MDML Connect — Privacy Policy

Effective: 2026.10.27 (MDML Connect 1.1.0 and later)

MDML Connect is a free Chrome extension from MDML Technologies LLC ("MDML"). It does your business's own chores on websites, using your MDML (RoleCall) account, in your own signed-in browser, after you approve. This page explains what it does with your information.

The short version: you sign in with your RoleCall account, and MDML Connect works only on the websites you allow, one at a time. It sends MDML only what each task needs: the blank layout of a form you chose to fill (never what's typed in it), the words of a store's search results, the text of your own receipts with card numbers, emails and phone numbers taken out. It never reads passwords, Social Security numbers, bank or card numbers, or cookies. It never signs, submits or accepts terms for you. It never places an order unless you, the owner, turn on Autopilot, accept its terms and set that store to "Place the order"; then it presses only the store's own Place order button, inside the limits you set in RoleCall. Connecting your domain happens entirely in your browser, with no network calls at all.

1. What it is for

It has one purpose: it does your business's own tasks on websites, from your MDML (RoleCall) account, in your own signed-in browser, only after you approve. Today those tasks are:

Fill this page. On a business form you have open (a state filing, a registration, a permit application), you press the MDML Connect button and choose "Fill this page with my MDML info". It shows you every box and what goes in it. Nothing is typed until you press "Fill these in". Then you check each box and press the site's own Submit yourself. Look it up finds a public answer a box needs (your business's county, for example) and shows where it found it.
Go there for me. For one of your filings, it opens the official filing website in a new tab and walks you to the form, page by page. Find it for me finds that official website from your own words ("building permit"). It stops at the site's review page and at any payment page. Terms, sign-in and anything sensitive are left to you.
Connecting your domain to your MDML website. When you press "Connect for me" on mdmltechnologies.com, it opens your domain provider's DNS page. You sign in there yourself and check the list of changes. After you press Apply, it adds the two records your website needs, below.
Order. RoleCall plans what your business needs to order. MDML Connect opens each store in your own signed-in browser, finds each item and puts it in the cart in the planned amount. It asks you to confirm a product it picks for the first time. It never removes anything you already had in a cart.
Autopilot (off unless the owner turns it on and accepts its terms in RoleCall): it can take MDML's sure product picks without asking, move on through a filing website's pages without asking at each step, and, only for a store the owner set to "Place the order", press that store's own Place order button after three practice runs, inside the owner's spending limits (section 11).
Receipts. It opens your order history at the stores you buy from, reads each new receipt or invoice and files it in RoleCall, which checks it against the cart and your usual prices. Supplier statements (PDF files on the supplier's own website) are filed too. It only reads there.
Product finder. From RoleCall's Product finder page, it searches sites RoleCall can't reach on its own (such as Facebook Marketplace, Google Shopping, eBay's sold listings, or a site you add) in your own browser and reads the results, so RoleCall can tell you what a product sells for.
Content Studio. On your business's own connected Instagram profile, it reads the post cards that are showing, so RoleCall's Content Studio knows what you have already posted.
Report a problem. You tell MDML's team something went wrong, in your own words, with a screenshot you see first.

The two website records:

an A record for your bare domain (@) pointing to 76.76.21.21
a CNAME record for www pointing to cname.vercel-dns.com

2. Signing in with RoleCall

You press "Sign in with RoleCall" in the extension's toolbar button. Chrome opens RoleCall's own sign-in page (app.mdmltechnologies.com) in a small window. You sign in there and approve MDML Connect. MDML Connect never sees your password. Once you have approved it, a later sign-in may finish without showing the window again.
RoleCall then gives the extension two keys (OAuth tokens). They reach only what you approved: your business's filing info and the answers you type; with ordering on your account, its order plan, carts, Autopilot settings and receipts; with Content Studio, its connected profiles (asked for separately); and your problem reports. They can't reach anything else in your RoleCall account.
Both keys stay on your computer. The short-lived key lasts an hour and is kept in Chrome's session memory, gone when Chrome closes. The sign-in key is kept in Chrome's storage on this computer so you stay signed in. It is replaced every time it's used, and stops working after 30 days without use.
Sign out (in the toolbar button) cancels the sign-in key at RoleCall and deletes both keys from your computer. You can also switch MDML Connect off in RoleCall (Settings → Keys).

3. Who it talks to

MDML's own server, app.mdmltechnologies.com. No analytics, no ads, no trackers, and no code loaded from the internet. Everything it runs ships inside the extension, and our build fails if any other network call appears in it.
It calls MDML for: signing in and out; which features are unlocked for your account; filling forms, finding official websites and public answers; order plans, product picks, what it put in each cart, and help reading a store page it doesn't recognise; Autopilot's settings and its check before an order is placed; filing receipts and statements; saving your Instagram grid; and problem reports.
The websites you use it on, in their own tabs, as your browser normally would. Two exact cases go further, both in that site's own tab with your own session: reading a supplier statement PDF from the same website, and asking a supplier's website for its invoice report the way that site's own "Run Report" button does.
A problem report's screenshot is uploaded through a one-time link RoleCall gives for it, straight into MDML's private storage.
Connecting your domain makes no network calls at all. It reads and changes the records on your provider's page, in your browser.
What the Product finder reads is not sent to MDML's server. It goes only to the RoleCall page in your browser that asked for it.
It never sends cookies. Your sign-in key is the only thing that identifies you to MDML.

4. What it sends to MDML

The blank layout of a form you chose to fill. Only after you press "Fill this page", or when "Go there for me" reaches the form you asked for. That means each box's name, type and label, the section headings, length limits and the choices in each list, plus the form's title and the page's address without the part after "?". Never what's typed in the form. Labels are cleaned first: anything that looks like an email address, a phone number, a Social Security number or a long number is removed.
Answers you type in its panel. If a form needs something your account doesn't have yet, MDML Connect asks you in its own panel, in plain words. What you type there is saved to your business's RoleCall account, so you don't have to type it again.
How a fill went, if you tell it. Which boxes you had to correct and whether it went through. Never the values.
Your OK to the filing terms, once, with the date and the terms' version.
For "Go there for me": which official page it is on (its address without the part after "?") and the label of the button that moved it forward, so the route is quicker next time. Never anything typed.
For "Find it for me" and "Look it up": the words you typed, or one box's label, the form's title and the website's name.
For Order: the item it is looking for and the store's search results it could choose from (each product's title, size, price, unit price and whether it's in stock), what it put in each cart and what it couldn't, and the store's search and page addresses that worked, so the next run is quicker. When a store's page isn't one it can read on its own, a short text outline of that page, with your address, name, email, phone and any card numbers taken out. No screenshot.
For Autopilot: your OK to its terms (date and version) and your settings. Before an order is placed: the store, the checkout's total and the cart's lines, so RoleCall can check them against your plan and limits. After: the total and the store's order number.
For Receipts: the text of your orders and receipt pages at those stores, as short rows with their links, after card numbers, gift-card codes, emails and phone numbers are taken out, and never anything typed in a box. Your delivery address goes separately, only so RoleCall can tell the business's deliveries from personal ones; RoleCall compares it and doesn't keep it. Supplier statement PDFs you collect.
For Content Studio: the link, the picture's address and the position of each post card showing on your connected profile. Only the business's owner can do this, and only for a profile connected to the business in RoleCall.
With a problem report: your words and the kind of problem you picked; the screenshot, if you keep it; the address of the tab you reported from without the part after "?"; MDML Connect's version; your browser's type, time zone, language and window size; and MDML Connect's own last 20 status lines (its steps and the site's address, cleaned of emails, long numbers and anything after "?"). Never what you typed on a website, passwords or card numbers.

5. What comes back

Your business's own saved answers for the boxes on that form, and which box each one goes in. They are typed into the page on your computer, and only after you press "Fill these in".
The list of features unlocked for your account (signed by MDML), your list of filings and the official websites where they start, and the official pages and public answers it found.
Today's order plan and, for each search, which product is your item (or that none clearly is), plus, when a page needs it, which control to press or read next. Before Autopilot places an order, RoleCall's yes or no.

6. What MDML keeps

Your filing info: the answers you or a manager saved, in your business's RoleCall account.
The shared lessons library: what a form looks like (its blank layout) and which saved answer belongs in each box, and which addresses work on a store's or filing site's pages, so the next run is better for everyone. It holds no personal data. Anything that matches a business's saved answers, or looks like an email address, phone number, Social Security number, EIN or long number, is removed before it is saved.
A private filing record for each business: for each fill, the site, the form, the time, the outcome you report, which saved answer (by its field name) went in each box, and a one-way fingerprint of each value (a SHA-256 hash), never the value itself. Only your business's account can see it. It is deleted after 2 years.
Your business's ordering records: the products you confirmed for each item, each cart run (what went in, what didn't), Autopilot's settings and your OK to its terms, and each order it placed (store, total, order number).
Your business's purchase records: the receipts it read (store, date, products, quantities and prices) and the supplier statement PDFs, kept privately for your business.
Your Instagram grid: the post links, picture addresses and positions it read, in your business's Content Studio.
Problem reports: what each report holds (section 4), for MDML's support team. A screenshot is checked and its hidden data (such as location) removed before it is kept, in MDML's private storage.
Not kept: a page's text outline sent for help reading it, and the delivery address on a receipt.
AI: OpenAI, our one AI provider, processes some of this for us: a new form's blank layout (never anyone's answers, sent with storage turned off), the words for "Find it for me" and "Look it up" (it searches the web for official pages and public answers), a store's search results to pick your product, a store page's cleaned text outline, and your receipts' cleaned text rows. OpenAI doesn't use this to train its models.
How long, and deleting it: everything above stays with your business's account until you delete it in RoleCall or ask us to, except the filing record (2 years). Email us at the address below and we delete it within 30 days, except records we must keep for billing and tax.
Your MDML account itself is covered by MDML's main Privacy Policy.

7. What it keeps on your computer

The task in progress (a form, a domain, a cart run, a receipts run or a product search: its steps, its live status and a short log) in Chrome's session memory. It's gone when you close Chrome.
The two sign-in keys described in section 2.
The list of features unlocked for your account (feature names and when the list expires; no name and no email) and your list of filings for "Go there for me", so its toolbar button can show them.
Your switches ("Fill my carts when RoleCall asks", "Collect my receipts every night"), a copy of your Autopilot settings, the last receipts run in counts and store names, and, for each store, the page where its store starts and the tab it used, so the next run doesn't open another.

8. What it never does

It never signs, submits, uploads or accepts terms for you, and never presses a site's final Submit or Pay on a filing. You press those yourself.
It never checks out or places an order, except under Autopilot's "Place the order" for a store the owner set that way (section 11). It never cancels, returns or reorders, and never removes anything you already had in a cart.
It never reads, fills in or stores passwords, security codes, Social Security numbers, bank account numbers or card numbers. It leaves those boxes to you.
It never sends what's typed in a form anywhere, never reads or stores cookies, and never looks at your browsing history or at pages outside the task you started.
It never runs on sign-in pages, and never on bank or card websites. You always sign in to other websites yourself. It never tries to get past a site's robot check.
On Instagram and the Product finder's sites it only reads: it never posts, likes, follows, messages anyone or reads your messages.
MDML never sells your information or uses it for advertising. MDML's use of information received through the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

9. Where it runs

Installing it gives it access to no website.
Fill this page, Report a problem and Content Studio work only on the tab in front when you press the toolbar button, and only after you press it (Chrome's "active tab" permission). It ends when that tab goes to another page.
Every other website is asked for one at a time, the first time you start a task there: MDML Connect's own page says which website and why, and Chrome asks you to confirm. That covers official filing websites (for example efile.sunbiz.org), the domain providers' domain management pages (dcc.godaddy.com, my.ionos.com and its country sites, ap.www.namecheap.com, account.squarespace.com, porkbun.com/account and hpanel.hostinger.com), the stores in your order plan and receipts, and the Product finder's sites.
It runs only in the tab it opened for that task, or in that store's tab.
You can take any of these permissions back at any time in Chrome's extension settings.
Tasks start from its own toolbar button, from your two switches, or from MDML's own website (mdmltechnologies.com, including RoleCall at app.mdmltechnologies.com). A page on MDML's website can start one only with a short-lived approval signed by MDML's server for that exact task, which it checks on your computer. No other website can start anything.

10. Connecting your domain: what it reads and changes

In the tab it opened, it reads the DNS records listed for your domain (each record's type, name and value). It uses them on the spot to show you what will change and to check the result. It doesn't keep them or send them anywhere.
Nothing until you press Apply. You see every change first, in plain words, with the old values.
It adds or updates only the two records above. So that they work, it may remove records that would clash with them (an old A record for the bare domain, an old www record, or your provider's parking or redirect record). Each removal is in the list you approve.
It never changes or removes email records (MX), TXT records, nameservers or any other record.
When it finishes, it tells the MDML page that started it how it went, inside your browser, so that page can check your domain now reaches your site.

11. Autopilot and placing orders

Off unless the owner turns it on. Only the business's owner can, after reading and accepting its terms in RoleCall. Managers and staff see it but can't change it.
Per store: each store is "Add to cart only" (the default) or "Place the order". "Fill carts" never places an order, whatever a store is set to.
Before it presses anything: the cart must hold only what the plan asked for, and RoleCall checks the checkout's total and items against your plan, your usual prices and your spending limits (per order and per week, set in RoleCall → Settings → Agent). A large price jump or a limit stops it, and the cart is left ready for you.
Three practice runs per store first: it stops at the store's Place order button and shows you where it would press.
What it presses: only the store's own Place order (or Complete) button, once. It uses the payment method and address already saved at that store. It never types a card number, security code or password, never ticks a terms box and never passes a robot, age or identity check; any of those stops it and the order is left to you.
After: RoleCall records the order (store, total, order number) and tells you.

12. The permissions it asks Chrome for

Identity: to open RoleCall's own sign-in page for "Sign in with RoleCall". It doesn't read your Google account or your email address.
Storage: to keep the task in progress, your sign-in keys, your switches and settings and your list of unlocked features, as described in section 7.
Active tab: to work on the tab in front when you press the toolbar button (Fill this page, Report a problem's screenshot, Content Studio), only after you press it.
Scripting: to run its own packaged scripts on that tab, or on a website you allowed, never code from anywhere else.
Side panel: to show its live status (what it's doing, what's next, and when it's your turn) in Chrome's side panel.
Notifications: to tell you once when a task needs you, or has finished, while you're looking at another tab.
Alarms: only for your two switches, both off unless you turn them on: to ask your RoleCall account every 2 minutes whether a cart is ready to fill, and to collect the day's receipts once a night.
Access to particular websites, asked one site at a time: the websites in section 9, only when you start a task there.
Messages from mdmltechnologies.com: so your MDML pages can start a task and see how it went.

13. Removing it

In Chrome, open chrome://extensions, find MDML Connect and press Remove. Or right-click its icon in the toolbar and choose Remove from Chrome. Everything it kept on your computer goes with it. To cancel its sign-in at RoleCall too, press Sign out first, or switch it off in RoleCall (Settings → Keys). The records it added stay at your domain provider, because your website needs them; you can change or delete them there at any time. To delete what MDML keeps (section 6), contact us below.

14. Changes and contact

If what MDML Connect does with information ever changes, we update this page and its date before releasing that version.

Questions: support@mdmltechnologies.com — MDML Technologies LLC, Florida.