Privacy Policy

• Email address — required to create an account and log in
• Password — stored as a bcrypt hash; we cannot read your plaintext password
• Display name — optional, visible only to you

• AI prompts — the text descriptions you provide when requesting the AI to build a tool
• Conversation history — iterative chat messages between you and the AI during tool refinement
• Generated tool code — JavaScript, CSS, and configuration produced by the AI based on your prompts
• Tool metadata — name, description, target websites, status (draft/active/archived)

When you start a Global Executive task, the following data is created and stored under your account:

• Task prompt — the instruction you gave the agent
• Agent plan — the AI-generated step list for the task
• Step logs — per-step records of actions taken (click / type / navigate / read / screenshot), the target element selectors, and the step result
• Page content snippets — textual excerpts of the DOM the agent extracted to make its next decision. Only content from pages you authorised is captured
• Screenshots — images of pages the agent visited, used by multimodal models for planning. Screenshots may include whatever is visible on the page at the time (including any personal data visible to you)
• Status & credit cost — task status (running / paused / done / failed), model used, total credits consumed, step count
• User-provided answers — any text you type when the agent asks a follow-up question during a task

Important: Agent data can include anything visible on the pages you direct the agent to. If you run the agent on a page showing personal information (emails, messages, account details, financial data), that information will be transmitted to our Server and to our AI provider (OpenRouter) for planning. Use the agent only on pages whose contents you are comfortable sending to those processors. You can delete any task from your dashboard at any time.

• Credit balance & transactions — credits purchased, used, and remaining
• AI request count — number of AI generation requests made
• Daily request count — used for rate limiting (50 requests/day)
• Lemon Squeezy customer ID — linked when you purchase credit packages
• Payment records — processed by Lemon Squeezy; we only store the transaction reference, not your full payment details

• IP address — logged in audit records for security and abuse prevention
• User-Agent string — logged in security audit events
• Request ID — unique UUID per request for log correlation
• Timestamps — account creation, last login, tool creation/update times

Audit logs are automatically deleted after 90 days.

• JWT authentication token — stored in chrome.storage.local; only accessible by the Extension
• Installed tools & tool code — cached locally for instant injection without network calls
• Extension settings & preferences — layout preferences, YouTube tool settings, etc.
• Tool-specific data — data collected by AI-generated tools, stored via isolated per-tool storage

This data never leaves your browser unless you explicitly export it. We do not have access to your local browser storage.

• Authenticating your account and managing sessions
• Generating AI tools based on your prompts via OpenRouter
• Planning and executing Global Executive agent tasks you initiate (multimodal reasoning over the page content and screenshots you authorised)
• Saving, syncing, and retrieving your tools, conversations, and agent task history across devices
• Processing credit purchases and managing your credit balance
• Injecting your accepted tools into matching websites

• Rate limiting to prevent API abuse (50 AI requests/day per user)
• Audit logging of credit transactions and security events (90-day retention)
• Detecting and blocking suspicious activity (failed logins, rate limit hits, invalid webhooks)
• Account suspension for Terms of Service violations

• Service-related notifications (billing confirmations, security alerts)

We do not send marketing emails. We do not sell, rent, or share your email with third parties for marketing purposes.

What is shared: Your AI prompts and conversation context are sent to OpenRouter to generate tool code. We do not send your email, password, or personal identifying information to OpenRouter.

OpenRouter's policy: https://openrouter.ai/privacy

Key protection: The OpenRouter API key is stored only on our server and is never exposed to the Extension or client-side code.

What is shared: When you purchase credits, you are redirected to Lemon Squeezy's checkout. Lemon Squeezy collects your payment details directly — we never see or store your credit card number.

What we receive: A webhook with your Lemon Squeezy customer ID and purchase details (no card data). We use this to credit your account.

Lemon Squeezy's policy: https://www.lemonsqueezy.com/privacy

What is stored: All server-side data (account info, tools, conversations, audit logs) is stored in MongoDB Atlas. MongoDB acts as a data processor under our instructions.

MongoDB's policy: https://www.mongodb.com/legal/privacy

If you use a self-hosted version of our Source-Available Server, your data is processed by that server's operator, not by us. We have no access to, control over, or responsibility for data processed by self-hosted instances. The operator of a self-hosted instance is their own data controller.

You can request a copy of all personal data we hold about you. You can also view most of your data directly through your Dashboard at any time.

You can update your display name and email through your account settings. Contact us if any data is inaccurate.

You can delete your account and all associated data from your Dashboard settings page. Upon deletion, your account, tools, conversations, and personal data are permanently removed within 30 days. Audit logs (which do not contain your personal content) are retained for 90 days for security purposes.

You can export your tools and conversation data in JSON format via the API. Contact us for a full data export.

You can request that we restrict processing of your data in certain circumstances (e.g., accuracy disputes, unlawful processing claims).

You can object to processing based on legitimate interests (e.g., audit logging). We will cease processing unless we have compelling legitimate grounds.

We do not use automated decision-making or profiling that produces legal or similarly significant effects. AI tool generation is a user-initiated, user-controlled process.

Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

You have the right to lodge a complaint with a supervisory authority in the EU/EEA member state of your habitual residence, place of work, or place of the alleged infringement.

Used to save your authentication token, installed tools, and preferences locally on your device via chrome.storage.local.

Used to detect when you navigate to a website so the Extension can inject matching tools, and so Global Executive can read the tab URLs and titles you authorise for a task.

Used to inject your accepted AI-generated tool code (JavaScript + CSS) into web pages that match the tool's target sites, and to execute Global Executive agent actions inside the authorised tab.

Used to interact with the currently active tab for tool injection and agent execution.

Used to display the Extension's side panel UI (tool list, builder, settings).

Used exclusively by Global Executive to drive authorised tabs reliably (typing real keystrokes, clicking precise coordinates, and capturing screenshots via the Chrome DevTools Protocol). When the debugger is attached, Chrome shows a persistent yellow notification bar on the tab. The extension only attaches to the tab the user has assigned to an active task, and detaches when the task ends.

Used by Global Executive to save files (e.g., exported tool bundles, agent-captured artefacts, CSV exports) to your local Downloads folder when you explicitly request it.

Used to schedule background work such as authentication token refresh, agent task heartbeats, and periodic notification checks.

Used only when you explicitly ask Global Executive or a tool to "use what is on my clipboard". The extension does not read your clipboard in the background.

Required because AI-generated tools and Global Executive tasks can target any website. The Extension only injects code into pages that match your configured tool target sites, and only attaches the agent to the tab(s) you explicitly authorise for a task — it does not read or modify every page you visit.

We do not use cookies for tracking or advertising. We do not use tracking pixels. The Extension does not place tracking cookies on websites you visit. Local storage usage is strictly for service functionality (preferences, tool caching, authentication).

New Order Global is a small-scale service. We are not a Very Large Online Platform (VLOP) under the DSA. However, we provide:

• Transparent terms of service and content moderation policies
• A mechanism for reporting illegal content or tools
• Clear point of contact for authorities and users

We are not a gatekeeper under the DMA. This regulation does not apply to our service.

Our AI tool generation feature uses third-party general-purpose AI models (via OpenRouter). We do not develop or deploy high-risk AI systems as defined by the AI Act. AI-generated tools are user-initiated and user-controlled. Users are responsible for ensuring their use of AI-generated tools complies with applicable law.

Credit packages are digital goods. Under EU law, you may have a 14-day right of withdrawal for distance contracts. However, once credits are consumed (used for AI generation), the right of withdrawal may no longer apply as the digital content has been supplied and consumed with your consent.

Payment processing is handled entirely by Lemon Squeezy, which complies with PSD2 requirements including Strong Customer Authentication (SCA).