Privacy Policy

Overview

This Privacy Policy explains what information Privly collects, why we collect it, how we use it, and the choices you have.

Privly is operated by MASTERPIECE Technologies Inc.

Information we collect

• Account data: email address, name, workspace, settings, and billing status.
• Business profile data: the ICP, offer, pains, triggers, exclusions, and other targeting facts you review or provide.
• Connected-source data: LinkedIn account identifiers, permissions, connection status, and provider account mappings.
• Connected-mailbox data: the authorized email address, provider account identifiers, connection and sending settings, email participants, message and thread identifiers, timestamps, subjects, content, and delivery or reply status needed for the connected-email workflow.
• Work-email data: professional email addresses returned by requested lookups, verification timestamps, lookup status, and related credit-usage records.
• CRM integration data: the connected HubSpot account identifier, granted permissions, protected authorization tokens, selected contact data, export progress, and destination record identifiers used to track results and prevent duplicates.
• Public-source evidence: public posts, profiles, URLs, and activity needed to find and qualify opportunities.
• Product data: leads, tags, notes, campaigns, drafts, approvals, delivery results, replies, and recorded outcomes.
• Usage and diagnostics: pages viewed, product events, browser type, approximate location, and reliability or security logs.
• Billing data: plan, billing period, payment status, and provider transaction or subscription identifiers. Privly does not store full card numbers.

Work-email finding

When an authorized workspace user requests Find email for a lead or selected leads, Privly sends the relevant LinkedIn profile URLs to Findymail to find verified work-email addresses. Saving or discovering a lead does not automatically request this lookup.

We store returned email addresses with the workspace lead, together with verification timestamps, lookup outcomes, and usage records. Authorized workspace members can use these details in the product and include them in an export. Provider verification does not guarantee that an address will remain accurate or deliverable, and does not establish consent to receive marketing.

Finding an email does not send a message or subscribe the person to Privly’s own marketing emails. Customers are responsible for their lawful use of contact details and for respecting objections and unsubscribe requests.

CRM connections and exports

HubSpot is the currently supported CRM destination. A workspace user with the required permissions connects the account through HubSpot authorization; connecting alone does not export contacts. An authorized user must select leads and request an export.

For a requested export, Privly sends available names, LinkedIn profile URLs, job titles, and usable email addresses. Where applicable, it also sends company names and creates or links company records using the permissions granted. Finding an email is optional; supported contacts can be exported without one.

Privly reads relevant HubSpot contact identifiers, email and profile matches, and company information to avoid duplicates and preserve existing records. We retain export status and destination identifiers to show results, recover interrupted exports, and prevent repeated creation. An export already requested can continue in the background after its dialog is closed; this is not ongoing two-way synchronization.

The connected CRM processes exported data under the customer’s relationship with that provider and its applicable terms and privacy policy. You can disconnect HubSpot in Settings under Integrations. Disconnecting or deleting a Privly lead does not delete records already exported to HubSpot; those records must be managed in HubSpot.

Gmail connections and Google user data

Connecting Gmail is optional. When you authorize it through Google, Privly uses Unipile to connect the mailbox, send messages you approve or schedule, synchronize relevant campaign conversations, detect replies, opt-outs and delivery failures, and stop remaining outreach when a reply or opt-out is received. Connecting Gmail alone does not launch a campaign or send an email. We do not ask for your Google password.

Depending on the permissions you grant, Google and Unipile provide your mailbox identity, email participants, message and thread identifiers, timestamps, subjects, message content, labels or folder information, and delivery events. Delivery-report attachments may be read to identify bounced messages. Unipile handles the authorized mailbox connection and email synchronization; Privly stores the account mapping, sending settings, campaign messages, relevant conversation content and reply excerpts, and delivery, suppression and reliability records used by the product.

Gmail data is used for the connected-email features you choose. Relevant reply excerpts may appear in workspace notifications according to your preferences. If you request AI assistance for a conversation, the necessary message context may be sent to the configured AI provider for that request. We configure those model requests to deny provider data collection; we do not use Google user data to train general-purpose AI models.

We share Gmail data with Unipile to operate the authorized mailbox connection, with the recipients you choose when sending messages, and with service providers only as needed for the connected-email features you use. We do not sell Gmail data or use it for advertising, advertising profiles, or unrelated lead discovery. Human access is limited to your explicit consent for specific data, necessary security investigations, legal obligations, or aggregated and anonymized internal operations permitted by Google’s rules.

You can revoke Privly’s Google access in your Google Account under Third-party apps and services. Disconnecting a mailbox in Privly stops it being used for further campaign sends; it does not itself revoke the Google authorization or erase saved messages and activity history. Revoke access through Google to end the authorization, and contact [email protected] to request deletion of Gmail-derived data held by Privly and its integration provider. Revocation does not recall messages already sent or delete recipients’ copies.

We retain Gmail-derived account, conversation and delivery records while needed for the connected-email features you use, security, suppression of further contact, and applicable legal obligations. You can request deletion without reconnecting the mailbox. We handle the request with the integration provider where required and explain any records that must be retained.

Our handling and transfer of Google API data follow the Google API Services User Data Policy and its Limited Use requirements. These restrictions also apply to data derived from Gmail and take precedence over broader descriptions of analytics, AI features and data sharing elsewhere in this policy.

Google Account: Third-party apps and services

Google API Services User Data Policy

Google Workspace user data and developer policy

Analytics and cookies

We use analytics to understand which pages and features are used and to improve performance and reliability.

Analytics providers may use cookies or local storage to recognize a browser across sessions. You can limit this through browser controls, although some product features may not work as intended.

AI features and model providers

When you use profile import, qualification, drafting, or in-app help, prompts and relevant context may be sent to configured AI providers to generate a response.

We limit the context to what is needed and use provider settings that reduce long-term storage where supported. Providers may still process request metadata for safety, reliability, and legal compliance.

Payment processing

Paid subscriptions are processed by third-party payment providers under their own privacy terms. They may collect billing address, tax, and transaction details needed to complete payment.

Data we access from connected sources

• Account or profile information needed to identify the account you chose.
• Permissions and scopes needed to connect the source or perform a user-approved action.
• Public evidence and professional activity returned by the configured discovery provider.
• Connection health and delivery status needed to keep the workflow reliable.

Privly LinkedIn Connector

The connector’s single purpose is connecting or reconnecting the LinkedIn session already signed in in your browser. Discovery is performed by Privly’s configured provider, not by the extension.

The connector does not collect LinkedIn passwords, private messages, payment information, discovery results, or unrelated browsing history. Connecting LinkedIn does not itself send a message.

• Visible LinkedIn account identity used to confirm which account is connected.
• Browser and session information needed to establish the requested connection.
• Basic connection diagnostics needed for reliability and security.

Chrome Web Store Limited Use disclosure

• We do not sell extension user data.
• We do not use extension data for personalized, retargeted, or interest-based advertising.
• Connection information is shared only with the integration provider needed to operate the connection, essential service providers, legal authorities when required, or as part of a business transfer.
• Humans do not read extension data except with consent for support, for security, to comply with law, or in aggregated and anonymized internal reporting.

How we use information

• Operate secure accounts and workspace access.
• Build and maintain the targeting profile you review.
• Discover and qualify relevant opportunities.
• Find work-email addresses when requested and export selected contact data to a CRM you connect.
• Prepare reviewed replies, messages, and campaign drafts.
• Measure reliability, prevent abuse, provide support, and improve the product.

Emails and your choices

When you sign up, Privly automatically sends welcome emails, setup tips, reminders, and guidance to help you use your account. We also send relevant workspace notifications, such as new results, replies, and follow-up reminders, according to your preferences.

We use your email address, workspace role, setup progress, subscription status, and relevant app activity to choose useful messages and avoid sending reminders for actions you have already completed. Our email providers process the information needed to deliver these messages and report delivery failures and unsubscribe requests.

You can turn off App guidance and tips and other optional messages in Settings under Email preferences, or use the unsubscribe link in an optional email. Essential account, security, and billing messages may still be sent when needed to operate your account.

Product updates and offers have a separate opt-in preference. Creating an account or accepting our policies does not turn on promotional emails or override an existing unsubscribe.

Where your data is stored

Privly uses cloud hosting, database, storage, and content-delivery providers to operate the web application, API, database, and media. The exact storage region depends on deployment configuration.

Retention and deletion

We keep data as long as needed to provide the service, meet legal obligations, resolve disputes, protect the product, and enforce agreements. You can request deletion at any time.

Raw authentication information used for a LinkedIn connection is not retained after the connection request. The account identifier, connection status, and account identity remain while the connection is active.

CRM authorization tokens are stored encrypted while needed for the connection. A successful HubSpot disconnection revokes authorization and removes stored credentials. Export history and duplicate-prevention records are separate from connection credentials and may remain under our retention policy.

People whose professional information appears in a customer workspace can contact [email protected] about access, correction, deletion, or objections without creating an account. Where we process the information on a customer’s behalf, we assist or refer the request to that customer as appropriate. Removing information from Privly does not automatically remove independent provider records or copies previously exported by a customer.

Who we share data with

• Connected source and platform-integration providers used for a connection or user-approved action.
• Discovery and enrichment providers that process search criteria and public-source information.
• Findymail, for profile URLs submitted during requested work-email lookups and the resulting email data.
• HubSpot, as the CRM destination connected by a customer for authorized contact exports and related record matching or company linking.
• Unipile, to operate authorized Gmail and other connected-mailbox synchronization, sending, delivery events and reply detection.
• Cloud, analytics, AI, payment, and communications providers needed to operate Privly.
• Legal and safety recipients when required to comply with law or protect users and the service.

Security

We use safeguards including encrypted transport, secure secret handling, constrained permissions, and workspace-level access checks. See the Security Overview for more detail.

Contact

Questions or requests? Email [email protected].