Privacy policy

1. DATA CONTROLLER

The controller of your personal data is:

2. DATA COLLECTED

As part of our service, we collect and process the following personal data:

2.1 Data collected when signing up via third-party OAuth

• First and last name
• Email address

2.2 Data collected through our sign-in and sync flows and our integrations

• Temporary authentication data required to keep the connection to a compatible third-party account working
• Spot likes, comments, profile visits, and received invitations quickly so you can act at the right time.
• Content and metadata required to run the automations or to operate certain features, when you turn them on
• Content saved through the Service when you use this feature

2.3 Data collected during the Stripe payment process

• Phone number
• Postal address

2.4 Service usage data

• Connection data
• Activity carried out on the service
• For product analytics: a random analytics-only pseudonym, activation steps and strictly limited usage categories (boolean values, categories and volume bands)

PostHog analytics exclude LinkedIn profile names and identifiers, prospects, messages, emails, tokens, content, prompts, resource identifiers, URLs, referrers, IP addresses and user agents collected by Yadulink.

2.5 Data related to AI and MCP connectors

• Technical data required for the MCP connector's OAuth authorisation, in particular the client used, the scopes requested, the access and refresh tokens, and their revocation status
• Data about MCP tool calls, in particular the name of the tool called, the execution time, the success or error status, the user account concerned, the target workspace account where applicable and a summary of the result
• Data strictly necessary to answer requests made from a compatible AI assistant, for example the contacts, lists, sequences, statistics, messages, posts, comments or LinkedIn signals you have authorised

3. PURPOSES OF PROCESSING

We process your personal data for the following purposes:

• Provide and run our automated outreach and engagement services
• Enable the connection of your compatible third-party account in our cloud environment
• Run the automations you have configured (profile visits, connection requests, interest signal detection, etc.)
• Adapt how certain automations and features work to your settings and your usage
• Manage your user account and your subscription
• Allow the Service to be used from compatible AI assistants through an MCP connector, within the permissions you have granted
• Log MCP calls for security, diagnostics, support, abuse prevention and improvement of the Service
• Bill you and process your payments
• Inform you about new features of the Service
• Provide you with customer support through our chat
• Improve our services and develop new features
• Measure the activation journey and adoption of the main features from pseudonymous product events in order to improve the Service
• Meet our legal obligations

4. LEGAL BASIS FOR PROCESSING

We process your personal data on the following legal bases:

• Performance of the contract : processing is necessary to perform the contract you entered into by using our service, or to take pre-contractual steps at your request.
• Legitimate interest : processing is necessary for the legitimate interests pursued by YADULINK, in particular understanding activation, improving the Service and growing our business. Product analytics are strictly limited, pseudonymised and can be objected to at any time.
• Legal obligation : processing is necessary to comply with a legal obligation to which YADULINK is subject.

5. DATA RECIPIENTS

Your personal data is intended for:

• Authorised YADULINK staff, bound by a confidentiality obligation
• Our processors:
  • Unipile.com (cloud management of compatible third-party account connections)
  • Stripe (payment processing)
  • Firstpromoter (affiliate programme management)
  • Crisp (customer support)
  • Resend (transactional email management)
  • PostHog, European infrastructure (pseudonymous product analytics based on YADULINK's legitimate interest)
  • The providers of AI assistants you choose to connect to the Service over MCP, for example Anthropic or OpenAI, and only when you explicitly authorise that connection

We make sure all our processors provide sufficient guarantees that they implement appropriate technical and organisational measures to protect your personal data.

6. DATA TRANSFERS OUTSIDE THE EUROPEAN UNION

Your data is mainly hosted in the European Union (Microsoft Azure, France Central region).

Some of our processors may, however, process your data outside the European Union. In that case, we make sure those transfers go to countries offering an adequate level of protection according to the European Commission, or are covered by standard contractual clauses or binding corporate rules approved by the European Commission.

7. RETENTION PERIOD

We keep your personal data only for as long as necessary to fulfil the purposes for which it was collected, and in any event until your account is deleted.

OAuth authorisations tied to MCP connectors are kept as long as you keep the connection active, then revoked or deleted when you disconnect the connector or delete your account.

Technical logs of MCP calls are kept for as long as necessary for the security, diagnostics, support and audit of the Service, then deleted or anonymised. Once your account is deleted, all your personal data is removed from our servers, unless a legal obligation requires otherwise.

Pseudonymous product events are kept in PostHog for 12 months at most. The technical delivery records kept by Yadulink are deleted 7 days after delivery, final failure or removal following an objection. Upon an erasure request or account deletion, the corresponding pseudonym is also deleted from PostHog under our rights-handling procedure.

8. DATA SECURITY

YADULINK implements appropriate technical and organisational measures to guarantee the security, integrity and confidentiality of your personal data, in particular:

• Strict limits on data access (IT team only)
• Encryption of sensitive data
• MCP permissions limited by scope and workspace permissions checked before any action on a managed account
• Logging of sensitive MCP calls in order to detect errors, abuse and unauthorised access
• Regular updates to our systems

9. YOUR RIGHTS

Under the General Data Protection Regulation (GDPR) and the French Data Protection Act, you have rights concerning your personal data.

• Right of access : you may obtain information about the processing of your personal data as well as a copy of that data.
• Right to rectification : if you believe your personal data is inaccurate or incomplete, you may require that this data be amended accordingly.
• Right to erasure : you may request the erasure of your personal data, to the extent permitted by law.
• Right to restriction of processing : you can request that the processing of your personal data be restricted.
• Right to data portability : you have the right to receive your personal data in a structured, commonly used and machine-readable format, and the right to transmit that data to another controller.
• Right to object : you have the right to object at any time to the processing of your personal data on grounds relating to your particular situation.
• Right to withdraw your consent : if you have consented to the processing of your personal data, you have the right to withdraw that consent at any time.
• Right to give instructions about what happens to your data after your death.

To exercise these rights, you can contact us at the following email address: [email protected]

You can also revoke an MCP authorisation by removing the connector from the AI assistant concerned, or from the YADULINK settings where available.

You can object to product analytics at any time by writing to [email protected]. Once the request is processed, new events are blocked and any pending events are no longer sent. This objection does not affect any feature of the Service.

You also have the right to lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL), the French supervisory authority for personal data protection.

10. COOKIES AND SIMILAR TECHNOLOGIES

Our Service uses the cookies required for it to work. PostHog product analytics are sent server-side, without loading the PostHog SDK and without any PostHog cookie or local storage in your browser. They are described in our Cookie Policy.

11. CHANGES TO THE PRIVACY POLICY

YADULINK reserves the right to amend this Privacy Policy at any time. If it changes, we will inform you through our Service or by email before the changes come into force.

We encourage you to review our Privacy Policy regularly to stay informed about how YADULINK protects your personal data.

12. CONTACT

For any question about this Legal Notice, contact us at: [email protected]