Ln2CRM logoLn2CRM
Login/Register Get started for Free

Privacy Policy

Last updated:

This Privacy Policy explains how Ln2CRM (“Ln2CRM”, “we”, “us”) collects, uses, shares, and protects information when you use our websites, browser extension, and related services (collectively, the “Service”).

Ln2CRM helps you save time by transferring selected profile and company information from professional networking pages to your CRM, and by enabling CRM-side actions from the sidebar (e.g., create/update records, add notes/tasks, check duplicates).

1) Scope and roles

Depending on what you do with the Service, Ln2CRM may act as:

  • Data controller for account, billing, security, and website analytics data that we determine.
  • Data processor for CRM-related content you choose to sync (e.g., contact/company fields, notes, tasks), where you control the purpose and content.

2) Information we collect

2.1 Account and identity

  • Email address, password hash (if you sign up with email/password), and account settings.
  • OAuth identity (Google/Microsoft): provider identifier and basic profile fields returned by the provider (typically email and a stable “sub” identifier).
  • Email verification status (when applicable).

2.2 CRM connection data

  • CRM provider selection and connection status.
  • Encrypted OAuth tokens / API keys needed to connect to your CRM (stored encrypted at rest).
  • Field mapping configuration and preferences (e.g., which CRM fields map to LinkedIn URL / company domain).

2.3 Usage and operational data

  • Basic usage counters (e.g., number of creates/updates, feature usage events) to run the Service, enforce plan limits, and improve reliability.
  • Security and audit logs (e.g., sign-in events, suspicious activity signals, connection failures) to prevent abuse and troubleshoot issues.

2.4 Device and technical data

  • Browser and device info (e.g., browser type/version, OS, language, time zone).
  • Approximate location derived from IP (city/region level) and network diagnostics (for security and reliability).

2.5 Profile data you choose to sync

When you use the extension on a supported page, you may choose to send profile/company information to your CRM. Ln2CRM processes only what is needed to perform your requested action (e.g., create/update a CRM record). We do not “bulk scrape” your account in the background without your actions.

2.6 Synced CRM contact index

To show, instantly and without a live API call per profile, whether a person or company is already in your CRM, and to link a LinkedIn conversation to the correct existing record, Ln2CRM keeps a lightweight index of the contacts in the CRM you connect. This index holds only the minimum match keys, not a full copy of your contact records. Specifically:

  • the CRM record identifier, its module/type, and its last-modified timestamp;
  • the contact's name (and normalized name tokens used for matching) and company name;
  • a LinkedIn identifier derived from the profile URL linked to that record;
  • the contact's email address, encrypted at rest (AES-GCM).

The index does not include note or message content, phone numbers, or other CRM fields. It is synced from the CRM you connected, refreshed periodically, and is deleted when you disconnect that CRM or delete your account. It is used only to power the in-page presence badge and record matching; it is never sold or shared.

3) Browser extension permissions

The extension requests only the minimum permissions necessary for its core features:

  • activeTab / scripting: to read the LinkedIn profile page you are currently viewing, only when you explicitly trigger an action (e.g., click "Save to CRM"). The extension does not read pages in the background or on other tabs.
  • storage: to persist your settings, authentication token, and UI preferences locally in your browser.
  • sidePanel: to display the Ln2CRM sidebar panel within your browser window.
  • tabs: to detect when you navigate to a supported LinkedIn page, so the extension can become active.

We do not use extension permissions to read your browsing history, access pages unrelated to the Service, or collect data without your explicit in-session action.

3b) CRM permissions we request (OAuth scopes)

When you connect a CRM, we ask that provider only for the access our features need. What we request depends on the CRM:

  • Pipedrive: read and write your persons, organizations, deals, notes and activities, and read your users list, so we can create and update records, log notes and tasks, and match existing contacts. These scopes are configured on our Pipedrive app.
  • HubSpot: read and write contacts, companies and deals; read owners and object schemas; read timeline events; read sales email records; and read a meeting scheduling link. The email scope is used only to reflect a conversation you choose to sync into a CRM note.
  • Zoho: read and write your CRM modules (contacts, leads, deals and so on); read your users, organization, pipelines and layouts; read field definitions; create a single custom field for the LinkedIn URL when a module does not already have one; and read email records to show recent communication and to mirror a conversation you sync. The field creation permission is used only to add that one LinkedIn URL field, never to change your existing fields.
  • Salesforce: full API access on your behalf, plus offline refresh. Salesforce does not offer the granular per object scopes the others do, so its standard "api" scope is required to read and write the same records (contacts, leads, accounts, opportunities, notes and tasks).

We read or write records only when you take an action in the extension, or when a feature you enabled (such as message sync) runs on a conversation you opened. We do not bulk export your CRM, and we do not touch data unrelated to the person or company you are working on. You can disconnect a CRM at any time to revoke this access.

4) How we use information

  • Provide the Service: authentication, account management, CRM sync actions you request, and feature delivery.
  • Instant CRM matching: we keep the lightweight contact index described in Section 2.6 for one purpose only, to show without a live API call per profile whether a person or company is already in your CRM, and to link a LinkedIn conversation to the correct existing record. It is not used for profiling, advertising, resale, or any other purpose.
  • Security: prevent abuse, detect suspicious sign-ins, protect accounts, and secure CRM connections.
  • Support: respond to requests and troubleshoot issues (including integration debugging).
  • Product improvement: understand performance and feature usage to improve UX, stability, and reliability.
  • Billing and compliance: manage subscriptions, invoices, and comply with applicable laws.

4b) AI Copilot data processing

When you use the AI Copilot feature, Ln2CRM assembles a context packet from your CRM records (e.g., contact name, job title, notes, recent emails, company info) and sends it to our AI provider (currently OpenAI) to generate a draft message or comment. By using this feature:

  • You consent to relevant CRM context being processed by OpenAI under their privacy policy and API terms.
  • Do not submit sensitive personal data (e.g., health information, financial details, government IDs) as AI Copilot input.
  • We do not use AI Copilot inputs to train our own models.
  • AI-generated outputs are not stored by us beyond what is necessary for the immediate session.

4c) Email & Phone Enrichment

Ln2CRM can find a work email for a person you are about to save, check whether an email address is deliverable, and, with your own provider key, find phone numbers. Here is exactly what happens:

  • Built-in email search. When you click ✨ next to an empty Email field, or open the create form with "Find the email automatically" switched on in Settings, our backend sends the person's first name, last name and company (or company domain) to our email-finding provider, Icypeas, and returns the email it finds. This search is included in your plan and counted against its monthly email finds.
  • Email checks. When an email address is shown in the create form or on a linked CRM record, Ln2CRM checks whether it is deliverable and shows a green or yellow check. For this, the email address is sent to Icypeas. The verdict is cached for 30 days under a one-way hash of the address, so the same address is not checked again in that time.
  • Your own provider keys. You can add your own FullEnrich or Apollo API key in Settings. We encrypt the key at rest (AES-GCM) and never expose it back to the browser. When that provider's turn comes in your search order, our backend forwards the LinkedIn URL and the name and company hints from the form to that provider using your key. Phone numbers are found only this way.
  • Searches that finish after you save. If you save the person while a search is still running, the search continues on our backend and writes the result into that CRM record, or into a note on it when the field already has a value. Nothing is written to a record you did not save.
  • What we keep, and for how long. For each search we keep the person's name, a key of the LinkedIn profile, the value found (email or phone), the provider used and the verdict for 30 days, so you can see your enrichment history in Settings and so reopening the same profile reuses the result instead of paying again. After 30 days these fields are deleted. The search inputs themselves are deleted as soon as the search finishes. We do not build a contact database from these results and we never sell or share them.
  • Billing. Built-in email finds are part of your Ln2CRM plan. Searches through your own key are billed by your provider directly per their plan; Ln2CRM never marks up their credits.
  • Sub-processors. Icypeas processes the names, companies and email addresses described above for the built-in search and checks. The provider of a key you add (FullEnrich or Apollo) processes the data sent with that key. Their privacy policies and data processing terms govern that processing, for example the FullEnrich DPA.
  • Your choices. Leave automatic search off to search only when you click ✨. Remove your own keys in Settings to stop calls to those providers. Removing a key does not affect data already saved to your CRM.

We do not sell your personal data. We share data only as described below:

  • CRMs you connect: when you run a sync action, data is sent to your selected CRM provider (Pipedrive, HubSpot, Zoho, Salesforce, Capsule) based on your explicit configuration and action.
  • AI provider (OpenAI): CRM context data you submit via the AI Copilot feature is processed by OpenAI. See Section 4b.
  • Enrichment providers: Icypeas for the built-in email search and email checks (name, company, email address), and FullEnrich or Apollo only if you add your own key for them (LinkedIn URL and name/company hints). See Section 4c.
  • Hosting and infrastructure: our backend runs on cloud infrastructure. Data is stored on servers operated by our hosting provider.
  • Email delivery: we use a third-party email provider to send account verification and security notification emails.
  • Payment processor (Paddle): billing and subscription data is handled by Paddle. We do not store full payment card details. Paddle's privacy policy applies to payment processing.
  • OAuth providers (Google, Microsoft): if you sign in via OAuth, we receive only the profile fields returned by the provider (typically email and a stable identifier). We do not access your Google Drive, Outlook, or other connected services.
  • Legal/safety: if required to comply with a legal obligation, court order, or to protect the rights, property, or safety of Ln2CRM, our users, or the public.
  • Business transfers: in the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you before data is subject to a different privacy policy.

7) Retention

  • Account data: kept while your account is active; deleted or anonymized within a reasonable period after account deletion, unless required for legal reasons.
  • Logs: retained for security and troubleshooting for a limited period, then deleted or aggregated.
  • Deletion feedback: if you delete your account, we retain your email address and the reason you provide for up to 12 months to contact you individually about product improvements (our legitimate interest). This is not used for bulk marketing. You can request complete erasure of this data at any time at admin@ln2crm.com.
  • CRM tokens: stored only while the connection is enabled; you can disconnect at any time to revoke/erase stored credentials on our side.
  • Synced CRM contact index: kept only while the CRM connection is enabled; removed when you disconnect that CRM or delete your account. Emails in the index are encrypted at rest.

8) Security

We use industry-standard measures to protect data (including encryption at rest for sensitive secrets, access controls, and audit logging). No method of transmission or storage is 100% secure, but we continuously work to reduce risk.

9) Your choices and rights

Depending on your location, you may have the following rights regarding your personal data:

  • Access: request a copy of personal data we hold about you.
  • Correction: request correction of inaccurate or incomplete data.
  • Deletion: request deletion of your account and associated personal data, subject to legal retention requirements.
  • Portability: request your data in a structured, machine-readable format where technically feasible.
  • Restriction / Objection: object to or request restriction of certain processing activities (where applicable under GDPR).
  • Withdraw consent: where processing is based on consent, you may withdraw at any time without affecting the lawfulness of prior processing.
  • Disconnect CRM: remove your CRM connection at any time via Settings — this removes stored credentials from our system immediately.
  • Opt out of marketing emails: use the unsubscribe link in any marketing email. Service emails (account, security) may still be sent.

To exercise any of these rights, email us at admin@ln2crm.com. We will respond within 30 days. We may request verification of your identity to protect your account before fulfilling requests.

If you are located in the EEA or UK and believe we have not addressed your concerns, you have the right to lodge a complaint with your local data protection authority.

9b) Note on contacts in your CRM

When you use Ln2CRM to add a person's information to your CRM, you are the data controller for that individual's data. Ln2CRM acts as a data processor on your behalf for that sync operation. You are responsible for ensuring you have a lawful basis under applicable law (e.g., legitimate interest, consent) for storing that person's data in your CRM.

10) Cookies and analytics

Our website may use cookies or similar technologies to keep sessions, remember preferences, and measure performance. You can control cookies through your browser settings. The extension primarily stores settings locally in your browser.

We use two analytics tools on the website. Google Analytics 4 measures aggregate traffic and sets its own cookies. PostHog (hosted in the EU) provides product analytics and anonymous session replay so we can understand how visitors move through the site and improve it. PostHog does not set cookies; it keeps a first-party anonymous session identifier in your browser localStorage, does not identify you, and masks form inputs in recordings. You can opt out of both by using your browser privacy controls or a content blocker.

11) International transfers

If data is processed outside your country, we take steps to ensure appropriate safeguards are in place (for example, contractual protections with providers).

12) Children

Ln2CRM is not intended for children. If you believe a child has provided us personal data, contact us and we will take appropriate steps.

13) Changes

We may update this Policy from time to time. The “Last updated” date will reflect the most recent version. Material changes may be communicated in-product or by email.

14) Contact

For privacy questions or requests, email: admin@ln2crm.com