Your Privacy Matters
Learn how UserWins AI collects, uses, and protects your information when you use our Chrome extension and services.
Scope and Applicability of Data Collection Practices
Personally Identifiable Information (PII) and Authentication Credentials
Email addresses and cryptographically hashed authentication credentials utilized for account provisioning, user verification, and secure access management in accordance with industry-standard security protocols
Personal nomenclature data and professional network profile identifiers provided during the initial registration and onboarding process, subject to user consent and data minimization principles
User-defined configurational preferences including but not limited to communication tone parameters, content generation specifications, target audience demographics, and algorithmic output length constraints
Behavioral Analytics and Usage Intelligence
Comprehensive comment generation telemetry, including frequency metrics, success rates, and algorithmic performance indicators collected for service optimization purposes
Transient processing of LinkedIn post content data (subject to ephemeral handling protocols with no persistent storage mechanisms)
Extension interaction patterns, feature utilization statistics, and user engagement behaviors analyzed through privacy-preserving methodologies
Technical Infrastructure and System Information
Browser fingerprinting data including user agent strings, rendering engine versions, and extension compatibility metrics
Distributed system performance indicators, latency measurements, and error reporting data
Network-level identifiers (IPv4/IPv6 addresses) and geolocation approximations processed for security threat detection and fraud prevention
Data Processing Legal Basis and Utilization Framework
Primary Service Delivery and Contract Performance
Artificial intelligence-driven content generation leveraging natural language processing algorithms to produce contextually appropriate professional communications based on user-specified parameters
Account lifecycle management including user authentication, session maintenance, and technical support provisioning
Financial transaction processing and subscription management services in compliance with PCI DSS standards
Legitimate Interest in Service Enhancement and Innovation
Statistical analysis of user behavior patterns to optimize machine learning model performance and algorithmic accuracy
Product development initiatives including feature enhancement, user experience optimization, and platform scalability improvements
System monitoring and performance analytics for infrastructure reliability, security incident response, and operational excellence
Legal Compliance and Communication Obligations
Regulatory compliance notifications regarding service modifications, security incidents, or policy amendments as required by applicable data protection legislation
Customer relationship management including technical support, account inquiries, and dispute resolution procedures
Opt-in marketing communications delivered through electronic channels (subject to explicit user consent and unsubscribe mechanisms)
Third-Party Data Sharing and Processor Arrangements
Artificial Intelligence Processing Partnerships
OpenAI and Anthropic API services utilized for natural language generation with transient data transmission protocols (zero-retention policies enforced)
Encrypted data channels and API security measures ensuring confidentiality during processing operations with immediate data purging post-completion
Infrastructure Service Providers
Supabase database-as-a-service platform for secure data persistence, user authentication, and real-time data synchronization with enterprise-grade encryption
Railway cloud hosting infrastructure providing containerized application deployment with SOC 2 Type II compliance and multi-layered security controls
All third-party processors maintain comprehensive security certifications including ISO 27001, SOC 2, and GDPR compliance frameworks
Data Protection Commitment and Non-Disclosure
Categorical prohibition on the commercial sale, licensing, or monetization of personal data to advertising networks, data aggregators, or marketing platforms
Strict compartmentalization of LinkedIn content data with no cross-platform sharing or external distribution mechanisms
Absence of behavioral targeting, profiling for advertising purposes, or participation in data broker ecosystems
Information Security Architecture and Data Protection Measures
Cryptographic Security and Network Protection
Transport Layer Security (TLS) 1.3 encryption for all client-server communications with Perfect Forward Secrecy (PFS) and Certificate Transparency compliance
Bcrypt password hashing with adaptive cost factors exceeding industry benchmarks (minimum 12 rounds) and salted hash generation
Database-level encryption at rest using AES-256-GCM with key rotation policies and hardware security module (HSM) key management
Data Retention Policies and Lifecycle Management
Active account data retention aligned with service provision requirements and user engagement patterns, subject to configurable retention periods
Comment generation history maintained for a maximum of ninety (90) calendar days with automated purging mechanisms and secure deletion protocols
Real-time LinkedIn content processing with zero-persistence architecture ensuring immediate data destruction post-processing completion
Access Control Matrix and Operational Security
Role-based access control (RBAC) implementation with principle of least privilege enforcement and multi-factor authentication requirements for administrative access
Continuous security monitoring including intrusion detection systems (IDS), vulnerability scanning, and penetration testing conducted by certified security professionals
Automated anomaly detection and incident response protocols with real-time alerting for unauthorized access attempts and suspicious behavioral patterns
Data Subject Rights and Privacy Control Mechanisms
Account Self-Service and Data Portability
Comprehensive account management interface providing real-time access to personal information, preference modifications, and profile data updates through authenticated extension dashboard
Right to data erasure (Right to be Forgotten) with complete account deletion functionality and cascading data removal across all system components within 30 days
Data portability compliance enabling export of personal data in machine-readable formats (JSON, CSV) within legally mandated timeframes
Privacy Preference Center and Consent Management
Granular marketing communication controls with category-specific opt-out mechanisms and preference persistence across all communication channels
Advanced privacy settings for comment generation parameters, data usage limitations, and algorithmic behavior customization
Selective permission management for LinkedIn content access with per-domain and per-post granular control mechanisms
Legal Rights Under Data Protection Regulation
Right to information transparency including detailed data processing disclosures, third-party sharing arrangements, and retention policy documentation
Right to rectification enabling correction of inaccurate personal data with verification procedures and update propagation across integrated systems
Right to restrict processing with temporary data freezing capabilities and conditional processing limitations (subject to legal and contractual obligations)
Browser Extension Technical Specifications and Permission Architecture
Chrome Extension Permission Matrix
activeTab permission: Limited-scope access restricted to currently active LinkedIn domain tabs with session-based authorization and automatic permission revocation upon tab closure
storage permission: Utilization of Chrome's encrypted storage APIs for secure persistence of user preferences, authentication tokens, and configuration data with sandbox isolation
scripting permission: Deployment of content script injection for DOM manipulation limited to comment detection algorithms and user interface enhancement within LinkedIn's content security policy boundaries
Client-Side Data Storage Architecture
Authentication token persistence within Chrome's secure storage compartment using encrypted key-value pairs with automatic token refresh mechanisms
Strict prohibition on localStorage or sessionStorage utilization for sensitive data with comprehensive data classification and handling procedures
Automated data cleanup procedures triggered by extension uninstallation events ensuring complete removal of locally stored information
Policy Amendment Procedures and Change Management
Privacy Policy Evolution and Version Control
Systematic policy review cycles conducted semi-annually or upon significant service modifications, regulatory changes, or business model evolution
Multi-channel notification framework including in-extension notifications, email alerts, and website banners for material privacy policy amendments affecting user rights
Implied consent mechanism through continued service utilization following 30-day notice period, with explicit consent requirements for material changes affecting data processing legal basis
Last Updated: September 12, 2025