This Privacy Policy applies to the Cornerstone Guide browser extensions, including the Cornerstone Guide Creator and the Cornerstone Guide Player (collectively, the “Extension”), which provide interactive, in-context guided walkthroughs inside web applications. This is a complete, standalone privacy policy for the Extension: the sections below describe what user data the Extension does and does not collect, how it is handled and used, how it is stored, and how it is shared. This Extension section governs the Extension’s data practices. The broader Cornerstone Client Portal Privacy Policy that follows further down this page applies to Cornerstone’s websites and hosted software, not to the Extension, and is provided for reference only.

Summary of Data Handled by the Extension

The single purpose of the Extension is to deliver in-context guided walkthroughs. The following table states how the Extension treats each category of personal or sensitive user data defined by the Chrome Web Store User Data policy.

Data category	How the Extension handles it
Personally identifiable information (name, email, address, etc.)	Not collected from web pages. A user identifier is obtained from the organization’s SSO session only when an administrator enables PII tracking, and is used solely to attribute guide analytics.
Authentication information & passwords	Collected at sign-in. When you sign in to the Cornerstone Guide extension, the Extension collects the username (email address) and password you enter into the extension’s own sign-in form only (or your Single Sign-On credentials, where SSO is used). It does not collect credentials or data you enter into the host web application. This credential data is collected only to authenticate you to the Cornerstone Guide service. It is sent over encrypted HTTPS; the password is not retained after login (only a session token is stored locally and cleared on logout); and it is never sold or shared with third parties. For automated walkthrough steps that demonstrate a sign-in, the Extension may enter a value into a field — which may be a password field — using credentials your administrator pre-configured for that guide, used only to perform the demonstrated step. The Extension does not read, capture, log, or transmit passwords that you type into third-party web pages for your own use. See the “Passwords and Login Credentials” section below for full detail.
Form data / keystrokes	Not collected. The Extension does not read or record values typed into any form field.
Financial and payment information	Not collected.
Health information	Not collected.
Web browsing activity	Not collected. The Extension does not track the pages you visit or your activity across sites.
Website content and resources	The Extension reads only the structural attributes of elements you author or that host a guide (such as element type, id, and CSS locators) to position guidance. Page content is not stored or transmitted for any other purpose.
User-provided content & personal communications	Not collected.
Guide interaction data (guide views and completions)	Collected to provide guide analytics. Recorded anonymously unless an administrator enables PII tracking, in which case it is associated with the SSO user identifier.

1. Data Collection

The Extension does not collect personal data from the browser or from the web applications you visit, does not read or scrape any user identity from those pages, and does not track your browsing activity across pages. The Extension maintains its own separate session and identifies a user only through that session.

By default the Extension does not collect any personal or user-identifiable data. A user identity is associated with activity only when PII tracking is explicitly enabled by the customer’s administrator. In that case, the user’s identity is obtained through the organization’s Single Sign-On (SSO) session, which is configured by the customer’s web application administrator — not read from the page content. Even when enabled, this identity is used only for guide analytics and is recorded solely when a user views or interacts with a guide associated with the Extension. When PII tracking is disabled, guide interaction data is recorded anonymously and no user-identifiable data is collected.

Login credentials the Extension does collect. The Extension has its own sign-in. When you log in, the Extension collects the username (email address) and password that you enter into the Cornerstone Guide extension’s own sign-in form only (or your Single Sign-On credentials, where SSO is used). These login credentials are collected for the sole purpose of authenticating you to the Cornerstone Guide service. The Extension does not collect the username, password, or any other credentials or data that you enter into the host web application’s own login or form fields. Full details of how this credential data is used, handled, stored, and shared are described in the “Passwords and Login Credentials” section immediately below.

The Extension does not collect keystrokes, the values entered into form fields for your own use, financial information, or health information from the pages you visit.

Passwords and Login Credentials

Because the handling of passwords is important, this section describes exactly how and when the Extension uses password and login information.

a) Signing in to the Cornerstone Guide service. To use the Extension, you sign in through the Extension’s own sign-in form using your login credentials — an email address (username) and password, or your Single Sign-On (SSO) login where SSO is configured.

• What we collect: the Extension collects the username (email) and password you enter into the Cornerstone Guide extension’s own sign-in form only. It does not collect credentials or any other data you enter into the host web application.
• How we use it: these credentials are used only to authenticate you to the Cornerstone Guide service and establish your session. They are not used for any other purpose.
• How we handle and store it: credentials are transmitted over an encrypted HTTPS/TLS connection. The password is not stored or retained after authentication; only a session/access token is stored locally in the browser and is cleared on logout.
• How we share it: the collected username and password are never sold, rented, or shared with any third party, and may be disclosed only where required by applicable law.

The Extension maintains its own session and does not use or depend on your credentials for the underlying host web application.

b) Automated (“auto-play”) guide steps. A guide may include automated steps that demonstrate a workflow, including a sign-in step. When a guide author has configured such a step, the Extension may enter a value into a field on the page — which may be a password or login field — using credentials that the customer’s administrator has pre-configured for that specific guide. These pre-configured values are used only to perform the demonstrated step within that guide and for no other purpose.

c) Passwords you type for your own use. When you type your own password into a login or form field on a web page you are visiting, the Extension does not read, capture, log, store, autofill, or transmit that password or its value. While authoring a guide, the Extension may recognize that a field is a password/login field (from its type and locator attributes) in order to attach a guide step to it, but it does not access the value entered into that field. Such password values never leave the page and are never sent to Cornerstone’s servers.

2. Data Handling and Use

Collected data is used solely to deliver interactive guided walkthroughs and to report guide usage analytics to the customer’s administrators. Data is never used for advertising, profiling, or any purpose unrelated to the Extension’s single purpose of providing in-application guidance. Data is processed in direct support of this functionality and is not sold or used for creditworthiness or lending purposes.

3. Data Storage and Retention

Session data is stored locally in the browser using the Chrome storage APIs and is cleared on logout. Where guide usage data is collected (only when the PII setting is enabled), it is stored on Cornerstone’s servers and is retained only as long as necessary to provide guide analytics, in accordance with the agreement between Cornerstone and the customer Organization. Details of how data is encrypted in transit and at rest are described in the “Data Security and Secure Handling” section below.

4. Data Sharing

Data collected by the Extension is not sold, rented, transferred, or shared with any third parties. Guide usage reports are accessible only to the customer’s own organization administrators. Data may be disclosed only where required to comply with applicable law or valid legal process.

5. Data Security and Secure Handling

The Extension handles all user data securely. Any user data transmitted between the Extension and Cornerstone’s servers — including authentication during sign-in and guide usage data — is sent only over encrypted connections using modern cryptography (HTTPS / TLS). The Extension does not transmit user data over unencrypted (HTTP) connections.

User data that is retained on Cornerstone’s servers is stored at rest using strong, industry-standard encryption (such as AES). Data held locally in the browser (for example, session state via the Chrome storage APIs) is limited to what is needed for the Extension to function and is cleared on logout. Cornerstone applies commercially reasonable physical, administrative, and technical safeguards to protect user data against unauthorized access, disclosure, or loss.

6. Limited Use Disclosure

The Extension’s use of information received from its permissions and from users complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. Specifically:

• Allowed use: Data is used only to provide and improve the Extension’s single purpose — delivering in-context guided walkthroughs and reporting guide usage analytics.
• Allowed transfer: Data is not transferred to third parties, except as necessary to provide the single purpose, to comply with applicable law, to protect against security threats, or in connection with a merger, acquisition, or sale of assets with appropriate notice.
• No advertising: Data is never used or transferred for personalized, retargeted, or interest-based advertising.
• No human reading: No human reads user data, except with the user’s consent, for security purposes, to comply with law, or where the data has been aggregated and anonymized for internal operations.

7. Your Choices, Consent, and Data Deletion

Collection of user-identifiable guide interaction data occurs only when the customer’s administrator explicitly enables PII tracking; it is off by default and no user-identifiable data is collected unless it is turned on. You can stop the Extension from associating activity with your identity at any time by logging out, which clears the locally stored session data. To request access to, correction of, or deletion of any data associated with your in-extension identity, contact your organization’s administrator or Cornerstone’s Data Protection Officer at DPO@csod.com.

Contact

For any questions about the Extension’s data practices, contact Cornerstone’s Data Protection Officer at DPO@csod.com.