Seller Assistant Extension Privacy Notice

Version: 2026-09-18.v1. Effective date: 18 September 2026. Operator: ABSOLUTE SERVICES (UEN 53464936W), a sole proprietorship registered in Singapore and owned by LEE KOK WAN. "Hail Pilot" is the name of the product and service operated by ABSOLUTE SERVICES ("Hail Pilot", "we", "us"). Registered address: 60 Paya Lebar Road, #06-28, Paya Lebar Square, Singapore 409051.

This notice applies to the Hail Pilot Seller Assistant browser extension for Google Chrome (the "Extension"). The Privacy Policy at /legal/privacy covers the Hail Pilot website and application. Terms in capitals have the meaning given in the Terms of Service at /legal/terms.

1. What the Extension does

1.1 The Extension reads pages of your own Shopee Seller Centre and Lazada Seller Centre while you are signed in to those sites in your browser, and sends selected campaign and advertising figures to your own Hail Pilot account.

1.2 The Extension is read-only on the Seller Centre page. It does not change the page, submit forms, or send any request to Shopee or Lazada of its own.

1.3 The Extension only works after you pair it with your Hail Pilot account using an extension key that you generate in the Hail Pilot dashboard. Until it is paired, nothing is transmitted anywhere.

2. When the Extension acts

2.1 On your click. When you open a Marketing Centre, campaign, promotion or nomination page and click "Scan this page" in the Extension pop-up or side panel, the Extension reads that page once, extracts the fields listed in Section 3, and sends them to your Hail Pilot account. Nothing is read from a page until you click.

2.2 Automatically on Shopee advertising pages. When you open a page under the Shopee Seller Centre advertising section (the address contains /portal/marketing/pas/), the Extension observes the advertising-performance data that the page itself loads from Shopee while you are viewing it, extracts the fields listed in Section 3.2, and sends them to your Hail Pilot account without a further click. This happens each time such a page loads new performance data. It does not happen on any other page, and it does not happen if the Extension is not paired.

2.3 The Extension has no timers, no scheduled scanning and no background polling. It does not open, fetch or read any Seller Centre page on its own. It acts only while you are viewing a page listed in 2.1 or 2.2.

2.4 You can stop the automatic capture in 2.2 at any time by unpairing the Extension (Section 6), by removing the Extension's access to Shopee Seller Centre in Chrome's extension settings, or by uninstalling the Extension.

3. What the Extension collects

3.1 Campaign pages (on your click): campaign titles, campaign date ranges, nomination counts, and the address of the page scanned.

3.2 Shopee advertising pages (automatic): campaign or keyword name, currency, impressions, clicks, click-through rate, orders, conversion rate, return on advertising spend, average position, the reporting period, and the address of the page. The raw response from Shopee is discarded inside your browser once these fields are extracted; only the listed fields leave your browser.

3.3 Pairing data: the extension key you paste in, the address of the Hail Pilot API the Extension talks to, the time and result of the last sync, the identifier of your Hail Pilot account returned when the key is checked, and the last error message, if any.

3.4 Every payload is checked against a fixed schema inside the Extension before it is sent. Fields the schema does not recognise are dropped.

3.5 The Extension does not collect: (a) cookies, sign-in sessions, passwords or authentication tokens for Shopee, Lazada or any other site; (b) your browsing history or the content of any page other than those described in Section 2; (c) Buyer names, contact details, addresses, order contents or messages. The pages and data the Extension reads are campaign and advertising records, not Buyer records; (d) anything about you beyond the pairing data in 3.3.

4. Where the data goes

4.1 The Extension sends data only to the Hail Pilot API at api.hailpilot.com, into the Hail Pilot account whose key you pasted in. Requests carry your extension key as a bearer token. Your browser cookies are never sent with these requests, and a request is aborted rather than followed if the server tries to redirect it.

4.2 The address the Extension may send to is restricted to a short fixed list built into the Extension (the production API, and a staging or local address used only by developers). Any other address is rejected.

4.3 The Extension sends no data to any other party. It contains no analytics, advertising or crash-reporting library and loads no code from the internet. Its source is not minified or obfuscated; the files you install are the files that run.

4.4 Once data reaches your Hail Pilot account it is Merchant Data and is handled as described in the Privacy Policy and, for the parties that process it, the Sub-processor List at /legal/subprocessors.

5. Storage on your device

5.1 The Extension stores the items in 3.3 in Chrome's extension storage on your device (chrome.storage.local). The extension key is held only by the Extension's background worker; the scripts that read Seller Centre pages never see it.

5.2 Clicking "Unpair" in the pop-up or side panel deletes the key, the last sync record, the account identifier and the last error from your device. Uninstalling the Extension deletes all of its storage.

6. Your controls

6.1 Revoke the key. In the Hail Pilot dashboard, under Settings, Extension Keys, an account administrator can revoke the key at any time. A revoked key stops every further transmission immediately, even if the Extension is still installed.

6.2 Unpair. Click "Unpair" in the Extension to remove the key from your device.

6.3 Limit site access. Chrome lets you restrict which sites an extension can read. Restricting the Extension's access to Shopee Seller Centre stops the automatic capture in 2.2.

6.4 Uninstall. Remove the Extension from Chrome at any time.

6.5 Delete synced data. Ask us to delete data already synced to your account, as described in the Privacy Policy.

7. Retention

7.1 Data synced by the Extension is retained in your Hail Pilot account for the periods stated in the Retention Schedule at /legal/retention, under the classes for campaign and advertising records and for Merchant account data.

7.2 The Extension itself keeps the pairing data in 3.3 on your device until you unpair or uninstall.

8. Platform terms

8.1 The Extension reads Seller Centre pages on your instruction, for your own seller account, and sends the results only to your own Hail Pilot account. You are responsible for deciding whether your use of the Extension is permitted by your agreement with Shopee or Lazada.

8.2 Hail Pilot gives no warranty that Shopee, Lazada or any other Platform authorises automated reading of its pages, and does not guarantee that a Platform will not object to it. If a Platform restricts or penalises your account because of your use of the Extension, that is a matter between you and the Platform.

9. Chrome Web Store user data policy

9.1 Hail Pilot's use and transfer to any other application of information received from Google APIs or collected through the Extension will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

9.2 In particular, Hail Pilot uses data collected by the Extension only to provide the single purpose described in Section 1, does not sell it, does not use or transfer it for advertising, and does not allow humans to read it except with your permission, for security purposes, or where the law requires.

10. Changes to this notice

10.1 We will update this notice when the Extension's behaviour or data handling changes, and we will update the Chrome Web Store listing at the same time. Every version is listed on the legal changelog at /legal/changelog.

11. Contact

11.1 Privacy questions, extension support and security reports all go to business@hailpilot.com; for privacy questions, address them to our Data Protection Officer. For security reports, see also the Vulnerability Disclosure Policy at /legal/vdp.