Privacy Policy

Devlyn AI · LinkedIn Engagement System
Effective date: June 29, 2026

This Privacy Policy describes how Devlyn AI (“we”, “us”) collects, uses, and protects information when you use the LinkedIn Engagement browser extension, the engagement backend API, and the admin dashboard (together, the “Service”). The Service is intended for authorized participants in your organization’s engagement campaigns.

1. Information we collect

In the data categories used by the Chrome Web Store, the Service handles:

• Personally identifiable information — your LinkedIn display name, public profile handle, and LinkedIn member identifier.
• Authentication information — a session (JWT) access token issued by our backend so you stay signed in.
• Website content and user activity — the LinkedIn post URLs you are assigned to engage with and the like/comment actions performed on your behalf.

The Service does not collect health, financial or payment, precise location, web browsing history, keystroke, or personal-communications (email/SMS/chat) data.

1.1 Browser extension

When you install and use the extension, it may process the following on your device:

1.2 Backend server

When the extension or admin panel connects to our backend, we store:

• Extension users: LinkedIn member identifier, optional public profile handle, display name, synthetic email (@linkedin.local), account creation time, last-seen timestamp, and connection status.
• Campaign data: post URLs, campaign settings, task assignments, and completion records (which user performed which action).
• Admin accounts: admin email and password configured for the deployment (password is verified; we do not expose it via the API).
• Technical logs: standard server and database logs may include IP addresses, request timestamps, and error details.

1.3 Admin dashboard

Administrators sign in with email and password. The dashboard displays user and campaign information retrieved from the backend. We do not use third-party analytics in the default deployment.

2. How we use information

• Authenticate extension users and administrators.
• Coordinate engagement tasks (likes and comments) across campaign participants.
• Display participant status and campaign progress to authorized admins.
• Maintain security, troubleshoot failures, and improve reliability.

Our use of data you provide complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. Specifically, we:

• do not sell or rent your personal information to anyone;
• do not use or transfer your data for advertising, ad personalization, retargeting, or cross-site/cross-app tracking;
• do not use or transfer your data for any purpose unrelated to the Service’s single purpose — coordinating engagement tasks you have opted into;
• do not use or transfer your data to determine creditworthiness or for lending purposes;
• do not allow humans to read your data, except: the organization administrators who operate your deployment (see Section 5), where you give consent, where necessary for security or to fix a bug, or where required by law.

3. Legal basis and consent

By installing the extension, staying logged into LinkedIn, and choosing to participate (not paused), you consent to the collection and use described in this policy for operating the Service. Organization administrators deploy and control the backend; participation is voluntary and can be stopped at any time from the extension popup.

4. Permissions used by the extension

• cookies — read LinkedIn session cookies (li_at, JSESSIONID) to detect login state and obtain a CSRF token for LinkedIn API calls. Cookie values are used only on your device and are not sent to our backend.
• storage — store the backend auth token and local preferences on your device.
• scripting — inject the like/comment automation into the LinkedIn post page when an assigned task runs.
• alarms — retry connection and authentication in the background.
• host permissions — communicate with LinkedIn and your organization’s backend.

5. Sharing and subprocessors

We share data only as needed to operate the Service:

• LinkedIn: when executing tasks, the extension interacts with LinkedIn using your existing browser session.
• Database hosting: user and campaign data is stored in MongoDB (self-hosted or a provider you configure, e.g. MongoDB Atlas).
• Organization administrators: admins can view participant names, connection status, and campaign activity.

We do not share data with other third parties except where required by law.

6. Retention

• Backend user and campaign records are kept until an administrator deletes them or the deployment is decommissioned.
• Extension local storage persists until you uninstall the extension, clear extension data, or use “Stop participating” / sign-out actions where available.
• Server logs are retained for a limited period appropriate for security and debugging.

7. Your choices and rights

• Pause participation: use “Stop participating” in the extension popup to halt new tasks without uninstalling.
• Remove local data: uninstall the extension or clear its site data in browser settings.
• Delete backend account: contact your administrator or email us at hello@devlyn.ai to request deletion of your user record.
• Access or correction: contact us at the address above for a copy of data we hold about you or to correct inaccurate information, subject to applicable law.

8. How we store, handle, and secure data

Data in transit between the extension, the admin dashboard, and our backend is sent over encrypted HTTPS/TLS connections in production. User and campaign records are stored in our MongoDB database; the backend auth token and local preferences are stored on your device in chrome.storage.local. Access is protected by JWT-based authentication and role-based access controls on admin APIs. We apply industry-standard safeguards, but no method of transmission or storage is 100% secure; we recommend using a strong admin password and restricting network access to the backend. We retain data only as described in Section 6.

9. International transfers

Data is processed on servers chosen by your organization. If you access the Service from outside that region, your information may be transferred to and processed in the deployment location.

10. Children

The Service is not directed to children under 16, and we do not knowingly collect information from children.

11. Changes to this policy

We may update this Privacy Policy from time to time. The effective date at the top will change when we do. Continued use of the Service after an update constitutes acceptance of the revised policy.

12. Contact

Questions about this Privacy Policy or data practices:

hello@devlyn.ai
Devlyn AI