Compliance, end to end
What we do for GDPR, CCPA and data subject rights, who our sub-processors are, and how to get a DPA before your security review.
At a glance
- Data roles
- Controller for account data; processor for customer-ingested data
- Legal basis
- Legitimate interest and contract (for processing)
- Data residency
- EU (primary), US (replicas)
- Data retention
- 30 days by default, configurable per customer
- Breach notification
- Customer notified within 60 minutes of discovery
- Contact
- info@linkfetch.io
The user is the principal
Every profile lookup runs through the end user's own LinkedIn session, via our Chrome extension by default. We never impersonate and never rent accounts. Session tokens are stored only for users who opt in to Cloud mode, encrypted, and deleted on disconnect or after 30 days unused.
- 1
Collect
The end user installs the extension. It passively observes public LinkedIn responses while the user browses. No background fetches.
- 2
Normalise
Raw responses are normalised into typed records with provenance stamps (source, fetch time, freshness). Session tokens stay in the browser unless the user opts in to Cloud mode.
- 3
Serve
Normalised records are served back through the API, keyed to the ingesting user. Erased rows are filtered at response time rather than deleted immediately, so audit trails survive.
Sub-processors
Everyone in the chain. To get an email when this list changes, write to info@linkfetch.io.
| Processor | Purpose | Basis and region |
|---|---|---|
| Hetzner | Hosting: application servers and Postgres | GDPR, Helsinki (Finland) |
| Google (Drive) | Off-site database backups | GDPR |
| OpenAI | AI chat and AI steps you run on your data | GDPR, US; API data not used for training |
| Dodo Payments | Merchant of Record (billing) | GDPR |
| PostHog (EU) | Product analytics | GDPR, Frankfurt |
| Resend | Transactional email | GDPR, US and EU |
| IPRoyal | Residential IPs for Cloud mode, in the user's country | GDPR, egress in the user's country |
| Webshare | Datacenter IPs for collecting public job listings (no personal data) | GDPR |
How to exercise your rights
- Access
- Request via info@linkfetch.io; resolved within 30 days
- Rectification
- Inline edits in the dashboard or by email to support; same day
- Erasure
- Soft delete on request; hard delete 30 days later, per retention
- Portability
- JSON export of all user-owned data within 7 business days
- Objection
- Opt out of processing; acknowledged within 5 business days
Need our DPA before your security review?
Pre-signed and built on the Standard Contractual Clauses. Or request custom edits; we respond within 24 hours.