logo
Privacy Policy

Your Privacy Matters

Learn how UserWins AI collects, uses, and protects your information when you use our Chrome extension and services.

Scope and Applicability of Data Collection Practices

Personally Identifiable Information (PII) and Authentication Credentials

  • Email addresses and cryptographically hashed authentication credentials utilized for account provisioning, user verification, and secure access management in accordance with industry-standard security protocols

  • Personal nomenclature data and professional network profile identifiers provided during the initial registration and onboarding process, subject to user consent and data minimization principles

  • User-defined configurational preferences including but not limited to communication tone parameters, content generation specifications, target audience demographics, and algorithmic output length constraints

Behavioral Analytics and Usage Intelligence

  • Comprehensive comment generation telemetry, including frequency metrics, success rates, and algorithmic performance indicators collected for service optimization purposes

  • Transient processing of LinkedIn post content data (subject to ephemeral handling protocols with no persistent storage mechanisms)

  • Extension interaction patterns, feature utilization statistics, and user engagement behaviors analyzed through privacy-preserving methodologies

Technical Infrastructure and System Information

  • Browser fingerprinting data including user agent strings, rendering engine versions, and extension compatibility metrics

  • Distributed system performance indicators, latency measurements, and error reporting data

  • Network-level identifiers (IPv4/IPv6 addresses) and geolocation approximations processed for security threat detection and fraud prevention

Data Processing Legal Basis and Utilization Framework

Primary Service Delivery and Contract Performance

  • Artificial intelligence-driven content generation leveraging natural language processing algorithms to produce contextually appropriate professional communications based on user-specified parameters

  • Account lifecycle management including user authentication, session maintenance, and technical support provisioning

  • Financial transaction processing and subscription management services in compliance with PCI DSS standards

Legitimate Interest in Service Enhancement and Innovation

  • Statistical analysis of user behavior patterns to optimize machine learning model performance and algorithmic accuracy

  • Product development initiatives including feature enhancement, user experience optimization, and platform scalability improvements

  • System monitoring and performance analytics for infrastructure reliability, security incident response, and operational excellence

Legal Compliance and Communication Obligations

  • Regulatory compliance notifications regarding service modifications, security incidents, or policy amendments as required by applicable data protection legislation

  • Customer relationship management including technical support, account inquiries, and dispute resolution procedures

  • Opt-in marketing communications delivered through electronic channels (subject to explicit user consent and unsubscribe mechanisms)

Third-Party Data Sharing and Processor Arrangements

Artificial Intelligence Processing Partnerships

  • OpenAI and Anthropic API services utilized for natural language generation with transient data transmission protocols (zero-retention policies enforced)

  • Encrypted data channels and API security measures ensuring confidentiality during processing operations with immediate data purging post-completion

Infrastructure Service Providers

  • Supabase database-as-a-service platform for secure data persistence, user authentication, and real-time data synchronization with enterprise-grade encryption

  • Railway cloud hosting infrastructure providing containerized application deployment with SOC 2 Type II compliance and multi-layered security controls

  • All third-party processors maintain comprehensive security certifications including ISO 27001, SOC 2, and GDPR compliance frameworks

Data Protection Commitment and Non-Disclosure

  • Categorical prohibition on the commercial sale, licensing, or monetization of personal data to advertising networks, data aggregators, or marketing platforms

  • Strict compartmentalization of LinkedIn content data with no cross-platform sharing or external distribution mechanisms

  • Absence of behavioral targeting, profiling for advertising purposes, or participation in data broker ecosystems

Information Security Architecture and Data Protection Measures

Cryptographic Security and Network Protection

  • Transport Layer Security (TLS) 1.3 encryption for all client-server communications with Perfect Forward Secrecy (PFS) and Certificate Transparency compliance

  • Bcrypt password hashing with adaptive cost factors exceeding industry benchmarks (minimum 12 rounds) and salted hash generation

  • Database-level encryption at rest using AES-256-GCM with key rotation policies and hardware security module (HSM) key management

Data Retention Policies and Lifecycle Management

  • Active account data retention aligned with service provision requirements and user engagement patterns, subject to configurable retention periods

  • Comment generation history maintained for a maximum of ninety (90) calendar days with automated purging mechanisms and secure deletion protocols

  • Real-time LinkedIn content processing with zero-persistence architecture ensuring immediate data destruction post-processing completion

Access Control Matrix and Operational Security

  • Role-based access control (RBAC) implementation with principle of least privilege enforcement and multi-factor authentication requirements for administrative access

  • Continuous security monitoring including intrusion detection systems (IDS), vulnerability scanning, and penetration testing conducted by certified security professionals

  • Automated anomaly detection and incident response protocols with real-time alerting for unauthorized access attempts and suspicious behavioral patterns

Data Subject Rights and Privacy Control Mechanisms

Account Self-Service and Data Portability

  • Comprehensive account management interface providing real-time access to personal information, preference modifications, and profile data updates through authenticated extension dashboard

  • Right to data erasure (Right to be Forgotten) with complete account deletion functionality and cascading data removal across all system components within 30 days

  • Data portability compliance enabling export of personal data in machine-readable formats (JSON, CSV) within legally mandated timeframes

Privacy Preference Center and Consent Management

  • Granular marketing communication controls with category-specific opt-out mechanisms and preference persistence across all communication channels

  • Advanced privacy settings for comment generation parameters, data usage limitations, and algorithmic behavior customization

  • Selective permission management for LinkedIn content access with per-domain and per-post granular control mechanisms

Legal Rights Under Data Protection Regulation

  • Right to information transparency including detailed data processing disclosures, third-party sharing arrangements, and retention policy documentation

  • Right to rectification enabling correction of inaccurate personal data with verification procedures and update propagation across integrated systems

  • Right to restrict processing with temporary data freezing capabilities and conditional processing limitations (subject to legal and contractual obligations)

Browser Extension Technical Specifications and Permission Architecture

Chrome Extension Permission Matrix

  • activeTab permission: Limited-scope access restricted to currently active LinkedIn domain tabs with session-based authorization and automatic permission revocation upon tab closure

  • storage permission: Utilization of Chrome's encrypted storage APIs for secure persistence of user preferences, authentication tokens, and configuration data with sandbox isolation

  • scripting permission: Deployment of content script injection for DOM manipulation limited to comment detection algorithms and user interface enhancement within LinkedIn's content security policy boundaries

Client-Side Data Storage Architecture

  • Authentication token persistence within Chrome's secure storage compartment using encrypted key-value pairs with automatic token refresh mechanisms

  • Strict prohibition on localStorage or sessionStorage utilization for sensitive data with comprehensive data classification and handling procedures

  • Automated data cleanup procedures triggered by extension uninstallation events ensuring complete removal of locally stored information

Policy Amendment Procedures and Change Management

Privacy Policy Evolution and Version Control

  • Systematic policy review cycles conducted semi-annually or upon significant service modifications, regulatory changes, or business model evolution

  • Multi-channel notification framework including in-extension notifications, email alerts, and website banners for material privacy policy amendments affecting user rights

  • Implied consent mechanism through continued service utilization following 30-day notice period, with explicit consent requirements for material changes affecting data processing legal basis

Last Updated: September 12, 2025