Privacy policy of the PAFworks Assistant extension

This policy covers the PAFworks Assistant extension for Chrome, the browsers built on Chromium, and Firefox. It explains what the extension reads, when, where that information goes, and what it never touches. It is based on the Swiss Federal Act on Data Protection (FADP) and, for users in the European Union, the General Data Protection Regulation (GDPR).

In short: the extension sends nothing to us. It works only with the PAFworks instance you choose to connect it to, and it reads a web page only when the assistant of that instance asks for it, for the page you are looking at beside the conversation.

Who we are

Iabsis Sàrl
Chemin des Préjins 18
1218 Le Grand-Saconnex
Switzerland
Contact: info@iabsis.com

What the extension is for

PAFworks has an assistant that can open a web page beside the conversation, so that you and the assistant look at the same page: you can sign in to the site there, go to the right screen, and the assistant then reads what you see. A web application cannot do that on its own, and that is the extension's only purpose. It shows the pages the assistant opens in its panel, signed in as you would be in your own tabs, and reads a page back when the assistant asks.

What it reads, and when

When you connect an instance. When you open the extension's window, it looks at the address of the tab in front of you and checks whether that page is the Assistant page of a PAFworks instance (such a page carries a marker for that purpose). It reads nothing else from the page, and keeps nothing unless you then click to connect the instance.

The page shown beside the conversation. For the page displayed in the assistant's panel of a connected instance, the extension passes its address and title to the PAFworks Assistant page in your browser, so it can show them above the page. While the panel is open, it also remembers the names of the sites it has shown (see What the extension changes).

When the assistant reads that page. Only then, and only for that page, the extension collects:

• the text displayed on the page, with its headings, lists, tables and links;
• the alternative text of images (not the images themselves);
• the labels of form fields and what is entered in them, with the exceptions below;
• the text you have selected on the page, if any;
• the same, for the frames displayed inside that page;
• the page's address and title.

Whatever that page displays is part of it: on a bank statement or in a webmail, the text read includes the personal or financial information shown there. The extension reads that one page, as it is displayed, and nothing else.

What it never reads:

• the value of a password field, or of a field marked or named as a payment card number, security code, one-time code, PIN, bank account number or secret: only its label is passed;
• anything that is not displayed, and the page's scripts and styles;
• your cookies, your browsing history, your saved passwords, or the content of your other tabs.

The assistant reads a page only in a conversation, and you see it: each reading appears in the conversation as an action of the assistant, and the page it reads is the one in front of you. The assistant cannot open a page without your approval — you are shown the address and choose to open it or not.

Where the information goes

To the PAFworks instance you connected, and nowhere else. The extension hands what it reads to the PAFworks Assistant page open in your browser, which sends it to the instance you are signed in to, over its encrypted connection. The instance passes it to the artificial intelligence model its administrator has configured, so that the assistant can answer you, and keeps it in the conversation for as long as that instance keeps conversations (90 days by default). How the instance processes it is governed by whoever operates it: your organisation, or Iabsis when you use the PAFworks service we operate.

Not to us. The extension itself sends nothing anywhere: no analytics, no telemetry, no error reports, no advertising. It does not load code from anywhere either. Iabsis receives nothing from it.

What is stored in your browser

• the web addresses of the PAFworks instances you connected, and the date you connected them, until you remove them or uninstall the extension;
• while you use it, the tabs in which the extension shows the Assistant page, and the names of the sites shown in their panel. These are kept in the browser's session storage and are erased when the panel is closed, when the tab is closed, or when the browser closes.

Nothing is stored anywhere else by the extension.

What the extension changes

When you open the Assistant page of a connected instance, the extension shows it inside a page of its own, which is what lets it place the site beside the conversation. The address bar then shows the extension's address.

Many sites forbid being displayed inside another page, with the X-Frame-Options header and the frame-ancestors directive of their content security policy. To show such a site in the panel, the extension removes these restrictions — and only within the tabs where it shows the Assistant page.

A site may also fetch its pages through a service worker of its own. In that case, and only for the sites shown in a panel and while it is open, the extension removes the same restrictions from those requests; this applies to the pages of those sites in your other tabs too, for that time. Removing a content security policy also removes the other protections it declares on the pages concerned.

Some sites also stop working when they find a page of another origin around them: Odoo's interface, for one, looks for the frame it is in through the page that contains it. So, in the panel, the extension makes the page its own parent (window.parent) before the page's own scripts run. For that, while the Assistant page is open through the extension, a small script is loaded into the frames of the pages you open; it only checks whether it is in the panel, and does nothing anywhere else.

The extension does not change anything else in the pages you visit.

Permissions and why they are needed

• Access to all websites: the assistant may open any site, which the extension has to be able to show and, when asked, read; it also has to recognise the Assistant page of a PAFworks instance.
• Declarative net request (with host access): open the Assistant page of a connected instance inside the extension's page, and lift the display restrictions described above.
• Scripting: read the page shown in the panel when the assistant asks, look for the PAFworks marker when you connect an instance, and load the small script described above while the Assistant page is open.
• Web navigation: follow where the page in the panel goes (address, title, going back), and notice when the Assistant page navigates elsewhere.
• Storage: remember the connected instances and the extension's tabs.

Limited use

The information the extension reads is used only to provide its single purpose described above. It is not sold, not used for advertising, personalisation or credit decisions, and not transferred to anyone other than the PAFworks instance you connected, which needs it to answer you. The use of information received through the extension complies with the Chrome Web Store User Data Policy, including its Limited Use requirements, and with Mozilla's add-on policies.

Security

The extension connects only to instances served over HTTPS (your own computer excepted, for development), and only after you choose to connect them. The pages it shows run in a restricted frame that cannot take over the tab. Passwords are never read.

Your choices

• Disconnect an instance at any time from the extension's window, or remove the extension altogether.
• Withdraw the extension's access to websites in your browser's settings.
• Decline when the assistant asks to open a page, and close the panel whenever you like.
• Delete a conversation in PAFworks to delete what the assistant read in it.

Your rights

You can ask for access to, correction or deletion of your personal data, object to its processing, ask for its portability and withdraw your consent at any time. For what the extension does, write to us at info@iabsis.com. For what your PAFworks instance keeps, contact its operator — your organisation's administrator, or us for the PAFworks service.

You can also lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) or, if you live in the European Union, with your national data protection authority.

Children

The extension is meant for people using PAFworks for their work or organisation. It is not directed at children under 16.

Changes to this policy

If the extension's handling of information changes, this policy will be updated before the new version is published, with a new date below.

Last updated: 7 October 2026 (version 1.0.2)