Insurance Hub Portal Assistant — privacy and permissions

Single purpose: help authorized brokers transfer a reviewed insurance application
and selected documents into the exact carrier portal they approve.

Data: the selected client's approved answers, document bytes, source references,
carrier destination, signed-in agent and agency business contact details,
local field mappings and action counts. The extension does not collect
carrier passwords, authentication codes, cookies, browser history or telemetry.
The local carrier tools do not call an AI service, sell data or contact advertising services.

Optional Hub / Benco guide: Voice or text help opens the existing Hub website in a
companion window. The extension does not send its packet, documents, page fields
or carrier activity to the guide. Only what you choose to say or type is shared
through the Hub's disclosed AI conversation flow. Start Voice mode explicitly;
the Hub requests microphone permission and provides mute/end controls. Closing
the companion ends its call. The Hub's conversation privacy and retention notice
applies. This feature adds no extension host or microphone permissions.

Storage: packet data is encrypted using AES-GCM in extension IndexedDB. The key
is held in Chrome's trusted-context session storage, not sync/local storage or
content scripts. The session expires in 30 minutes; expiry/clear removes it.
An interruption may leave unreadable ciphertext until the next startup/cleanup.
Your hub retains its approved-packet audit and broker-reviewed receipt according
to the brokerage's own access and retention policies.

Permissions:
- activeTab + scripting: inspect and fill controls only after your invocation;
  execution is constrained to the approved carrier origin.
- sidePanel: show answers and documents beside the portal.
- storage + alarms: encrypted session handling and expiry cleanup.
- downloads: save only the documents or receipt you request.
- A content bridge runs on the explicitly listed current Insurance Hub and retained legacy/Benco domains to
  accept approved packets and revalidate them through your existing hub session.
No persistent all-sites host permission is requested.

Disclosure: filling fields or attaching files can transmit customer information
immediately where a carrier autosaves/uploads. Review the destination and selected
data first. Downloaded documents remain in Downloads after extension cleanup;
apply your brokerage's device and file-handling policies.

Revocation stops future extension actions. It cannot recall downloads or data
already transmitted to a carrier. The extension does not submit applications,
bind policies, make insurance decisions or sign documents.

Per-request field mappings remain in trusted session storage, scoped to the
approved origin and page structure. They are not shared across clients or sent
to an AI service. Automatic rescanning follows navigation only within the
approved portal after invocation; each fill still requires review.
Historical policy producer details are not a source of submitting-agent identity.

Delegated preparation: a named unlicensed preparer may use an exact packet
approved by their selected licensed producer. Both identities are retained
separately. Producer facts never come from the preparer's identity or an old
policy. Team changes revoke existing packets; current agency access and the
producer's license are rechecked before extension actions.


Benco shortcuts open the public Benco quote page, the Benco client login on
Insurance Automation Hub, or Benco's existing ePayPolicy payment portal. No
packet, document, client identifier or payment details are added to those URLs.
The destination website's privacy policy applies to what you submit there.
