Charm published a privacy policy for its fraud prevention browser extension, distributed through the Chrome Web Store, setting out how the extension handles bank data. It runs only on pages in a permitted list that the customer sets in the Charm admin portal and Charm enforces, and on those pages it reads the case, customer, account and transaction details on screen. IP addresses are trimmed and hashed daily, Charm says it takes steps to filter identifiers out of AI tool inputs while not guaranteeing their removal, and the page data is not used for advertising, profiling or anything unrelated to the service.
Our readA browser extension that reads case and account screens inside bank tools needs a written scope boundary before GLBA vendor review signs off, and this gives privacy and security teams one to test the deployment against. The AI input filtering is a best efforts commitment, so reviewers should assume customer data can reach the AI tools.