Extension privacy policy

Last updated: 29 October 2026.

This policy explains how SIA Anyon3e operates the EzyFin Chrome extension. Contact us at info@anyon3e.com for privacy, support or deletion requests.

What the extension handles

• Account and company access: your EzyFin user identifier, authorized company names and identifiers, the shared active-company preference, and access/subscription eligibility.
• Authentication: a scoped, revocable extension credential. Your website session and password are not copied into the extension. Server records hold hashes of extension credentials.
• Selected documents: complete PDFs and images, filenames, file type, size, hashes and upload/processing identifiers. Documents may contain financial, company, contact or personal information.
• Selected page data: file links and viewer information needed to find and retrieve the files you choose. Source URLs, signed parameters and generated-file identifiers remain in memory; the source hostname, selected filename and capture time are retained with submission metadata.
• Service diagnostics: request times, errors, transfer outcomes and technical security information processed by EzyFin and its infrastructure providers. Document contents and signed source URLs are not included in extension diagnostic messages.

When data is used and uploaded

File detection happens when you invoke the extension or refresh the selected page. Only files you select and confirm are retrieved and uploaded. Optional website access is requested when needed for those files. Chrome manages applicable website cookies; the extension does not read or export portal cookies or authorization tokens.

Optional tab-details permission is used for the selected file tab and its explicit source tab when Chrome’s PDF viewer hides the address. EzyFin does not collect your browsing history, inspect unrelated tabs, collect files automatically, or read your mailbox.

Files go directly to private EzyFin storage over HTTPS. We use account and company data to enforce access, subscription eligibility and the destination you choose; file data to preserve originals and process documents; and diagnostics to operate, secure and troubleshoot transfers.

Who receives data

Accepted documents and extracted details become available to authorized members of the company you selected. Supabase provides authentication, private storage, database and backend services. Vercel hosts the website and processing worker. Google Vision processes document images for OCR, and OpenAI processes document text and visual content for extraction and coding. Where enabled, supplier research sends supplier-identifying details to OpenAI; it does not send complete invoices for web research.

The extension does not send documents to PayTraq or create purchases there. Those actions require a separate user action in EzyFin. We may disclose data where required by law or necessary to protect security. We do not sell extension data or use or transfer it for advertising, creditworthiness or lending decisions.

Limited use

EzyFin’s use and transfer of information received through the extension follows the Chrome Web Store User Data Policy, including its Limited Use requirements. Data is used only for the document-upload and related user-facing EzyFin processing features and their security. Staff access to document contents is limited to your consent for specific support, security investigations, legal requirements or permitted aggregated/de-identified use.

Local storage and retention

The scoped credential is kept in trusted extension storage, unavailable to page content scripts, and expires after 30 days or earlier if revoked or its linked EzyFin login session ends. Disconnect removes the local connection and revokes it server-side.

Retrieved file bytes are temporarily kept in extension-owned IndexedDB so unfinished uploads can resume. They are removed after accepted upload, cancellation or disconnect. Unfinished files expire after 24 hours; expiry is checked before reuse and during cleanup. If Chrome is closed, cleanup runs when the extension next runs. Up to 20 recent transfer metadata records, without document bytes, may be retained locally for up to seven days.

Disconnecting or uninstalling does not delete files already accepted by EzyFin. Server-side documents, source originals, processing records and audit evidence are retained for service delivery, company recordkeeping, security and applicable legal obligations. Removing an inbox item may retain its original source and audit history. Contact us for account or retained-data deletion; legal recordkeeping obligations may limit deletion.

Access, security and your choices

You choose files and their destination, can decline optional permissions, cancel unfinished transfers, disconnect, or uninstall. Access is restricted by active company membership and scoped server authorization. The extension cannot edit financial records, manage suppliers or send PayTraq drafts.

We process data to provide the requested service, meet legal obligations and protect its security. Processing providers may operate internationally; applicable transfer safeguards and service agreements govern those transfers. Depending on applicable law, you may request access, correction, deletion, restriction, objection or portability, and complain to a supervisory authority. Send requests to info@anyon3e.com.

We publish updates to this policy on this page with a revised date.