Privacy policy

Mutaris is a regulatory-compliance platform operated by 3Beez. The platform runs on Google Cloud in the United States, in the us-east4 and us-central1 regions. Retrieval of regulatory text runs in europe-west2.

The extension checks sentences you write against advertising regulations. It runs on the pages where you turn it on and stays off everywhere else.

What leaves your browser. Text you type is first examined entirely on your own machine by a classifier that runs inside the extension. Only a sentence that classifier marks as a possible regulated claim is sent to Mutaris, along with the sentence immediately before and after it for context. A sentence is truncated at 1000 characters and at most 25 are sent in one request. Everything else you type is never transmitted.

What does not leave your browser. The extension does not send the page you are on, its URL, its contents, your browsing history, your keystroke timing, your screenshots, or any file. It reads the address of the current tab only when you open its popup, and only to show you whether checking is on for that site. That address is not transmitted.

What the extension stores locally. Your settings and your per-site on and off choices, in Chrome’s own synced storage. Your sign-in token, which expires. Nothing else.

What is recorded when you act on a finding. Applying a rewrite or dismissing a finding is written to your organization’s compliance record, described below.

The add-in sends the sentences of the document you ask it to check to the same endpoint, when you press Check document. It does not read your document otherwise, does not upload the file, and does not run in the background.

Signing in through Google gives us your name, your email address, and your Google account identifier. We use them to identify you, to place you in your organization, and to attribute actions in the audit record. We do not receive your Google password.

Documents, product evidence, and marketing pages you submit for audit are stored so the platform can do what you asked of it. Every state change is written to an append-only audit record, which is the point of the product: a regulator asking who changed what, and when, has to be able to get an answer.

When a sentence is flagged, and when you apply a suggested rewrite or dismiss a finding, Mutaris records that in your organization’s audit record. Each entry holds the sentence, the verdict, the regulation it was flagged under, the rewrite that was offered, the site you were writing on, your email address, and the time.

This is the point of the product rather than a side effect. A compliance officer has to be able to show which flagged claims a team corrected and which it published anyway, and an entry that cannot name who acted cannot show that. These entries are deliberately identified, unlike the classifier records described below.

We record the site’s address only, never the full page address. The rest of a web address carries session identifiers, search terms, and document names that this record has no use for.

The record is append-only. Entries are not edited or deleted once written, and a check runs every fifteen minutes to prove none has been altered. That is what makes it evidence.

When the platform returns a verdict on a sentence, that sentence and that verdict are stored and used to retrain the classifier that runs inside the extension. This is what lets the on-device gate improve, which is what keeps most of your writing from ever being transmitted at all.

These records carry the sentence, the verdict, and a one-way hash of your organization identifier. They do not carry your name, your email address, the page you were on, or anything else that identifies you. We do not sell them, and we do not share them with anyone outside Mutaris.

If you would rather your text was not used this way, write to the address below and we will exclude your organization.

Google Cloud hosts the platform and stores its data. Anthropic and Google process the text of a checked sentence to produce a verdict, through their respective enterprise APIs. Neither trains on it. We use no advertising networks and no analytics that follow you across sites.

Account and organization records last as long as the account does. Audit records are append-only and are retained for the period the relevant regulation requires, which is what makes them evidence. Documents and audit results are kept until you delete them or close the account.

Classifier training records have no automatic expiry today. Setting one is open work, and until it is set they persist indefinitely in the hashed form described above.

You can turn checking off for any site, or everywhere, from the extension’s popup, and the extension then transmits nothing. You can uninstall the extension, which removes its local storage. You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it, and we will act on that request within 30 days.

Write to privacy@mutaris.ai for anything in this policy, including a request to access or delete your data.

Material changes to this policy will be announced in the platform before they take effect. The date at the top is the date of the current version.