Privacy Policy

1. Who this policy covers

The oyyo browser extension ("the extension") is a Chrome side-panel tool for commercial insurance brokers and underwriters. It connects to your own oyyo tenant — the company-scoped oyyo instance your agency licenses, at https://<tenant>.oyyo.ai — and helps you search your agency knowledge base, ask an AI assistant about the page or submission in front of you, clip page content into the knowledge base, and auto-fill carrier portal forms from an existing submission's data.

This policy describes what the extension itself collects and transmits. Once data reaches your tenant it is governed by your agency's agreement with oyyo and by your agency's own policies.

2. Where your data goes

All network traffic from the extension goes to your own oyyo tenant on *.oyyo.ai (including cx.<tenant>.oyyo.ai) and nowhere else. The extension contacts no third-party servers. It ships with no analytics SDK, no advertising or tracking pixel, no error-reporting vendor, and no content delivery network — every script, style, and font it uses is bundled inside the extension package.

The AI assistant ("Ask oyyo") is served through your tenant. When you ask it a question, your question and the page context you chose to share are sent to your tenant, which handles the model call. The extension does not talk to a model provider directly.

3. What the extension collects

Below are the Chrome Web Store data categories, answered honestly for this extension. Where a category applies, we say exactly when the data leaves your browser and what is done to it first.

3.1 Website content

Collected — when you invoke a feature. When you clip a page, or ask the assistant about the current page, the extension serialises the readable content of that page to markdown and sends it to your tenant. This includes the values of the form fields on the page — every non-password input — because the purpose of the feature is to capture what is actually on the submission, the quote, or the email in front of you.

This happens only for an action you took. The extension does not passively read or stream pages you visit.

3.2 Personally identifiable information

Collected — as part of the page content above. Carrier forms and broker emails contain insured names, business and home addresses, phone numbers, email addresses, and Federal Employer Identification Numbers (FEINs). When you clip such a page or ask about it, those values are included in what is sent to your tenant.

Before anything leaves your browser, a scrub runs on your machine and masks:

• Social Security numbers
• Credit-card numbers (Luhn-validated, to avoid masking ordinary long numbers)
• Bank routing numbers
• Labelled dates of birth, driver-licence numbers, and medical record numbers

Names and email addresses are deliberately not masked. Drafting correspondence about a submission requires knowing who it is about and who to write to. We would rather tell you this plainly than claim an anonymisation we do not perform.

3.3 Health information

Collected — as part of the page content above. Insurance pages can carry health information: workers' compensation claims, life and health applications, loss runs describing injuries. If you clip such a page, its content is sent to your tenant.

The client-side scrub masks medical record numbers, ICD codes, and labelled injury or diagnosis fields before egress. It is a mitigation, not a guarantee that no health information can reach your tenant — free text describing an injury may survive it. Treat your tenant as a system that may hold this data, and handle it accordingly.

3.4 Financial and payment information

Collected — as part of the page content above. Premiums, payroll figures, revenue, and loss history are exactly what these pages contain, and they are included in clipped or asked-about content.

Credit-card numbers and bank routing numbers are masked before egress. Separately, the auto-fill engine refuses to fill any field it classifies as a Social Security number, a payment-card number, a bank routing number, or a date of birth — those must be typed by a human.

3.5 Authentication information

Not collected. The extension never reads, stores, or transmits a password.

• Password fields are excluded from page extraction.
• The page serialiser used by the AI assistant strips credential fields: passwords, one-time passcodes, 2FA codes, security answers, and any field the site itself marks autocomplete="current-password", "new-password", or "one-time-code".
• The auto-fill engine will not fill a credential field.
• Your oyyo identity is an httpOnly session cookie held by the browser. No authentication token is ever written to extension storage.

3.6 Personal communications

Collected — when you invoke a feature. If you clip, or ask the assistant about, an email thread open in your webmail, the content of that email is sent to your tenant, subject to the same client-side scrub described above.

3.7 Web history

Partially — and never as a browsing history. The extension reads the URL of the active tab so it knows which carrier portal you are on and can offer you the matching submission. It does not log or transmit a record of the pages you visit.

• A full page URL is sent to your tenant only as part of an action you took — a clip, a question, or a fill — because the action needs to record what it acted on.
• Anonymous usage telemetry records only the site's registrable domain (for example, carrier.com) — never the full URL, never a query string, and never the value of a field.

3.8 User activity

Collected — only when you start a recording. The extension has a user-initiated "record a flow" feature that captures the sequence of interactions on a portal — which control you interacted with, in what order — so that the steps can be replayed later against a different submission.

The recorder is value-blind by construction: it records that a field was filled, never what was typed into it.

3.9 Location

Not collected. The extension requests no geolocation permission and derives no location from your device.

4. What the extension never does

• Auto-fill mapping never sees page values. When oyyo decides which submission field belongs in which form field, it sends only the form's structure — field labels, types, and dropdown options — and never what is typed in them. On the fill path, data flows tenant → page, never page → tenant.
• It never submits a form. Every submit, bind, and purchase control is fenced. A human must click it.
• No remote code execution. The extension contains no eval(), no new Function(), and loads no remotely-hosted scripts. This is enforced by an automated gate that runs when the extension package is built.
• It never stores a carrier-portal password, and never replays one.
• No data is sold, and none is shared with third parties.
• Data is used only to provide the feature you invoked — never for advertising, never to train third-party models, and never for creditworthiness or lending purposes.

5. Permissions, in plain language

Chrome asks you to approve a list of permissions. Here is what each one is actually for.

sidePanel

To show the oyyo panel alongside the page.

activeTab and optional host permissions

The extension has no standing access to any website. When you want to use oyyo on a carrier portal, you explicitly grant access to that one site ("Unlock this portal"). Access is per-site and granted by you.

scripting

To run the form scanner and the filler on a page you have unlocked.

tabs

To know which site the active tab is on, so oyyo can offer you the right submission.

storage

To remember which oyyo instance you connected to. No credentials are stored here.

contextMenus

To add the right-click "clip to oyyo" entry.

webNavigation

To detect when you navigate away, so an automated run stops rather than continuing blindly.

declarativeNetRequest

A security control. While an automated run is active, this blocks that tab from sending data anywhere except oyyo.

6. Data retention

The extension is not a store of record. Anything it sends lands in your own oyyo tenant, and its retention there is governed by your agency's agreement with oyyo and by the retention settings your agency's administrators configure. The extension keeps nothing on your device beyond which oyyo instance you connected to; uninstalling it removes that.

7. Your rights and choices

Your agency controls its oyyo tenant and the data inside it. To access, correct, export, or delete data that the extension sent to your tenant, contact your agency's oyyo administrator, or write to us at support@oyyo.ai and we will route your request to the right tenant owner.

You can also, at any time:

• Revoke oyyo's access to a specific site in Chrome's extension settings.
• Decline to clip, ask about, or record on any page — every collection is an action you take.
• Remove the extension, which ends all collection immediately.

8. Security

Traffic between the extension and your tenant is encrypted in transit (HTTPS). Your identity is carried by an httpOnly session cookie the extension cannot read. High-risk values are masked on your device before egress, the extension executes no remote code, and while an automated run is in progress the extension actively blocks the tab from sending data to any host other than oyyo. No system is perfectly secure, and we do not claim otherwise.

9. Children

oyyo is a professional tool for commercial insurance brokers and underwriters. It is not directed at children, and we do not knowingly collect personal information from children.

10. Changes to this policy

If the extension's data handling changes, this page changes with it, and the "last updated" date above changes too. Material changes will be communicated to tenant administrators. Continued use of the extension after an update constitutes acceptance of the updated policy.

11. Contact

Questions about this policy, or about how the extension handles data, go to support@oyyo.ai.