Privacy Policy for Sylectus Bidder

1. Introduction

Sylectus Bidder ("the Application", "the Extension", "we", "us", "our") is a Google Chrome browser extension developed to assist freight dispatchers and logistics operators with mileage calculation, Deadhead (DH) estimation, Rate Per Mile (RPM) calculation, and direct bid email dispatch on the Sylectus load board.

We respect your privacy and are committed to protecting user data. This Privacy Policy explains what information is collected, how it is used, and our specific technical mechanisms for protecting sensitive data.

2. Information We Access and Use

The Extension functions as a local, client-side utility inside your Google Chrome browser. We collect and process only the minimal data strictly necessary for the Extension's core features:

a. Sylectus Load Information:

When browsing the Sylectus load board (sylectus.com), the Extension reads publicly displayed load details within your active browser tab (including origin city/state, destination city/state, loaded miles, vehicle equipment type, and broker contact email/notes). This information is processed exclusively in-memory on your device to compute road mileage and prepare your bid email.

b. User Preferences and Settings:

Your custom settings (such as MC number, equipment type, email signature template, and language preference) are saved locally within your browser using Chrome's secure storage API (chrome.storage.sync). This data remains on your device and synchronized across your own Chrome instances via your Google account. It is never transmitted to our servers.

c. Google User Data and Gmail API Access:

To send bid emails directly from your Gmail account, the Extension requests the following Google OAuth 2.0 scope:

• https://www.googleapis.com/auth/gmail.send

Purpose of Gmail API Access:

• The permission is used solely to construct and transmit bid offer emails directly from your authorized Gmail account to freight brokers when you explicitly click the "Send" button for a selected load.
• The Extension DOES NOT read, view, or process your incoming emails, existing inbox messages, or email history.
• The Extension DOES NOT access your personal contacts, email drafts, or account profile details.
• We DO NOT sell, rent, monetize, transfer, or share any Google user data with third parties, data brokers, or advertising platforms.

3. Google API Limited Use Disclosure

Sylectus Bidder's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. Data Protection Mechanisms for Sensitive Data

To ensure the security, confidentiality, and integrity of sensitive user data, we employ strict technical and organizational safeguards:

a. Encryption in Transit (HTTPS / TLS 1.2+):

All network communications between the Extension and Google APIs (including the Gmail API endpoints) are strictly encrypted in transit using industry-standard Transport Layer Security (TLS 1.2 or TLS 1.3) over HTTPS. This cryptographic protection prevents unauthorized interception, eavesdropping, man-in-the-middle attacks, or tampering of sensitive information during transmission.

b. Client-Side Only Architecture & Zero External Storage:

The Extension operates entirely within the sandboxed environment of the user's local web browser without any remote backend server, cloud intermediary, or centralized database. Sensitive data—including Google OAuth access tokens, broker email addresses, load identifiers, and bid amounts—is never transmitted to, collected by, or stored on any external servers, logging services, or third-party cloud infrastructure.

c. Secure Token Handling via Sandboxed Chrome Identity API:

OAuth 2.0 access tokens are managed exclusively through Google Chrome's native and sandboxed Identity API (chrome.identity). Tokens are short-lived, stored securely within Google Chrome's protected operating system credential storage, and are never exposed to third-party scripts, written to unencrypted disk storage, or logged to persistent files.

d. Ephemeral In-Memory Processing & Zero Data Retention:

Sensitive data processed during an email dispatch (such as the recipient broker address, email subject, and body content) is held only ephemerally in volatile memory (RAM) for the few seconds required to execute the API call. Once the transmission completes, the data is immediately dereferenced and purged from memory by automatic garbage collection, leaving no persistent footprint.

e. User Control, Deletion, and Revocation:

Users maintain full, immediate control over their data and permissions:

• Users can disconnect their Gmail account at any time with a single click using the "Odjavi / Disconnect" button in the Extension interface.
• Users can permanently revoke the Extension's access through Google Account Security Settings at https://myaccount.google.com/permissions.
• Revoking permissions or uninstalling the Extension immediately deletes all locally stored preferences and clears all cached tokens from Chrome's credential store.

5. Data Retention and Deletion Policy

We do not collect or retain any personal data, sensitive data, or Google user data on any server. Any configuration settings stored locally in the browser persist only until explicitly modified, cleared by the user, or until the Extension is uninstalled.

6. Changes to This Privacy Policy

We may update this Privacy Policy periodically. Any updates will be published on this page with an updated "Last updated" date.

7. Contact Information

If you have any questions, security inquiries, or requests regarding this Privacy Policy, please contact:

Tony Ross / Sylectus Bidder Support
Email: [email protected]