KTC GiCheck Sync Privacy Policy

1. About the extension

KTC GiCheck Sync is an internal Chrome extension for authorised staff of Kapar Trading Company (“KTC”, “we”). It is not intended for the public.

Its single purpose is to capture the details of successful vehicle inspection bookings made on GiCheck and to synchronise selected booking data with KTC’s internal KTC Inspection system. It runs only on GiCheck (gicheck.my and www.gicheck.my) and on the KTC Inspection site (kapartradingcompany.netlify.app). It never fills in, pays for, cancels or reschedules a GiCheck booking.

2. Information the extension processes

When a staff member reaches a GiCheck booking confirmation, or imports a booking from KTC Inspection, the extension reads the booking confirmation that GiCheck returns to that staff member’s browser and keeps:

• Booking details: booking reference, transaction date and time, appointment date and time, inspection centre, inspection type (with code and reasons), and GiCheck reservation identifiers and status values.
• Vehicle information: registration number, chassis and engine numbers, make, model, engine capacity, fuel type, year of manufacture, category, type, usage class, body type and weights (BDM / BTM).
• Customer or registered-owner information shown in the booking: name, identity or company registration number, contact number and address.
• Payment amount: the booking’s total amount only.
• Staff choices made in the extension: the KTC case selected, attendance method and assigned runner.

GiCheck’s confirmation can also contain payment details such as the payment method, bank or masked card information, fees and tax. The extension removes these fields inside the GiCheck page as soon as it reads the response. They are not stored by the extension and are not sent to KTC.

The extension also handles:

• KTC device token: a per-computer token issued by a KTC System Admin and pasted by staff into the extension options. It authenticates the computer to KTC Inspection.
• GiCheck session: to import or refresh a booking, the extension uses the GiCheck login already open in the staff member’s tab to request that booking from GiCheck (api.gicheck.my). The GiCheck session token is used only inside the GiCheck page. It is not stored by the extension and is never sent to KTC.
• Local synchronisation state: drafts, unsent bookings, recent sync history, the page address and capture diagnostics of a captured confirmation, and the last result (see section 3).

To detect a GiCheck reschedule, the extension matches booking references in GiCheck’s own booking-list responses. That mapping is kept only in the open page’s memory. The extension does not collect browsing history and does not read any other website.

The KTC Inspection address is fixed when the extension is built (https://kapartradingcompany.netlify.app); staff cannot enter or change it. The extension does not ask for or store a device name; that name is kept with the device token record in KTC Inspection.

3. What is stored in the browser

The extension stores data with Chrome’s extension storage (chrome.storage) on the computer where it is installed:

• Settings (chrome.storage.local): only the GiCheck device token. Versions before 1.1.21 also stored a KTC address, a device name and an automatic-retry preference; these are deleted when the extension updates.
• Drafts saved with “Review later” (chrome.storage.local): the captured booking information listed in section 2. A draft is removed when the booking is saved to KTC.
• Unsent bookings (chrome.storage.local): bookings that could not be delivered yet, kept for retry and removed after a successful save. At most the latest 100 are kept.
• Sync history (chrome.storage.local): booking reference, vehicle registration, KTC booking ID, result, time saved, appointment and inspection centre, used to warn about duplicate saves. At most the latest 500 entries are kept, together with the last successful sync time and the last error code.
• Current captures (chrome.storage.session): the latest captured confirmation for each booking reference, held in memory and cleared when the browser closes.

Websites cannot read extension storage, and the extension asks Chrome to limit it to the extension’s own pages and background service worker. The extension does not add its own encryption, so anyone with access to that computer account and Chrome profile may be able to access the stored data.

The device token is read only by the background service worker and is sent only in the authorization header of requests to KTC Inspection. It is never inserted into the GiCheck page or its DOM, window messages, unsent-booking (retry) records or logs. The token field is masked, and once saved the token is never shown again, so it does not appear on screen or in screenshots.

4. What is sent to KTC

When staff save a booking, import a booking reference, use Add Attempt, a reschedule is detected or a retry runs, the extension sends to KTC Inspection (https://kapartradingcompany.netlify.app): the booking details, vehicle information, customer or registered-owner information, total amount and staff choices listed in section 2, plus the extension version and basic capture details (capture method and number of vehicles). Each request is authenticated with the KTC device token. “Test Connection” sends the token with an empty test request.

The extension also contains a booking-status check that would send a booking reference, vehicle registration, GiCheck reservation identifiers and status to KTC; the current KTC Inspection system does not use it.

The extension never sends the GiCheck session token, cookies, passwords, payment method or card details, or browsing history to KTC. Requests to GiCheck contain only the booking reference (and, for a status check, GiCheck’s reservation identifier) and are made with the staff member’s own GiCheck session.

5. How the information is used

The information is used only to create and update inspection cases and attempts in KTC Inspection, so that KTC staff can manage inspection bookings, runner assignment, results, costs and follow-up. The information is:

• not sold;
• not used or transferred for advertising, including personalised advertising;
• not used or transferred to determine creditworthiness or for lending purposes;
• not used or transferred for any purpose unrelated to this single purpose.

6. Who can access the information

• Authorised KTC staff, through KTC Inspection’s login and role-based access (runners see only the jobs assigned to them).
• Infrastructure providers required to operate KTC Inspection, which process the data on KTC’s behalf: Netlify (hosting) and Supabase (database and authentication).
• If KTC enables its internal staff notifications, short booking notices (such as vehicle registration, appointment time and inspection centre) may be posted to a private KTC staff channel on Telegram.
• Authorities, where disclosure is required by law.

7. Security

• All communication with KTC Inspection and GiCheck uses HTTPS. The published extension sends booking data only to the fixed KTC Inspection HTTPS address above.
• Every computer has its own device token. KTC Inspection stores only a hash of the token, and a KTC System Admin can revoke a token at any time.
• Fields that look like credentials (tokens, cookies, passwords and authorization values) are removed from captured GiCheck data before it is stored or sent.
• All code run by the extension is included in the extension package. It does not load or execute remotely hosted JavaScript or WebAssembly.

No method of storage or transmission is completely secure.

8. Retention, deletion and revocation

• Browser data is kept as described in section 3. Staff can clear the device token from the extension options. Uninstalling the extension removes all data it stored in Chrome.
• Revoking a device token in KTC Inspection stops that computer from sending further data to KTC.
• Booking data sent to KTC becomes part of KTC’s inspection records and is kept for as long as KTC needs it for its inspection work and business record-keeping.
• To ask about, correct or request deletion of personal information, contact us below. We will respond within a reasonable time, subject to our legal and record-keeping obligations.

9. Changes to this policy

We will update this page and its effective date when the extension’s handling of information changes.

10. Contact

Kapar Trading Company — semleel2367@gmail.com