Privacy Policy

1. Who we are

Warmscript (“Warmscript,” “we,” “us”) is operated by [Legal entity name], [registered address]. For any privacy question or request, contact us at privacy@warmscript.com. For the purposes of the GDPR, we are the “data controller” of the personal data described here.

2. Information we collect

We collect only what we need to run the service:

• Account data — your email address, name (optional), and a securely hashed password. If you sign in with Google, we receive your basic Google profile (name, email, avatar).
• Your voice & profile — the details you add so drafts sound like you: role, company, one-line pitch, your goal on LinkedIn, your “about me,” a short bio, expertise topics, writing-style notes, and sample messages you paste in.
• Your preferences & guardrails — default tone, length, language, emoji setting, standing instructions, and your never-say list.
• Page content you choose to draft from — when you click a “Write” button, the extension reads the visible text of the LinkedIn profile, conversation, or post you are on, so it can write a relevant draft. It only reads a page when you take that action.
• Drafts & history — the drafts we generate for you and which one you chose, so you can review them later.
• Follow-up contacts — people you save to follow up with: name, headline, LinkedIn profile URL, your notes, and reminder dates.
• Device & technical data — per-device access tokens (stored hashed), session information, and standard server logs (such as IP address, timestamps, and error data) used for security and reliability.

We do not collect your LinkedIn password, and Warmscript never logs into LinkedIn for you.

3. How we use your information

• To generate drafts, replies, comments, and follow-up nudges in your voice.
• To create and secure your account, sign you in, and pair your devices.
• To send essential emails (email verification and password resets).
• To operate, maintain, debug, and improve the service and keep it secure.
• To comply with legal obligations and enforce our Terms.

We do not sell your personal data, and we do not use your content to train our own foundation models.

4. How drafts are generated (AI processing)

To write a draft, we send the relevant inputs — the page text you triggered, plus your voice profile and preferences — to our AI provider, OpenRouter, which routes the request to a large language model to produce the draft. We ask providers not to retain or train on this content, but their handling is governed by their own terms. We send only what is needed to produce the draft.

5. Legal bases (EEA/UK)

• Performance of a contract — to provide the features you ask for.
• Legitimate interests — to secure, maintain, and improve the service.
• Consent — where required (e.g. certain communications); you may withdraw it at any time.
• Legal obligation — where we must retain or disclose data by law.

6. Who we share it with

We share data only with service providers (“sub-processors”) that help us run Warmscript, under contracts that require them to protect it:

• OpenRouter and the model providers it routes to — to generate drafts.
• Our hosting and database providers — [e.g. your host] — to run the app and store your data.
• Resend — to send verification and password-reset emails.
• Google — only if you choose “Sign in with Google.”

We may also disclose information if required by law, to protect our rights or users’ safety, or as part of a merger or acquisition (you will be notified).

7. Data retention

We keep your data for as long as your account is active. You can delete your account at any time from Account settings, which deletes your profile, voice data, drafts, and contacts. Some records may be retained where required by law or for legitimate security purposes, and backups are purged on a rolling schedule.

8. Security

Passwords are hashed with bcrypt, sessions and device tokens are stored hashed, cookies are marked Secure in production, and traffic is encrypted in transit. No system is perfectly secure, but we work to protect your data and will notify you and any regulator as required if a breach affects you.

9. Your rights

Depending on where you live, you may have the right to access, correct, export, delete, restrict, or object to the processing of your personal data, and to withdraw consent. You can edit most data in the app and delete your account from Account settings. For any other request, email privacy@warmscript.com. EEA/UK users may also lodge a complaint with their local supervisory authority. We do not sell or “share” personal information as defined by California law.

10. Cookies & local storage

We use a single essential cookie to keep you signed in — no third-party advertising or tracking cookies. The browser extension stores your settings and access token locally via the browser’s extension storage on your device.

11. International transfers

We and our providers may process your data in the United States and other countries. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for international transfers.

12. Relationship with LinkedIn

Warmscript is an independent product and is not affiliated with, endorsed by, or sponsored by LinkedIn Corporation. Warmscript acts only on pages you are viewing and actions you take, and you are responsible for using it in line with LinkedIn’s User Agreement.

13. Children

Warmscript is not intended for anyone under 16, and we do not knowingly collect data from children.

14. Changes to this policy

We may update this policy from time to time. We will post the new version here with an updated date and, for material changes, notify you by email or in the app.

15. Contact

Questions or requests: privacy@warmscript.com.