatePass service it connects to. It adds to the Infraista Privacy Policy. GatePass is provided to organisations ("your organisation"), which decide who gets an account and which websites are routed.

1.What the extension does

The extension sends the websites your organisation chooses ("routed sites") through your organisation's GatePass hub and gateways, so those sites see your organisation's exit IP address. All other websites open directly. The extension doesn't route them, log them or send their addresses anywhere.

2.Information we process

• Account details: your name and work email, and your organisation's name, from your GatePass account.
• Sign-in information: your password and two-step codes, which are sent once over HTTPS to sign you in. The extension never stores them. A session token is kept in the extension's storage until you sign out or the session ends. Tokens are never logged.
• Device information: browser and operating system, extension version, IP address, and an approximate city and country derived from it, at sign-in and on each heartbeat (about once a minute while you're signed in).
• Routed site visits: for routed sites only, the site's address, time, data transferred, result and the device. For HTTPS sites the hub sees only the site name and port, not the page or its content. GatePass doesn't decrypt traffic.
• The current tab: when you open the popup or Site details for a routed site, its address (without the query string) is checked with the GatePass service to show which rule and gateway apply. Direct sites are decided inside the extension and their addresses aren't sent.
• Reports and diagnostics: only when you choose to send a problem report or run a connection test: your message, the hub name, recent connection errors and test results.
• Notifications: messages your organisation's admins send you, and whether each was delivered and opened.

The extension never reads page content, forms, cookies or passwords on the websites you visit, and it doesn't inject scripts into them.

3.Who can see it

• Your organisation's GatePass admins can see your account, devices, sign-in history, routed site visits, reports and notification delivery in the Infraista console, for the retention period they set.
• Infraista processes this information to run the service on your organisation's behalf, as described in the Infraista Privacy Policy. We don't sell it and don't use it for advertising.

4.Retention

Your organisation sets how long routed site visits are kept. Account and device records are kept while your account exists. When your organisation removes you, your devices are signed out and your account is deleted.

5.Your choices

You can pause GatePass or sign out at any time. While paused or signed out, nothing is routed through GatePass. For access to or deletion of your information, contact your organisation's GatePass admin, or Infraista through the contact page.

6.Contact

Questions about this notice: infraista.com/contact