SuiteHUD Privacy Policy

Summary

SuiteHUD runs in your browser on NetSuite pages. It uses SuiteHUD services at suitehud.com for account connection, install registration, license checks, settings sync, enterprise team sharing, subscription flows, optional SuiteHUD AI proxying, and Notes and Tasks. SuiteHUD does not run advertising analytics on your page inputs. SuiteHUD AI is off by default and requires explicit opt-in before any AI feature runs.

Some features send content you write to SuiteHUD backend, and they are worth understanding before you use them:

• Notes and Tasks (Pro/Enterprise) store notes and tasks you leave on NetSuite pages on SuiteHUD backend. Anything you @mention a teammate on, or assign to them, is readable by that teammate. A task can also carry a due date and a saved SuiteHUD AI prompt — which is stored only, never run on its own. See "Notes" and "Tasks" below.
• Voice input lets you dictate into the SuiteHUD AI chat box instead of typing. Recognition is done by your browser, not by SuiteHUD — and Chrome, by default, sends the captured audio to Google’s speech service to transcribe it. SuiteHUD never receives your audio and never stores it. The transcribed text goes into the chat box exactly as if you had typed it, and is sent nowhere until you press Send. See "Voice input" below.
• SuiteHUD AI chat history stores a text transcript of your AI conversations on SuiteHUD backend, scoped to you. This is on by default. You can turn it off per conversation (Incognito) or for every new conversation (Settings → SuiteHUD AI → Incognito by default), and you can delete any or all saved conversations at any time. See "SuiteHUD AI chat history" below.
• Referral invitations send one email address that you type — a colleague's — to SuiteHUD backend so it can email that person an invitation to try SuiteHUD. Nothing is sent until you press Send, and SuiteHUD never reads addresses from NetSuite or from any address book. See "Referrals" below.

Data Stored Locally

• Hybrid extension cache (chrome.storage.local): HUD preferences, SuiteHUD AI enablement/consent, report package definitions, shortcut setup, field-map formatting preferences, export preferences, local sync metadata, and non-secret MCP setup state such as the NetSuite account ID. The NetSuite Integration Client ID is no longer stored in your browser: it now lives on SuiteHUD backend, so an enterprise administrator can set up one or more NetSuite connections once for their whole team. The extension fetches it only when it needs to build a NetSuite authorization URL and holds it in memory for the length of that one sign-in. The Client ID is a public OAuth client identifier, not a password or secret — these NetSuite integrations use PKCE and have no client secret.
• SuiteHUD account session (chrome.storage.local): a rotating SuiteHUD refresh token used solely to keep you signed in and obtain short-lived access tokens for SuiteHUD backend requests. It is replaced each time your session refreshes and is removed when you sign out or if your session becomes invalid.
• AI Lessons consent (chrome.storage.local): a single opt-in flag (acc_ai_learning_consent_v1) recording whether you've agreed to the AI Lessons "Learn from this conversation" flow described below. The lessons themselves are not stored in the browser — they live on SuiteHUD backend, scoped to your account.
• AI Memory enabled flag (chrome.storage.local, synced): a single opt-in flag (acc_ai_memory_enabled_v1) recording whether you've turned on AI Memory, described below. Like your other settings (SuiteHUD AI enablement, usage display, etc.), this flag syncs to your SuiteHUD account so it carries over across devices — see "Data Sent Externally" below. The memory notes themselves are a separate thing entirely: they're never stored in the browser at all, only on SuiteHUD backend, scoped to your individual account.
• Enterprise sharing cache (chrome.storage.local): pending enterprise shares currently addressed to the signed-in user are cached under suitehud_pending_shares_v1 so the notifications panel can render and update without constant polling.
• Notes and Tasks index (chrome.storage.local): a summary index cached under suitehud_notes_index_v1 so the HUD can show its badge without a request on every page load. It holds the page keys that currently have notes or tasks (see "Notes" below for what a page key is), unread, expiring, due-soon and overdue counts, and one record per notification event — which thread it belongs to, what kind of event it was (mention, reply, resolve, task assigned, task completed, task overdue), the name of the teammate who acted, the record type and internal ID it happened on, and when. The extension does not read note or task text from this cache: that text is requested from SuiteHUD backend when you open the panel and is held in memory only for as long as the panel is open. A second key, suitehud_notes_seen_v1, holds up to 500 event identifiers already shown to you as a desktop notification, so the same mention or due date is not announced twice. (Before version 2.4.0 these two keys were named suitehud_comments_index_v1 and suitehud_comments_seen_v1; updating renames them in place and removes the old ones.) Both keys are erased when you sign out, when your Pro access ends, or when your enterprise team is deactivated — a cached index never outlives the session it belongs to.
• Legacy migration source (chrome.storage.sync): temporary one-time import source for older installs. Migrated keys are copied into chrome.storage.local and then retired from sync.
• Session-only extension state (chrome.storage.session): temporary export worker state used during the current browser session.
• Local export cache (IndexedDB): export metadata and generated file blobs used by the export/notification workflow.
• NetSuite page localStorage: UI preferences on NetSuite pages, such as panel width and collapsed/expanded panel state. Some legacy field-map preferences may be imported from page localStorage into extension storage on first use.
• NetSuite page sessionStorage: your current SuiteHUD AI conversation, so the chat survives a page reload. While a message that has files attached is being answered, the attachment content itself is part of that saved conversation; once the answer completes, each attachment is replaced with a short label such as [document: Q3-notes.docx], so the file content is no longer retained. Also held here: the conversation's own identifier, its Incognito on/off state, and — briefly, until the next reply is drawn — a summary of a record action just run, so the "log this to Notes" button can be offered once. Everything in sessionStorage is discarded by the browser when you close the tab, and you can clear it sooner by starting a new conversation.

Data Sent Externally

• Optional profile pictures: You can upload, replace, or remove a profile picture in your account settings, or keep an initials avatar. SuiteHUD resizes uploaded pictures and removes embedded image metadata before sending them to Clerk, our authentication provider, which stores and serves them for your profile. Your picture appears in your own account and signed-in navigation. SuiteHUD also makes your current picture URL available to your authenticated extension during account connection and profile refresh, so supported extension versions can display it in your own account interface. Loading the picture contacts Clerk's image service. This feature does not publish it to a public member directory or add it to extension team lists. Image URLs are not a private document-sharing mechanism, so do not upload sensitive documents. Pictures are not used for facial recognition or account recovery. You can remove your picture without deleting your account; deleting your Clerk account as part of SuiteHUD account deletion also removes its profile image, subject to provider backup and cache retention.
• Referral subscription status: If you were referred, the person who referred you can see whether your referred subscription is scheduled to end, has ended, or has a payment issue, and the scheduled end date where available. This helps explain referral eligibility; it does not disclose your payment method or cancellation reason.
• SuiteHUD backend (https://suitehud.com): used for connect/login, token refresh, license verification, install sync, checkout/portal session creation, optional SuiteHUD AI proxying, and silent background sync of selected user settings/configuration data. Data sent for account/install flows can include a persistent install identifier, extension version, and device label. Sync-backed fields can include HUD preferences, SuiteHUD AI enablement/consent flags, the AI Memory on/off flag, the "Incognito by default" chat-history flag, the "Log record actions to Notes" flag, reporting package definitions, report export preferences, shortcut configuration, and field-map formatting preferences. Auth headers use the existing SuiteHUD token flow.
• Enterprise sharing endpoints on SuiteHUD backend (https://suitehud.com): for enterprise users, SuiteHUD can request the current enterprise team member list, send a report package or custom shortcut to a specific teammate, check the signed-in user's pending shared items, and delete pending share records after accept or decline. Share-related payloads can include recipient user ID, sender display name, item type, and the shared report package or custom shortcut object itself.
• Referrals (optional, on your action only): the licensing panel shows a referral code and share link that SuiteHUD backend issues for your account, and an Invite box. When you type an email address there and press Send, that one address is sent to SuiteHUD backend, which emails the person an invitation to try SuiteHUD carrying your referral code, and records the invitation against your account so you can be credited if they subscribe. Nothing is sent until you press Send; SuiteHUD does not read addresses from NetSuite, from your contacts, or from anywhere else, and the person receives nothing beyond that invitation and its own unsubscribe link. What comes back to the extension is your own list of invitations — each address, when you sent it, and how far it has got (invited, signed up, installed, subscribed) — together with how many free months you have earned this year, how many are banked or applied, and the yearly cap; the panel shows the same information, up to 200 invitations. Inviting someone gives them no access to anything of yours, and sharing your code or link is entirely up to you. Invitation records stay attached to your account; contact support to have one removed.
• SuiteHUD Connect page bridge (https://suitehud.com/connect*): extension and connect page exchange messages for login/connect flow, including install identifier, sign-in status, and a limited license/account summary such as license state, trial/subscription status, report-package limits, enterprise membership status, and device-limit state. When you start the connect flow from a NetSuite page, the extension also puts that page's URL on the connect page address as a returnUrl parameter so the site can send you back where you started; that URL is a NetSuite address and can contain the record or search identifiers in its query string.
• Notes (optional Pro/Enterprise feature): Notes lets you leave a note on a NetSuite page — a record, dashboard, saved search or Suitelet — that you and, if you choose, your teammates can see later. When you post a note or a reply, SuiteHUD sends its text (up to 2,000 characters, written by you) to SuiteHUD backend along with a page key identifying the page it belongs to, and the user IDs of anyone you @mention.
  • What a page key contains: your NetSuite account identifier (including the sandbox suffix, e.g. 1234567-sb1), and either the record's script type and internal ID (e.g. salesord, 1042) or, for a non-record page, the page path and a short fixed list of identifying query parameters (deploy, id, scriptid, searchid, type). Record titles, customer, vendor and employee names, amounts, and other record field values are never part of a page key, and this feature never reads them off the page. The only NetSuite content it transmits is what you yourself type. Labels shown in the Mentions, Tasks and Expiring lists, such as "Sales Order 1042", are built in your browser from the record type and internal ID alone.
  • A link back to the page is sent alongside the page key, so a note can be opened again from a list or from a reminder. It is rebuilt from scratch rather than copied out of your address bar: SuiteHUD keeps only the NetSuite host, the page path, and a fixed allowlist of identifying parameters (deploy, id, rectype, recordtype, script, scriptid, searchid, type), and drops everything else. Like the page key, it cannot carry a record field value, and a link that is not an https NetSuite page address is refused outright.
  • Who can read a note: a note with no mentions is private to you. Mentioning a teammate notifies them and grants them read access to that thread, including its replies; the literal *team mention notifies everyone at your company. Mentions require an Enterprise plan. Adding a mention to a reply grants that person access to the whole thread, which is why SuiteHUD asks you to confirm before posting anything with a mention on it.
  • What comes back: thread and reply text written by teammates on threads you can see, along with their display names, plus desktop notifications naming the teammate, the event, and the record.
  • Reminder emails: when a task is due or coming due, SuiteHUD emails the account address of the person it is due for. The message contains, for each task, the first 120 characters of the note text, the due date, and — where the task is attached to a record — a link back to that NetSuite page. If the reminder covers a single task, a 60-character extract of the note text also appears in the subject line, which means it is visible in an inbox preview without opening the message. Every reminder carries a one-click unsubscribe, and task reminders can be switched off on their own without affecting other SuiteHUD email.
  • Note text is not filtered or redacted. Like a file you attach to an AI message, a note is content you author rather than content SuiteHUD collects, so what you type is what is stored and what your mentioned teammates can read. Write them accordingly where a record involves personal, customer, or regulated data.
• Tasks (optional Pro/Enterprise feature, licensed separately from Notes): a task is a note with a due date, an owner, and optionally a saved SuiteHUD AI prompt. It is stored by the same service and follows every rule above, plus the following.
  • Extra fields sent: a due date, the user ID of the teammate you assign it to, if any, and a completion state. A due date is a calendar date and nothing else — it carries no time of day and no time zone, so "due Aug 15" means Aug 15 to everyone who can see the task. SuiteHUD does not read your NetSuite user record, or any preference on it, for this or any other purpose.
  • Tasks that belong to no record: a task does not have to be attached to a page. An off-record task ("review the close checklist") is sent with no page key at all.
  • Assignment is a notification to another person and, like mentions, requires an Enterprise plan. Assigning a task grants that teammate access to the thread and notifies them; you are also notified when a task you assigned is completed, and when a task of your own becomes overdue.
  • A saved AI prompt on a task is stored as written and sent to SuiteHUD backend with the task. It is stored only — SuiteHUD backend never runs it. A saved prompt runs only when you click it, and only by being handed to SuiteHUD AI in the chat panel exactly as if you had typed it there. A saved prompt that would perform a record action therefore still has to clear the confirmation described under "Record actions in SuiteHUD AI" below; saving one is not permission to run it, and there is no scheduler or background execution anywhere in this feature.
• SuiteHUD AI chat history (on by default, per-conversation and global opt-outs): unless a conversation is in Incognito, SuiteHUD sends a conversation identifier with each SuiteHUD AI message and SuiteHUD backend saves a text transcript of that conversation against your account, so you can find it again later. Attachments, images and tool results are not saved — they are replaced in the stored transcript with a short stand-in noting that the content was not saved — and NetSuite page context sent with a message is replaced the same way. Saved conversations are private to your own account and are never shared with teammates or your enterprise administrator.
  • One exception, on Enterprise plans only. An enterprise administrator can require that conversations are recorded for their team, which switches Incognito off and prevents it being turned back on. On a seat under that requirement, the transcript is stored as submitted — including the NetSuite page context attached to each message, which is not stripped. That is the point of the setting: the record has to reflect what was actually asked. Attachments and tool results are still replaced with stand-ins, and the transcript is still readable only by you — the requirement changes what is kept, not who can read it, and your administrator cannot read your conversations. The AI panel shows when Incognito has been switched off for your seat. From the History view in the AI panel you can open, rename, continue, or delete any saved conversation, and delete all of them at once (also available from Settings → SuiteHUD AI). Turning Incognito on for a conversation stops the identifier being sent at all, so nothing about that conversation is saved; the "Incognito by default" setting applies that to every new conversation and syncs to your SuiteHUD account so it carries across devices.
• SuiteHUD AI (optional Pro feature): when you explicitly enable SuiteHUD AI, SuiteHUD stores your Anthropic API key (if you bring your own) and your NetSuite OAuth access and refresh tokens encrypted on SuiteHUD backend systems, so the extension does not persist durable MCP secrets in browser storage. The non-secret parts of a NetSuite connection — the account ID, the Integration Client ID, and the redirect address — are stored unencrypted, because under PKCE none of them is a secret: a Client ID is a public identifier and there is no client secret involved. When you ask SuiteHUD AI a question, SuiteHUD sends your message, conversation history, selected NetSuite page context, account ID, and MCP tool request data through SuiteHUD backend to Anthropic and to NetSuite MCP/SuiteTalk services as needed to answer your request or perform authorized NetSuite actions.
• Record actions in SuiteHUD AI (writes to your NetSuite data): SuiteHUD AI can list and run NetSuite record actions — approvals, rejections, activate/inactivate and similar state changes exposed through NetSuite's record action API — on records in your own NetSuite account, using your own NetSuite session. These are writes: they take effect in NetSuite immediately and cannot be undone by SuiteHUD. Nothing runs without you first accepting a confirmation naming the action and the record, and SuiteHUD re-checks with NetSuite that the action is genuinely available for that record before running it. A bulk run over records you have selected from a result list is confirmed separately and is capped at 200 records per submission. Running an action sends the record type, internal ID and action ID to NetSuite, and the outcome NetSuite reports back — including any status fields that changed — becomes part of the conversation, which means it is sent to Anthropic on subsequent turns and saved in your chat history if that conversation is not in Incognito. If you turn on Settings → SuiteHUD AI → Log record actions to Notes (off by default), each run additionally writes a Note on that record recording the action name, the time, any fields that changed, and NetSuite's own response message; with the setting off, SuiteHUD instead offers a one-click button to write that note only if you want it.
• File attachments in SuiteHUD AI (optional, only files you choose): you can attach files to a SuiteHUD AI message — by clicking the attach button, dragging files onto the chat panel, or pasting an image from your clipboard — up to 5 files and 20 MB per message. Attached files are sent with that message through SuiteHUD backend to Anthropic, the same way the message text is. Nothing is attached or sent unless you attach it, and you can remove any staged file before sending.
  • Images (PNG, JPEG, GIF, WebP) are never sent as the original file. Each one is redrawn and re-encoded as a JPEG in your browser first, which also strips embedded camera metadata such as EXIF GPS coordinates before anything leaves your machine.
  • PDFs are sent as document content.
  • Word and PowerPoint files (.docx, .pptx) are not sent as files. SuiteHUD extracts their body text in your browser and sends only that text. Images, embedded objects, comments, footnotes, speaker notes, and revision history are not extracted and are not sent.
  • Spreadsheets (.xlsx, .xlsm, .xlsb, .xls, .ods) are not sent as files either. They are converted to plain text in your browser — cell values only, one block per sheet. Macros are neither extracted, sent, nor run.
  • Text and data files (CSV, TSV, TXT, JSON, Markdown, XML, HTML, logs, and common code/query files) are sent as text.
  • Extracted or plain text from any single file is truncated at 100 KB before sending, and you're told when that happens.
  • Because you choose these files yourself, they can include content from outside NetSuite. SuiteHUD does not inspect, filter, or redact attachment content — what you attach is what is sent. Attach files accordingly, particularly where a document contains personal, customer, or regulated data.
• NetSuite requests using your existing session: export and preview features request NetSuite URLs (including report/search/workbook exports, attachment/media URLs, and hotprint URLs). Some export flows replay NetSuite form data to generate files, which may include report parameters and other NetSuite form fields.
• AI Lessons (optional, opt-in, SuiteHUD AI only): clicking the brain icon and confirming sends the current conversation's transcript, plus the title/description/model preference/"what went well"/"what didn't go well" you provide, through SuiteHUD backend to Opus (using your own Anthropic key) to draft a reusable lesson. You can comment to ask for revisions before signing off; only the final lesson you sign off on (title, trigger phrase, lesson text, tool/model guidance) is saved to your account. The transcript and any in-progress revisions are discarded immediately after sign-off, cancellation, or a 30-minute idle timeout — none of it is written to durable storage. Once saved, invoking a lesson with its /trigger sends that lesson's guidance (not the original transcript) along with your message for the rest of that conversation.
• Running a playbook (AI Lessons, optional, opt-in): a lesson you saved as a step-by-step playbook can be *run* — the extension walks you down its checklist, and SuiteHUD backend keeps a record of that run so you can pause it, resume it after a reload, or pick it up on another device. A run record is a record of what happened, kept alongside a copy of the playbook it is walking. Both parts are described below, because the second one can contain text you saved into the playbook itself.
  • A copy of the playbook, frozen at the moment you pressed start. A run stores the checklist as it stood then — every step's title, instruction, rules and branch conditions — so that editing the lesson mid-run cannot renumber or rewrite the steps you are standing in. If a step carries a pinned query (the tool and query text saved by "Pin this query", up to 8,000 characters) or a default answer (saved by "Use as default"), those are part of the playbook and are therefore part of the copy. A value you supplied during an earlier run becomes playbook content in exactly this way, and only if you explicitly pin it. Because the copy is frozen, editing or removing a pinned query or default answer from the lesson afterwards does not change the copies already held by runs that started before the edit; those copies go when the run is deleted, on the schedule under "Retention" below.
  • What actually happened, one entry per step taken: the step's identifier, its outcome from a fixed list (started, done, self-fixed, sent back, failed, skipped, waiting, confirmed), the names of any tools the step used — names only; anything that is not a tool-name-shaped value is rejected — how long the step took in milliseconds, and when it happened.
  • The state of the run itself: which lesson and which revision of it, the run's status (running, waiting on you, waiting on a condition, paused, completed, ended early, failed, abandoned), which step you are on, a short note of up to 200 characters written by the extension saying what the run is waiting for, a progress count with its unit (for example 12 of 40 "invoices" — the unit is a short label of up to 40 characters, also written by the extension), the identifiers of the conversation and browser session it belongs to, and the times it started, last changed and finished.
  • What a run never contains: the conversation transcript, the results a step got back from NetSuite, and any NetSuite record or field value a step read or wrote — none of that is stored with the run, and none of it is written to SuiteHUD logs. Nor does a run keep, as text, the input a step ran with or the answer you gave it on that run. Where the panel needs to know whether a step got *the same* input or answer as last time — which is what lets it offer "Pin this query" or "Use as default" in the first place — the extension sends the value with that step's update and SuiteHUD backend immediately converts it to a keyed hash (HMAC-SHA-256, salted per account and truncated) inside that same request. The original is dropped there and then: it is never written to storage and never echoed back to any client. The same query run by two different people produces two different hashes, and a hash cannot be turned back into the text it came from. The one way such a value is kept as readable text is the pinning described above, which is your own explicit act and lives in the playbook.
  • Who can see a run: a run is scoped to your own account. It is not shared with teammates, and your enterprise administrator cannot list or open it — where your company funds your AI usage, administrators see AI Lessons usage counts only, as described under "Your enterprise administrator, for cost only" below.
• Publishing a lesson (optional, opt-in, two separate flows): a lesson you've already saved stays private to you unless you explicitly click Publish.
  • Publish to your enterprise team: sends a snapshot of the lesson (title, trigger, description, lesson text, tool guidance, model preference — never your personal "went well/poorly" notes, never usage history) to one or more teammates you choose, via the same team-sharing mechanism already used for shortcuts and report packages. The recipient must explicitly accept it; accepting creates an independent copy in their own account, not a link back to yours.
  • Submit for public review: sends the same kind of sanitized snapshot to SuiteHUD for admin review. Before sending, you're shown exactly what will be submitted and can edit it. Nothing becomes publicly visible until a SuiteHUD admin approves it; if approved, it appears on the public SuiteHUD AI lessons page and can be downloaded by other SuiteHUD users, who each get their own independent copy. Editing your private lesson afterward does not change what's already public — you'd need to re-submit (and get re-approved) to update it. You can withdraw a pending or published submission at any time.
• AI Memory (optional, opt-in, SuiteHUD AI only): When enabled, SuiteHUD AI may automatically save short notes about recurring patterns in your NetSuite setup, such as custom field usage or workflow preferences, to help future conversations on your account. This avoids needing to re-explain the same context every session, which also reduces token usage and cost for repeat tasks over time. Notes are limited to a fixed set of categories that exclude financial figures, transaction details, and customer or vendor identifying information. Any such content is stripped before a note is saved. Memory is scoped to your individual SuiteHUD account and is never shared with other users at your company. You can view and delete any memory note at any time. You can also turn AI Memory off entirely, which stops new notes without deleting existing ones. Unlike AI Lessons, this feature never sends your conversation transcript anywhere — only the short note text itself.
• Voice input (browser speech recognition — SuiteHUD receives nothing): when you tap the microphone in the SuiteHUD AI chat box or the HUD bar ask box, the extension asks your browser to transcribe what you say, using the browser’s built-in Web Speech API. Two things are worth being precise about:
  • Where the audio goes. SuiteHUD does not receive it, does not proxy it, and does not store it — not locally, not on SuiteHUD backend. The extension asks your browser for a microphone stream and hands it straight to the browser’s own recognition service. In Chrome’s default configuration that service is Google’s, and the audio is sent there for transcription. Chrome 139 and later can also recognize speech on your device with nothing leaving the machine; SuiteHUD requests that mode whenever the browser reports it is available, but it depends on your Chrome version and installed language pack and cannot be guaranteed. What Google does with audio it receives is governed by Google’s terms and privacy policy, not by this one.
  • What SuiteHUD does with the result. The transcribed words are written into the chat box, where you can edit or delete them like anything you typed. Nothing is transmitted at that point. If you then press Send, the text travels the ordinary SuiteHUD AI path described above — to SuiteHUD backend and on to Anthropic — and is indistinguishable from a typed message. If you do not send it, it goes nowhere.
  • The extension also opens a second, parallel microphone stream purely to animate the level meter inside the microphone icon. That stream is analysed in your browser frame by frame and is never recorded, buffered, or transmitted anywhere. Both streams are closed the moment dictation stops, you send the message, you press Escape, or you close the panel — whichever comes first — so your browser’s recording indicator goes out.
  • The first time you ever start dictation, SuiteHUD shows a one-time notice saying that your browser’s speech service processes the audio. No microphone permission is requested until you tap the microphone yourself; the prompt you see comes from Chrome, against your NetSuite domain.
• Voice input on/off flag (chrome.storage.local, synced): a single flag (acc_ai_voice_enabled_v1) recording whether you want the microphone offered at all. Voice input is on by default — no audio is captured until you tap the microphone, so the default only controls whether the button is there. Like your other AI settings, this flag syncs to your SuiteHUD account so it carries across devices. Turning it off removes the microphone from both chat boxes entirely.

Data Minimization

• NetSuite page context attached to SuiteHUD AI messages is sanitized before sending: common sensitive query parameters (for example, token/session/csrf/auth-like parameters) are removed from URLs, and obvious token patterns, emails, and session values are redacted.
• File attachments are the one part of a SuiteHUD AI message that SuiteHUD does not sanitize, because their content is chosen by you rather than collected by the extension — see the attachment section above. What SuiteHUD does limit is volume and scope: 5 files and 20 MB per message, a 100 KB per-file text cap, a fixed list of accepted file types, and — for Office files — extracting only body text and cell values rather than sending the original file.
• Attachment content is never written to extension storage, never synced to your SuiteHUD account, and never included in AI Lessons or AI Memory. It is dropped from the in-page conversation as soon as the answer completes.
• Notes and Tasks identify a page by an account/record/path key rather than by its contents. Record titles, party names, amounts and other field values are never sent by those features, and SuiteHUD backend treats the key as an opaque string it does not parse. A page whose key would exceed the length limit is refused rather than shortened, because a shortened key could merge two different pages.
• Note, task and reply text is not sanitized or redacted, for the same reason attachment content is not: it is written by you rather than collected by the extension. What SuiteHUD limits is scope — 2,000 characters per note, task or saved prompt, a maximum of 20 mentioned people (or the single *team mention), and no mentions or assignments at all outside Enterprise plans.
• SuiteHUD does not read your NetSuite user record. A task's due date is stored as a plain calendar date, which needs no time zone and no reference to your user preferences.
• Saved chat transcripts are text only. Attachments, images, tool inputs and tool results are replaced with short stand-ins before the transcript is stored, so a saved conversation carries what was said and not the data that rode along with it. NetSuite page context is replaced the same way, except on enterprise seats where recording has been required by an administrator — see the exception under "SuiteHUD AI chat history" above.
• SuiteHUD refresh tokens, license cache data, service-worker session state, export blobs, MCP credentials, and NetSuite auth/session values are not part of the user-data sync dataset.
• The extension removes legacy local MCP API/OAuth secret keys and does not intentionally persist Anthropic API keys or NetSuite OAuth tokens in browser storage.
• Enterprise-sharing pending items are stored locally for UI purposes only and are not included in the user-data sync dataset.
• AI Lessons drafting transcripts are used transiently to produce a lesson and are discarded immediately afterward — only the resulting lesson (not the conversation it came from) is persisted.
• A playbook run's record of what happened is structure rather than content: step identifiers, outcomes from a fixed list, tool names, timings and status. The two values that would otherwise be content — the input a step ran with and the answer you gave it on that run — are reduced to per-account keyed hashes inside the request that carries them, and are kept in no other form. Tool entries are accepted as names only, from a restricted character set, because free text there would defeat the hashing. This minimization applies to the run's event trail; it does not apply to the copy of the playbook the run is walking, which holds whatever you saved into that playbook, including a pinned query or default answer. The playbook's own limits apply to that copy: 60 steps, 2,000 characters of instruction per step, 8,000 characters of pinned query, and 64 KB of checklist in total.
• AI Memory notes are restricted to a fixed, closed set of categories (custom field usage, workflow preferences, UI quirks, terminology) that exclude financial figures, transaction details, and customer/vendor/employee-identifying information. Sensitive content is stripped from a note before it is saved, and a note with nothing meaningful left afterwards is discarded rather than saved as a placeholder. Two independent passes apply, and they are deliberately complementary rather than identical:
  • In the extension, before the note is sent: dollar amounts, any run of six or more digits (which covers account, routing and internal ID numbers), government-ID-shaped number patterns, and email addresses are replaced with placeholders.
  • On SuiteHUD backend, on whatever it receives: credentials, access tokens and similar secrets, email addresses, phone numbers, and government-ID-shaped numbers are stripped again. This pass exists so that a note arriving from something other than the SuiteHUD extension — an older version, or any other client — is still filtered before it reaches storage. It is narrower on plain numbers than the extension's pass, because a rule broad enough to catch every number would remove the NetSuite specifics that are the substance of a useful note.

Retention

• Sync settings, local extension data, and NetSuite-page localStorage values persist until you change/clear them or uninstall the extension.
• Session-only extension state is cleared when the browser session ends.
• Enterprise-sharing pending items remain in local extension storage until refreshed, accepted, declined, sign-out, or enterprise-access removal. Backend pending-share records are designed to be transient and are deleted on accept/decline, with backend TTL expiry as a fallback.
• Export history retention in IndexedDB is bounded:
  • package export entries are capped to the newest 10
  • notice entries are capped to the newest 50
  • stored export file blobs are removed after download or when superseded by newer runs
• SuiteHUD AI conversation history is held in memory in the current NetSuite page for chat continuity and is sent to SuiteHUD backend/Anthropic with each SuiteHUD AI request while the page session is active. A copy is kept in the page's sessionStorage so the conversation survives a reload, and the browser discards it when the tab closes.
• Separately from that in-page copy, and unless the conversation is in Incognito, a text transcript is stored on SuiteHUD backend against your account — see "SuiteHUD AI chat history" above. Stored transcripts are dropped automatically after 90 days without activity in that conversation. You can delete a single conversation, or all of them, at any time from the History view or from Settings → SuiteHUD AI; deletion is immediate and is not recoverable. Turning Incognito on stops new turns being saved but does not delete transcripts already stored — delete those yourself if you want them gone.
• Notes and tasks are stored on SuiteHUD backend until they are deleted or expire, and both follow the same schedule. An open note or task is deleted after 90 days without activity; opening it and choosing Keep resets that clock, and the Expiring list shows what is approaching its deadline. Resolving a note or completing a task starts a shorter 30-day countdown to permanent deletion; within that window it can be restored by the thread's author, the person it was assigned to, or whoever marked it done. On an Enterprise plan, a thread with more than one participant has its deletion clock paused while the team is inactive and resumed when the team becomes active again, so such a note can exist for longer than 90 calendar days without being deleted. A note that is yours alone is never paused. Deleting one yourself removes it immediately. A task's due date, assignee and saved prompt are deleted with the task. The local index and notification-dedupe caches described above are erased on sign-out, on loss of Pro access, and on enterprise team deactivation.
• File attachment content is retained only for the message it was attached to. Once that answer completes, the attachment is replaced in the conversation with a short label, so follow-up messages in the same conversation no longer carry the file. The extension keeps no copy anywhere else.
• AI Lessons drafting transcripts and in-progress revisions are discarded immediately on sign-off, cancellation, or after 30 minutes of inactivity. Saved lessons persist on SuiteHUD backend until you delete them.
• Playbook runs are kept on SuiteHUD backend so you can resume them, and are swept on a schedule: a run left open with no activity for 30 days is marked abandoned, and a run that is finished or abandoned — its step entries and its frozen copy of the playbook with it — is deleted 180 days after it stopped. Those two periods are the standard settings SuiteHUD operates; they are configurable, so SuiteHUD may change them, and a change would be reflected here. Independently of the sweep, you can abandon a run yourself at any time from the AI panel, and deleting the playbook deletes its runs, their step entries and their frozen copies along with it.
• A lesson submitted for public review persists in the moderation queue until an admin approves or rejects it, or you withdraw it. An approved lesson stays visible on the SuiteHUD AI page until you withdraw it or it's removed by SuiteHUD. Edits to your private lesson after publishing don't change the live public version — only a re-submission and re-approval does.
• AI Memory notes persist on SuiteHUD backend, scoped to your account, until you delete them individually or turn AI Memory off. Turning it off stops new notes from being created; it does not retroactively delete notes already saved unless you delete them yourself.

Your Choices

• SuiteHUD AI is off by default.
• Enabling SuiteHUD AI requires explicit consent during its setup flow; NetSuite OAuth authorization is a separate, optional step within that flow.
• AI Lessons is off until you confirm the first "Learn from this conversation" prompt; you can view and delete every lesson you've created from the lessons management view in SuiteHUD AI at any time.
• Publishing a lesson (to your team or publicly) is a separate, explicit per-lesson action — saving or editing a lesson never shares it on its own. You can withdraw a team-shared or publicly published lesson at any time; withdrawing a public one removes it from the SuiteHUD AI page but does not retroactively delete copies other users already downloaded.
• AI Memory is off by default; you turn it on yourself from the lessons management view in SuiteHUD AI or from the SuiteHUD settings panel (both control the same setting). The on/off switch syncs to your SuiteHUD account, the same way your other settings do, so it carries over to other devices you're signed into. You can view and delete every memory note at any time, and you can turn it off again whenever you want.
• File attachments are per-message and entirely your choice. SuiteHUD never attaches anything on its own, and staged files can be removed individually before you send. Starting a new conversation clears the saved chat, including any attachment content still held for an in-flight message.
• Chat history is on by default, and there are three ways to control it: Incognito for the conversation you are in (the ⋯ menu in the AI panel, or the checkbox in the History card — an "Incognito" pill in the header shows when it is on); Incognito by default in Settings → SuiteHUD AI, which applies to every new conversation and syncs across your devices; and deletion, either one conversation at a time or all at once. Starting a new chat can only keep or increase privacy — it never silently resumes saving a conversation you had paused.
• Notes and Tasks are Pro/Enterprise features and do nothing until you open the panel and post something. A note with no mentions is visible only to you; mentioning or assigning someone is an explicit act, and one that SuiteHUD confirms with you first when SuiteHUD AI is the one proposing it. You can delete your own notes, tasks and replies at any time, and resolve or restore a thread you authored, were assigned, or marked done. Your enterprise administrator has no ability to read, edit, or delete them — an administrator who has been mentioned or assigned on a thread sees it as an ordinary participant, exactly like any other teammate, and being an administrator grants no additional access.
• A saved AI prompt on a task never runs on its own — there is no scheduler and no background execution. It runs only when you click it, and a prompt that would change a NetSuite record still has to clear the same confirmation as a request you typed yourself.
• Voice input is on by default, but nothing is captured until you tap the microphone — and the first tap is what triggers your browser’s own microphone permission prompt, which you can refuse or revoke at any time in Chrome’s site settings for your NetSuite domain. You can also remove the microphone entirely from Settings → SuiteHUD AI → Voice input, and on non-Chromium browsers, which have no Web Speech API, it never appears at all. Dictation stops when you tap the microphone again, press Escape, send the message, start typing, or close the panel. If your company administers SuiteHUD for your organization, they can switch voice input off for everyone; when they have, the setting shows as locked and names them.
• Logging record actions to Notes is off by default. With it off, SuiteHUD offers a one-click button after an action runs instead of writing to the record on its own.
• You can turn SuiteHUD AI off at any time from the popup or settings panel.
• You can dismiss individual export notifications or clear all notifications.
• You can unsubscribe from SuiteHUD email with one click from any message. Task reminders, product email and promotional email are separate categories, so switching off task reminders leaves the rest untouched, and vice versa.
• Enterprise users can accept or decline shared items. Declining removes the pending share without adding the item to local data.
• You can sign out of licensing to clear stored licensing session data.
• Referral invitations go out only when you type an address and press Send. Your referral code and link are shown for you to share however you like; doing nothing with them sends nothing to anyone.

Third Parties

• NetSuite: used for page functionality and export/preview fetches.
• SuiteHUD backend (suitehud.com): used for connect/login, install registration, license verification, settings sync, SuiteHUD AI proxying/credential custody, and subscription session creation.
• Enterprise teammates shown by SuiteHUD backend: for enterprise sharing, the extension may receive teammate profile fields such as email, first name, last name, role, and whether an invite is still pending sign-in. The same sharing mechanism is used if you publish a lesson to your team, and the same roster backs the @mention and task-assignee pickers in Notes and Tasks.
• Your enterprise administrator, for cost only: where a team pays for SuiteHUD AI usage, the team's administrators can see per-person cost and usage in their admin console — your email address, your role, how many AI requests you made, what they cost, which models were used, your remaining balance and allocation, and whether you ran out of credits. They cannot see any conversation content: not your questions, not the answers, not your page context, not your notes or tasks. The same applies to AI Lessons, where administrators see usage counts only and never lesson titles or text. If your company does not fund your usage, none of this applies.
• Teammates you mention or assign in Notes and Tasks: mentioning a teammate on a note or reply, or assigning a task to them, lets that person read that thread — your text, every reply on it, and the NetSuite record it is attached to — and raises a desktop notification for them. *team does this for everyone at your company. This is the one SuiteHUD feature that deliberately makes content you write visible to other people; it happens only on threads where you added a mention or an assignee.
• Other SuiteHUD users and the public SuiteHUD AI website page: if you submit a lesson for public review and a SuiteHUD admin approves it, its title, description, trigger, lesson text, tool guidance, and model preference become visible on the public SuiteHUD AI page and downloadable by other SuiteHUD users. Your personal notes and usage history are never included.
• People you invite through Referrals: the address you enter receives one invitation email from SuiteHUD carrying your referral code. It is sent by SuiteHUD backend, not from your own email account, and it tells the recipient nothing about your NetSuite account or your use of SuiteHUD beyond the fact of the invitation.
• Anthropic: for SuiteHUD AI, Anthropic receives your messages, conversation history, NetSuite page context, MCP tool configuration, and any files you attach to a message (as images, PDF document content, or extracted text — see "File attachments in SuiteHUD AI" above) through SuiteHUD backend. The short title SuiteHUD generates for a saved conversation is also produced by Anthropic, from that conversation's own content. What Anthropic does with data it receives is governed by Anthropic's own terms and privacy policy, not by this one; SuiteHUD does not make any commitment on Anthropic's behalf about retention or model training. For AI Lessons (opt-in), Anthropic's Opus model also transiently receives the conversation transcript and your lesson notes when you use the "Learn from this conversation" flow, using your own Anthropic key. For AI Memory (opt-in), once you save a memory note, its short text (not your conversation transcript) is included as part of the message content sent to Anthropic on future SuiteHUD AI turns, the same way an active AI Lesson's text is. If you ask SuiteHUD AI about your Notes and Tasks — to catch up on a record, or to find what you have been mentioned on — the note, task and reply text it reads, and the authors' names, become part of that conversation and are therefore sent to Anthropic, and saved in your chat history unless the conversation is in Incognito.
• Your browser’s speech service (Google, in default Chrome): if you use voice input, the audio your microphone captures is sent by your browser — not by SuiteHUD — to its speech recognition service to be transcribed. SuiteHUD never receives, stores or proxies that audio, and has no visibility into what the service does with it; that is governed by your browser vendor’s terms and privacy policy. Where your Chrome build supports on-device recognition, SuiteHUD asks for it, and the audio then never leaves your machine. You can avoid this entirely by not using the microphone, or by turning voice input off in settings.
• NetSuite MCP/SuiteTalk services: used by SuiteHUD AI after your OAuth authorization to read or write NetSuite records on your behalf through the NetSuite MCP endpoint.
• Payment portal pages: opened from backend-generated checkout/portal URLs.

Permissions and Domain Access

• https://*.app.netsuite.com/*: required to run SuiteHUD features inside NetSuite.
• https://suitehud.com/* and https://*.suitehud.com/*: required for connect flow, licensing, subscription management, settings sync, enterprise sharing, and SuiteHUD AI backend proxying.