Privacy Policy

Effective October 15, 2026

1. Information we process

• Account and billing: name, email, account and reseller identifiers, plan, verification timestamps, purchase and subscription status, checkout reservation identifiers and expiry, and Stripe transaction identifiers. Stripe collects your payment-card details. Magically Linked does not store your full card number. For historical individual trials, Stripe card fingerprints may be retained to enforce their eligibility; they do not reveal the card number. The current Founding Partnership is a paid purchase without a trial.
• Authentication: password hashes, session records, API-key records and permissions. The extension stores its Magically Linked session locally in your Chrome profile. Optional LinkedIn login may store the linked LinkedIn identity needed for sign-in.
• Workspace: connected LinkedIn account IDs and profiles, contacts, usernames, notes, tags, pipeline stages, deal amounts, tasks, audiences, workflow settings and activity history.
• Messages and content: conversation participants, relevant message and comment text and metadata, recent thread context, saved replies, brand instructions, AI prompts and responses, drafts and uploaded media used by enabled features.
• Operations: connection state, usage counts, job progress, timestamps and errors. Authentication receives IP addresses and uses failed-login counters to protect accounts.
• Website activity: visited pages, interactions, referrals, browser/device information and identifiers used for analytics and attribution. Theme preferences and sign-in also use browser storage.

2. Browser connection and inbox choice

The extension reads relevant LinkedIn pages and uses your existing signed-in LinkedIn session. Magically Linked does not ask for your LinkedIn password. Read-request templates and session-associated request headers are handled locally on LinkedIn for requests to LinkedIn; these authentication values are not uploaded as workspace data. The extension does not collect your general browsing history for advertising.

Inbox synchronization requires a separate choice in connection or account settings. When enabled, available participants, message text and conversation history are copied through the Magically Linked API into your workspace for CRM context, reply detection and enabled replies. Turning off automation stops automated LinkedIn actions; approved inbox synchronization may continue. Turn inbox sync off to stop new collection; requests already sent may finish. Previously saved records remain until deleted and can be used by features you leave enabled.

Inbox synchronization records attachment text and metadata rather than automatically copying attachment files. If you enable photo analysis, relevant photos may be copied to our storage and sent to your AI provider for a description. Stored analysis photos are scheduled for cleanup after 90 days; descriptions can remain with the conversation.

3. Uses and service providers

We use information for account access, subscriptions and trial eligibility, workspace synchronization, workflows you enable, AI assistance, transactional email, support, service reliability and website measurement. Authorized resellers can manage customer accounts within their permissions. We may disclose information when required by law or needed to protect rights and security.

• Cloudflare: website/API hosting, network services, database connectivity and media storage. See Cloudflare’s privacy policy.
• Supabase: PostgreSQL hosting for account, workspace, settings, communication and activity records. Our API connects through Cloudflare Hyperdrive.
• Stripe: embedded checkout on Magically Linked, payment confirmation, subscriptions, renewals and billing management. Stripe handles payment data under its privacy policy.
• Mailgun: account and workflow email delivery, including recipients, message content and delivery information. Follower summaries can include names, profile links, image URLs and recorded counts. You can change follower-summary email settings in Follower Tracker.
• OpenRouter, Anthropic and your selected model providers: AI features send relevant prompts, workspace context and media to the configured provider. OpenRouter can route requests to the model provider you select. Provider handling depends on its terms and your configuration; Magically Linked does not promise universal zero retention or training exclusion. See OpenRouter’s privacy policy. Your provider account may incur usage charges.
• Chirply: the marketing website includes Chirply’s measurement script for site activity and attribution. This website measurement is separate from extension inbox synchronization; the marketing script is not given your LinkedIn message history by that integration.
• LinkedIn: browser reads and authorized actions communicate with LinkedIn. Data already held by LinkedIn or message recipients remains subject to their controls and policies.

4. Cookies, browser storage and integrations

Necessary account cookies support sign-in. The site and app remember appearance preferences in local storage or a theme cookie. The extension keeps its connection state and bounded read continuations locally. Founding checkout keeps recovery information in the current tab’s session storage so a refresh can resume the existing reservation. Marketing analytics and checkout services may use cookies or similar identifiers. You can manage browser storage and available analytics choices; blocking necessary storage may affect sign-in or checkout.

When you connect an API or MCP client, that client can receive information within its granted permissions. Review the third party’s practices and protect your access tokens. Copilot requests can use the same permitted workspace operations and may include workspace context in AI requests.

5. Retention and deletion

We retain information for service delivery, requested operations, security and applicable obligations. Retention varies by record and purpose. Purchase, security, compliance and backup records may remain after account closure where needed. Card fingerprints used for trial eligibility can remain to prevent repeated trials. We do not promise that uninstalling the extension deletes server-held information.

Contact us to request account closure, deletion or a copy of your information, including if your information appears in a customer’s workspace. We may verify your authority and will explain records that must be retained. Removing the extension removes its extension-local storage from that Chrome profile; it does not cancel a subscription or reverse LinkedIn actions. Separately manage any copies held by LinkedIn, recipients or connected third-party services.

6. Security, location and your choices

We use HTTPS, password hashing, authentication and account access controls. No system can guarantee absolute security. Providers may process information in the United States and other locations, with applicable safeguards where required. You can pause workflows, revoke integrations, change settings, disable inbox sync or contact us about your information.

Depending on your location, you may have rights to access, correct, delete, restrict, object to processing or receive a copy of information, and to contact a privacy authority. We handle requests according to applicable law. Contact jon@vaughnlabs.io.

7. Children and changes

The service is intended for adults and is not directed to children under 18. Contact us if you believe a child has supplied personal information. We will update this policy when practices change and provide further notice or obtain consent where required.