Verixa Forms may handle:

• document images uploaded by the user;

• extracted identity information, including names, dates, nationality, addresses, document numbers, and other government-issued identifiers;

• values the user explicitly saves from a web form;

• field labels and mappings for sites where the user asks Verixa to fill a form;

• the current site's domain when remembered field mappings are enabled;

• non-sensitive extension preferences; and

• Google Cloud Vision or OpenAI API keys supplied by the user.

Tesseract.js is the default extraction engine. With Tesseract selected, document images and recognized text are processed inside the browser. Additional OCR language-model data may be downloaded from jsDelivr; document images and extracted text are not sent to jsDelivr.

Saved profiles, document images, learned field mappings, and API keys are encrypted with AES-256-GCM using a key derived from the user's master password. They remain in the user's browser storage until the user deletes them or uninstalls the extension. The master password is not stored. A salt and password-verification hash are stored locally so the extension can verify the password.

Non-sensitive preferences may be synchronized through Chrome storage. A user-requested export contains decrypted profile data in JSON format; the user controls where that export is saved.

Verixa does not continuously read browsing activity. It receives temporary access to the active page only after the user opens the extension popup. Opening the popup detects editable fields so the extension can show whether the current page can be filled; field values are read only when the user requests saving. A selected profile is written to fields only when the user clicks Fill. Password, one-time-code, payment-card, and bank-account fields are excluded. Verixa does not submit forms.

Cloud processing is disabled by default. Before it can be used, the user must select a cloud engine, affirm an in-product disclosure, and grant Chrome access to that provider's API origin.

- Google Cloud Vision: When selected, clicking Extract Data sends the chosen document image and the user's API key directly to Google Cloud Vision for OCR. Field matching and MRZ validation then run locally. See the Google Privacy Policy and the terms applying to the user's Google Cloud account.

- OpenAI Vision: When selected, clicking Extract Data sends the chosen document image, an extraction instruction, and the user's API key directly to OpenAI. Requests are sent with API storage disabled. A local Tesseract pass may still verify the MRZ. See the OpenAI Privacy Policy and the terms applying to the user's OpenAI API account.

We does not receive the document, extracted fields, API keys, or cloud-provider response. Data handled by a selected provider is subject to that provider's terms and privacy practices.

Verixa does not sell user data, use it for advertising, or share it with data brokers. Data is transferred to Google or OpenAI only when the user has selected that provider, consented to the upload, and clicked Extract Data.

Users can:

• keep processing on-device by selecting Tesseract.js;

• stop future cloud uploads by switching back to Tesseract.js;

• disable remembered field mappings;

• delete individual profiles and documents;

• clear the extension's data through Chrome; or

• uninstall the extension to remove its local data.

Because encryption is password-based, we cannot recover a forgotten master password or decrypt the user's data.

Verixa uses HTTPS for network requests, AES-256-GCM for sensitive local data, and PBKDF2-SHA-512 with 660,000 iterations for password-based key derivation. No security measure is absolute, and users should protect their browser profile, computer, master password, and API keys.

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. Verixa uses user data only to provide or improve its disclosed document-extraction, profile-management, and form-filling features.

Material changes to these practices will be disclosed in the extension before the changed practice begins, and this policy's effective date will be updated.

For privacy questions or deletion assistance, contact support@serajsystems.com.