Galici

Privacy Policy - Galici Extension for Mercado Público

Last updated: May 2026

Overview

Galici Extension helps Chilean businesses participate in public procurement tenders on Mercado Público.

The workflow is simple:

  1. Import products from any supplier website to build your catalog
  2. Submit bids to Mercado Público tenders using products from your catalog

By importing products from your suppliers' websites, you can quickly build a catalog that allows you to bid on a wider range of government tenders. The extension streamlines both steps - finding products and submitting competitive bids.

This extension operates with strong privacy protections. All data processing happens locally on your device, and data is only transmitted when you explicitly take action.

Data Collection

What We Collect

For Bid Submission:

  • Authentication Token: Your Mercado Público JWT token (JSON Web Token)
  • Connection Status: Whether you're logged into Mercado Público

For Product Import:

  • Product Page HTML: Content of the product page (only when you click "Import")
  • Product URL: The URL of the product page (only when you click "Import")

What We DON'T Collect

  • ❌ No personal information
  • ❌ No browsing history or URLs you visit
  • ❌ No analytics or telemetry
  • ❌ No usage statistics
  • ❌ No cookies from other sites
  • ❌ No data from banking, email, or social media sites
  • ❌ No automatic data collection (all actions require your click)

Supplier Product Import Feature

Why This Feature Exists

To bid on Mercado Público tenders, businesses need a catalog of products they can offer. The product import feature lets users quickly add products from their suppliers' websites to their Galici catalog, enabling them to bid on a wider range of government tenders.

Why We Need Access to All Websites

The extension requires broad website access to detect product pages on any e-commerce website. This is necessary because:

  • Chilean businesses purchase from thousands of different suppliers across all industries
  • Suppliers include hardware stores, office supplies, industrial equipment, medical supplies, and more
  • These supplier websites cannot be enumerated in advance
  • This is the same approach used by extensions like Honey (17M+ users) and Rakuten (10M+ users)

What Actually Happens

  1. On page load: The extension checks if you're on a product page (using URL patterns and page elements)
  2. If product detected: A small "G" button appears on the page
  3. When you click "Import": Only then is the product data captured and sent to Galici
  4. On non-product pages: Nothing happens, no data is collected

Privacy Guarantees for Product Import

GuaranteeHow It's Enforced
No browsing historyWe never store or transmit URLs you visit
User-initiated onlyData is ONLY sent when you click the "Import" button
Data minimizationScripts, styles, and iframes are removed from captured HTML
Excluded domainsThe extension exits immediately on galici.cl and mercadopublico.cl
No sensitive sitesWe do not process banking, email, or social media sites

What We Send to Galici Servers

When you click "Import" on a product page:

  • Product HTML: Cleaned HTML content (scripts/styles removed)
  • Product URL: The URL of the product page
  • Purpose: Extract product information (name, price, description, images)

This data is used only to create a catalog entry in your Galici account, which you can then use to submit bids on Mercado Público tenders.

Data Storage

Where Your Data is Stored

  • Locally Only: All data stored in chrome.storage.local (encrypted by Chrome)
  • No Cloud Storage: Galici does not have a database that stores your Mercado Público authentication token. The token is never persisted on our servers.

How Long Data is Stored

  • Authentication token: 8 hours on your device, then automatically deleted
  • When you logout from Mercado Público, the token is immediately deleted from your device
  • Bid submission state cache (in-progress / completed bids): up to 1 hour on your device, automatically deleted after that. Enables automatic recovery if you accidentally close the tab while a bid is being sent

Data Usage

How We Use Your Token

Your token is used solely to submit bids on your behalf, and only when you explicitly click "Submit". It is never used in the background, never used for any purpose other than the action you initiated, and never shared with third parties.

There are two technical paths the token can take, depending on which version of our submission flow your account is on:

  1. Direct path (V1): The extension sends your bid directly to mercadopublico.cl using your token. The token does not leave your browser.

  2. Server-assisted path (V2, current): When you click "Submit", the token is transmitted transiently to Galici's servers (galici.cl) over HTTPS for the duration of that single submission. Our backend uses it once — to send the bid to mercadopublico.cl on your behalf with the resilience improvements V2 enables (automatic recovery from network hiccups, accidental tab closes, etc.) — and then discards it from memory. The token is:

    • Never written to our database
    • Never logged (our logging system is configured to redact authentication credentials even if they leak through other code paths)
    • Never used for any subsequent request without a fresh, explicit click from you
    • Never shared with any third party

In both paths, every use of your token is the direct result of an explicit action on your part. The extension never acts on your Mercado Público account autonomously.

Why the server-assisted path exists

Sending bids reliably to Mercado Público requires handling slow network conditions, accidental tab closes, and intermittent gateway failures. Doing this entirely from within the browser is fragile — closing the tab at the wrong moment used to lose your submission. The server-assisted path lets Galici handle the difficult parts of the network conversation with Mercado Público so you don't lose work, while still requiring your explicit click for every submission.

Additional Technical Services

To enable bid submission, the extension uses these external services:

  • IP Detection (api.ipify.org): We obtain your public IP address, which is required by Mercado Público for bid validation. No personal data is sent.
  • reCAPTCHA: The extension uses reCAPTCHA only if it's already loaded by Mercado Público. We do NOT load reCAPTCHA ourselves.

These services are technically necessary for the extension to work and are required by Mercado Público's API.

Permissions Required

PermissionWhy We Need ItHow We Use It
storageStore authentication token locallySave token to avoid re-login
webRequestCapture token automaticallyIntercept MP requests to get token (scoped to mercadopublico.cl only)
tabsCommunicate between pagesSync status between Galici and MP tabs
scriptingExecute bid submission and product detectionInject scripts into MP and supplier sites
host_permissions (<all_urls>)Detect products on any e-commerce siteShow "Import" button on product pages (user-initiated only)

Security

Token Protection

  • Obfuscated before storage (base64 + reverse)
  • Chrome.storage.local is encrypted by browser
  • Automatic expiration after 8 hours
  • Cleared on logout

What We Don't Do

  • ❌ Store your authentication token in our database
  • ❌ Log your authentication token (logging is redacted server-side)
  • ❌ Share your data with third parties
  • ❌ Use your token in the background or for any purpose other than the bid submission you just initiated
  • ❌ Track your browsing activity or history
  • ❌ Collect data automatically (all actions require your explicit click)
  • ❌ Submit bids automatically (only when you click "Submit")
  • ❌ Import products automatically (only when you click "Import")
  • ❌ Process sensitive sites (banking, email, social media)

Third-Party Services

We use the following external services:

  • api.ipify.org: To obtain your IP (required by Mercado Público)
  • Google reCAPTCHA: For bot protection (only if already loaded by Mercado Público)
  • galici.cl (our own servers):
    • To send product data when you click "Import" (product upload feature)
    • To relay your bid to Mercado Público when you click "Submit" on a bid using the server-assisted submission path (V2). Your authentication token is sent transiently for this single action and is not stored or logged — see "How We Use Your Token" above.

We DO NOT use analytics, tracking, or telemetry services.

Children's Privacy

This extension is designed for businesses and is not intended for children under 13.

Changes to This Policy

We will update this policy if our practices change. Check the "Last updated" date at the top.

Contact

Questions about privacy? Contact: support@galici.cl

Code Quality

Our privacy guarantees are enforced by automated tests that run on every code change. The extension code is reviewed by Chrome Web Store before publication.

Official Website: https://galici.cl Support: support@galici.cl Privacy Questions: privacy@galici.cl