Privacy Policy

Click-to-Call Router — Chrome Extension
Last updated: April 4, 2026

1. Introduction

Click-to-Call Router ("the Extension") is a Chrome browser extension published by MCA CRM Platform ("we", "us", "our"). This privacy policy explains what data the Extension collects, how it is used, and who it is shared with.

2. Data We Collect

The Extension collects and processes the following categories of data:

Data	Purpose	Storage
Email address and password	Authenticate with MCA CRM Platform	Password is never stored. Sent once over HTTPS to our server to obtain an authentication token.
Authentication token	Maintain your signed-in session	Stored locally in chrome.storage.local. Expires after 7 days. Cleared on sign-out.
User profile (name, email)	Display your identity in the Extension popup and settings	Stored locally in chrome.storage.local. Cleared on sign-out.
Company name, subscription status, and plan tier	Verify your subscription is active and display account info	Stored locally in chrome.storage.local. Cleared on sign-out.
Call preferences (selected call method, custom URL, tab-reuse setting)	Route phone calls to your chosen provider	Stored in chrome.storage.sync (synced across your Chrome browsers).

3. Data We Do NOT Collect

• Browsing history or page content: The Extension injects content scripts on web pages solely to detect and intercept tel: (phone) links. It does not read, collect, transmit, or store any page content, URLs, or browsing activity.
• Phone numbers: Phone numbers from tel: links are processed locally in your browser and routed directly to your chosen calling provider (e.g., Google Voice). Phone numbers are never sent to our servers.
• Cookies or tracking data: The Extension does not use cookies, analytics, or any third-party tracking.
• Personal files or device data: The Extension does not access your files, camera, microphone, or other device resources.

4. How We Use Your Data

Your data is used exclusively to:

• Authenticate you with MCA CRM Platform and verify your subscription status.
• Route phone calls from web pages to your selected calling provider (Google Voice, Skype, Zoom Phone, or a custom URL).
• Save your call routing preferences across your Chrome browsers.

We do not use your data for advertising, profiling, or any purpose unrelated to the Extension's core functionality.

5. Data Sharing

Your data is shared only with:

• MCA CRM Platform (funderscrm.com): Your email, password (at login only), and authentication token are sent to our servers over HTTPS for authentication and subscription validation.
• Your chosen calling provider: When you click a phone number, the Extension routes the call locally to Google Voice, Skype, Zoom Phone, or your custom URL. No data is sent to these providers by the Extension itself — your browser handles the connection directly.

We do not sell, rent, or share your data with any other third parties.

6. Data Retention

• Authentication tokens expire after 7 days and are automatically cleared.
• All locally stored data is immediately cleared when you sign out of the Extension.
• Call preferences stored in chrome.storage.sync persist until you uninstall the Extension or clear them manually.

7. Data Security

• All communication with our servers uses HTTPS encryption.
• Passwords are never stored locally — only a time-limited token is retained.
• The Extension validates all messages to prevent unauthorized access from other extensions or web pages.
• API endpoints are hardcoded to prevent credential theft via storage manipulation.

8. Permissions Explained

Permission	Why It's Needed
storage	Save your authentication state and call preferences locally.
tabs	Open and reuse Google Voice tabs for making calls.
alarms	Periodically check subscription status (every 24 hours) and token expiry (every hour).
scripting	Inject the dialer script into Google Voice tabs and register content scripts for tel: link interception.
activeTab	Interact with the currently active tab when you click a phone number.
Host permissions (funderscrm.com)	Communicate with our authentication and subscription API.
Host permissions (voice.google.com)	Inject the dialer into Google Voice to initiate calls.
Optional host permissions (all sites)	Detect tel: phone links on any website you visit. Requested once on install; you can decline.

9. Your Rights

• You can sign out at any time to clear all stored authentication data.
• You can uninstall the Extension to remove all locally stored data.
• You can decline the optional host permission to limit the Extension to working only on the active tab.
• You can contact us to request deletion of your account and associated data on our servers.

10. Changes to This Policy

We may update this privacy policy from time to time. Changes will be reflected by updating the "Last updated" date at the top of this page. Continued use of the Extension after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this privacy policy or your data, contact us at:

• Email: rob@click2process.com
• Website: funderscrm.com