Pick Three Car Service Controller — privacy

What it reads

On a job card in the service portal, Pick Three Car Service Controller reads named fields only: the job card number, the vehicle registration, the VIN, the odometer, the portal's own status, and the labour lines with their standard hours. It never captures, stores or transmits the page source.

It does not read customer or driver identity — not the name, address, phone number or anything else about the person who owns the vehicle. The product has no use for it, so it is not collected. Registration and VIN identify the vehicle, which is the thing being worked on.

It reads. It does not modify the portal, submit anything to it, or call its API. A controller navigates; Pick Three Car Service Controller looks at the rendered page.

Where it goes

To one place: the Grist document belonging to your own dealership, on the Pick Three workspace whose address you enter in the extension's settings. Nowhere else. There is no analytics, no telemetry, no crash reporting, and no server operated by the extension's author.

The data written is the tracking record itself — which job, which technician, started when, stopped when — alongside the job card fields above.

What is stored in the browser

Your workspace address, document id, your name, and the API key, in chrome.storage.local on that machine. The key is a bearer token scoped to one workspace. It is read only by the extension's background service worker and is never sent to the portal page, never logged, and never leaves the machine except in a request to the workspace address you configured.

What it is never used for

• It is not sold, and not transferred to anyone, for any purpose.
• It is not used for advertising, profiling, or credit assessment.
• It is not used for anything unrelated to tracking shop-floor work.

Permissions, and why each exists

• carsdms.inservices.tatamotors.com — to show the panel on a job card and read the fields listed above. This is the only site the extension runs on.
• job-control.pick3.tech — your workspace, where the record is written. Other Pick Three addresses are optional: the extension asks for one only if you point it at a different workspace.
• storage — the settings above.
• declarativeNetRequestWithHostAccess — removes the Origin header from the extension's own requests to your workspace, which the platform rejects otherwise. It applies to that one address and to no other traffic.

Removing it

Uninstalling the extension deletes everything it stored in the browser, including the API key. Records already written to your dealership's document belong to that document and are yours to keep or delete.