What we touch, what we send, and where it goes.

• A PDF you explicitly select. The extension never scans your disk or opens a file on its own.
• The blank or active Mitchell Connect Create New Job form.
• Rendered Mitchell Estimating rows and reviewed draft controls, used to compare and stage parsed PDF lines.
• Only the repaircenterca.mymitchell.com/connect and /estimating pages declared in the manifest.
• Text extracted from the PDF after you select it for import.
• In an intake-enabled build, customer forms submitted from the shop tablet and the staff queue used to claim, review, release and complete them.

This is the distinction that matters most, so it is stated plainly.

• The PDF file itself never leaves your computer. Text is extracted in the browser using PDF.js, and the PDF bytes stay in the content script.
• The extracted text does leave. Selecting a PDF sends that text — not the file — through the Bowstack AI service running on Google Cloud Run, to OpenAI, for parsing into structured fields.

The service processes the text transiently. It does not intentionally log request bodies or parsed results, does not persist claim content, and sets store: false on the API request. Infrastructure access logs may retain request metadata such as timestamp, status and latency. The OpenAI API key is held in Google Secret Manager and is never returned to the extension.

OpenAI states that data sent to its API is not used to train its models unless the API organization opts in. Bowstack has not opted in. OpenAI's default abuse-monitoring logs may retain customer content for up to 30 days unless the project is approved and configured for Zero Data Retention.

• No analytics or telemetry of any kind.
• No advertising, profiling, or remote OCR.
• No cookie access and no network interception.
• No access to your Mitchell credentials. The extension works only inside the session you are already signed in to.
• No persistent storage of selected PDFs or their parsed drafts.
• No automatic Save & Next, and no automatic job submission.
• No automatic estimate Commit or Mark as Final.

Parsed values sit in memory-backed chrome.storage.session, keyed to the current tab, so Contact data can carry through to Vehicle and Insurance across route changes and background-worker suspension.

Closing the tab, restarting the browser, or reloading the extension clears that draft. It is never written to persistent local or sync storage.

Where a shop has configured the optional tablet intake, the tablet sends structured customer, contact, vehicle, payment, police-sticker and request information to a separate intake service. That service stores the submission so authorised staff can retrieve it from another device, prevents duplicates through idempotency keys, and records queue status changes. Printable PDFs are generated on demand from the saved record.

The managed deployment stores intake records in a dedicated Firestore database in Montréal, Canada. Records become eligible for deletion 30 days after submission; completing a record resets that to 30 days after completion. Firestore performs TTL deletion typically within 24 hours of eligibility, but does not guarantee a deletion deadline.

Kiosk credentials can create records only. Separately authorised staff credentials can list, print, claim, release and complete them. The extension stores the staff intake access code and workstation label in chrome.storage.local; it does not store queue records in the browser. System notifications contain only an aggregate count — never names, contact details, vehicle details, notes or claim information.

In full, and no others:

• Google Cloud Run — hosts the Bowstack AI service that relays extracted text.
• OpenAI — performs the extraction from the text.
• Google Cloud Firestore (Montréal, Canada) — stores intake records, only where the optional intake feature is enabled.

Data is not sold, not used for advertising or profiling, and not made available for human review by the developer.

Bowstack's use of information received from Chrome APIs and from the Mitchell Connect page adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Data is used only to provide the PDF review, customer-intake queue and form-filling features you invoke. Transfer to OpenAI occurs only to provide field extraction, after you select a PDF.

Collision documents contain personal and insurance information, and your shop — not Bowstack — is the organisation accountable for it under applicable privacy law. Use production documents only where authorised, follow your own retention and access policies, and confirm that use of browser automation is permitted under your Mitchell agreement.

Because extracted text is processed outside Canada under the current configuration, Alberta shops should review their obligations under the Personal Information Protection Act, including the s.13.1 notification duty and the s.6(2) requirement that written policies name the countries involved. This is general information, not legal advice; obtain your own.

Questions about this policy, or a request concerning data handled by the extension, can be sent to info@bowstack.ca.