Privacy notice for our plugins

1. Controller and data protection officer

frag.hugo Informationssicherheit GmbH
Spaldingstraße 64-68, 20097 Hamburg, Germany
Email: info@fraghugo.de · Support: support@fraghugo.de
Managing director: Nils Oehmichen

External data protection officer: datuno GmbH, Kiebitzhörn 15, 22885 Barsbüttel, Germany, datenschutz@datuno.de.

This notice covers our two plugins. Everything else, including our website, is described in our full privacy policy (in German); the German text prevails.

2. Browser extension “frag.hugo AI Shield”

The browser extension frag.hugo AI Shield (German “frag.hugo KI-Schutz”) for Google Chrome and Microsoft Edge replaces personal data in text you paste into ChatGPT, Claude, Gemini, Microsoft Copilot, Microsoft 365 Copilot Chat and DeepL with placeholders. It works in a free mode without an account and in company mode when your employer distributes it centrally.

Free mode: processing only in your browser

The text you paste, the placeholders and the mapping between placeholder and real value are processed only in your browser. The mapping lives in the browser's session storage and is deleted when you close the browser, after twelve hours without use, or when you choose “Clear mapping” in the extension. This data is never sent to frag.hugo.

The only connection to us is the daily download of a signed page configuration from ki-schutz.fraghugo.de. It describes where the input field and the answer sit on the supported pages and contains no personal data. Your IP address is transmitted for technical reasons; the service does not store IP addresses, and its logs contain none.

The extension sends no telemetry and no usage statistics. Error reports are sent only if you switch them on in the options. They are anonymous and contain only the page adapter concerned, the extension version and the error class, never text from your input or the answers.

Legal basis: downloading the page configuration, Art. 6(1)(f) GDPR (our legitimate interest is that the extension keeps working when the supported pages change); access to your device is strictly necessary under Section 25(2) no. 2 TDDDG. Error reports: your consent, Art. 6(1)(a) GDPR and Section 25(1) TDDDG, which you can withdraw at any time in the options.

Company mode

If your employer distributes the extension, it uses the company's deployment key to fetch the company configuration: the list of approved AI services, the link to the company's AI policy and short learning units. The key identifies the company, not the individual person.

Monthly figures exist only if the company switches them on. They are counters without content (for example the number of replaced items), tagged with a random value that is regenerated every month. The company sees them only once they come from at least five devices, and only in total: no department, no person. IP addresses are not stored. Towards our business customers we act under the existing platform contract and data processing agreement.

The AI services

The providers of the AI services are separate controllers or providers whose services you use yourself. What reaches them — the placeholders and any data the extension did not detect — is subject to their terms. Our assessment of the individual services and plans is in the DSGVO-Prüfstand (in German). The configuration service runs on Cloudflare (Workers and Workers KV).

3. frag.hugo for AI assistants (Claude, Microsoft 365 Copilot, ChatGPT)

Through our service mcp.fraghugo.de you can connect frag.hugo to AI assistants such as Claude, Microsoft 365 Copilot and ChatGPT. The assistant then calls tools, for example to search documented GDPR fines, look up deadlines, assess software or find the competent supervisory authority.

Public tools (no account)

Search terms, software names and domains passed by the assistant are processed only to answer the request. They are neither stored nor logged. Rate limiting uses short-lived counters with a hash of the IP address that expire after two days at most; the IP address itself is not stored. For the email security check our servers query the DNS records of the given domain.

Exception: website check. If you ask the assistant to check a website, the address is sent to our scanner, which loads the page like a visitor. As with every Hugo Check, the scanner logs the address, keeps the result available for retrieval and stores, per domain, which third-party services it found. To avoid checking the same request twice, we keep a hash of the address for up to 24 hours.

Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is to provide the requested information and to protect the service from overload.

Tools with your frag.hugo account

frag.hugo customers can connect their existing account (OAuth). The assistant can then read and enter whatever the connected person may read and enter in the app: company details, processing activities, service providers and data processing agreements, technical and organisational measures, privacy policy, retention schedule, data protection impact assessments, data breaches and data subject requests, employees (name, email address, department) with their trainings and safety briefings, phishing exercises, answers to the onboarding audit, documents, tasks, the AI register, and NIS2 and supply chain details. The same permissions apply as in the app. You grant reading and writing separately when you connect.

Anything that sends an email or deletes something (for example inviting employees, assigning trainings or starting a phishing exercise) is first shown as a preview and only carried out after your explicit confirmation.

Every change made through the assistant is recorded in your company's change log: who made it and when, which record, which fields changed, and what they looked like before and after. You can see in the app what your assistant changed and undo it for 90 days. After that we delete the contents (before and after) from the log; the line without contents (who, when, which record) is kept as evidence for 13 months and then deleted.

For the connection we store the access tokens (encrypted), timestamps, the name of the connected assistant and your organisation, so that you can see and revoke the connection in the app. An access token is valid for one hour, its renewal for at most 90 days without use; after that, or when you revoke it, the connection ends. The log of tool calls holds no free text, only IDs, tool, time and a checksum of the input. Legal basis: Art. 6(1)(b) GDPR (your contract with us).

Whatever your assistant enters is processed on behalf of your company, as in the app, under the existing platform contract and data processing agreement.

Your AI provider

What you tell your assistant and what it reads from frag.hugo is processed by the provider of the AI assistant you use (for example Anthropic, Microsoft or OpenAI). You choose that provider and contract with it, so it is your processor, not ours, and it processes the content under its own terms. For personal data such as your employee list, use a business plan with a data processing agreement, for example Claude Team or Enterprise, ChatGPT Business or Enterprise, or Microsoft 365 Copilot. The DSGVO-Prüfstand (in German) shows which plans qualify.

Hosting

mcp.fraghugo.de runs on Cloudflare (Workers and Workers KV; Cloudflare is certified under the EU-U.S. Data Privacy Framework and bound by a data processing agreement). Content your assistant reads or enters only passes through there and is not stored. The platform holding your account data runs on servers of Hetzner Online GmbH in Germany.

4. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) (Art. 21). Consent can be withdrawn at any time with effect for the future. Write to info@fraghugo.de.

You may lodge a complaint with a supervisory authority. Ours is the Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI), Ludwig-Erhard-Str. 22, 20459 Hamburg, datenschutz-hamburg.de.