Privacy Policy

InMailAI ("we", "our", "us") is a Chrome browser extension and associated backend service that helps sales professionals generate AI-powered prospect summaries, outreach messages, and find work email addresses directly within LinkedIn.

This Privacy Policy explains what information we collect, how we use it, and what rights you have. By installing and using InMailAI, you agree to the practices described here.

We collect the minimum information necessary to provide the service:

Account information

When you create an InMailAI account, we collect your email address and a hashed password (stored securely by Supabase). We do not collect your name, phone number, or any other personal information at signup.

Usage data

We track the number of AI calls and email lookups you make per month to enforce your plan limits. We do not track which LinkedIn profiles you visit or which messages you generate.

Authentication tokens

When you sign in, a JWT is stored in your browser's extension storage (chrome.storage.local). It is stored only on your device and never sent to third parties.

Server logs

Our backend automatically generates standard server logs including request timestamps, API endpoints called, and HTTP response codes. These logs do not include the content of your prompts or generated messages. Logs are retained for 30 days.

• LinkedIn profile data — We do not store any information from profiles you view. Profile data is sent to our AI service to generate a response and immediately discarded.
• Generated messages — Outreach messages and summaries are not stored on our servers. They exist only in your browser until you copy or close them.
• Browsing history — We do not know which LinkedIn profiles you visit, how many you view, or your browsing patterns.
• Payment details — All payments are processed by Stripe or Razorpay. We never see or store your full card number, CVV, or bank account details.
• LinkedIn credentials — We have no access to your LinkedIn username or password. InMailAI reads the visible page DOM only.

We use the data we collect for the following purposes only:

1. Providing the service — authenticating your requests, generating AI responses, finding emails, and enforcing plan limits.
2. Preventing abuse — tracking usage counts to prevent free-tier abuse and ensure fair access for all users.
3. Improving the product — aggregate, anonymous usage metrics may be used to understand how the product is used. No individual user behaviour is tracked.
4. Transactional emails — we may send emails related to your account (password resets, payment receipts, plan limit warnings). We do not send marketing emails without your explicit consent.

We do not use your data for advertising, profiling, or sale to third parties. Ever.

InMailAI uses the following third-party services. Each has its own privacy policy:

We do not share your data with any other third parties.

Your account data is stored in Supabase's secure PostgreSQL database with row-level security — meaning our application can only access your own data, never another user's.

Your authentication token is stored in chrome.storage.local— a sandboxed storage area accessible only to the InMailAI extension. No website, including LinkedIn, can read this data.

All communication between the extension and our backend uses HTTPS (TLS 1.2+). We do not transmit data over unencrypted connections.

We retain account data for as long as your account is active. If you delete your account, we delete your data within 30 days.

• Access — Request a copy of all personal data we hold about you.
• Correction — Update your email address through account settings.
• Deletion — Request deletion of your account and all data at any time by emailing privacy@inmailai.com. We process deletion within 30 days.
• Portability — Request an export of your data in JSON format.
• Objection — Object to any processing of your data at any time.

To exercise any of these rights, email privacy@inmailai.com. We respond within 14 business days.

InMailAI reads only the publicly visible LinkedIn page you are currently viewing. We do not:

• Access LinkedIn's internal APIs or private endpoints
• Automate any actions on LinkedIn (clicking, sending, connecting)
• Scrape LinkedIn pages in bulk or programmatically
• Store or resell LinkedIn profile data
• Bypass LinkedIn's authentication or access controls

All AI generation and message drafting is done by you, the user — InMailAI assists but does not automate.

InMailAI is intended for adults (18+) in a professional context. We do not knowingly collect personal information from anyone under 18. If you believe we have inadvertently collected information from a minor, please contact privacy@inmailai.com immediately.

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date and, for material changes, notify you by email or by displaying a notice in the extension.

Continued use after changes are posted constitutes acceptance of the updated policy.

For questions, concerns, or data requests:

We respond to all privacy-related enquiries within 14 business days.