Legal

Privacy Policy

Version 1.0 · Last updated: 26 August 2026

1. Controller

Linnx Solutions UG (haftungsbeschränkt) Kollwitzstraße 76, 10435 Berlin, Germany Amtsgericht Charlottenburg, HRB 290197 B Managing Directors: Paul-Martin Karrmann, Jessie Schofer Email: privacy@linnx.ai

This Policy applies to linnx.ai, app.linnx.ai, api.linnx.ai, demo.linnx.ai and mcp.linnx.ai, and to the Linnx waitlist.

Linnx has not appointed a data protection officer. The thresholds in § 38 BDSG are not met.

2. Roles

2.1 In respect of your account, billing, support and use of the Website, Linnx is the controller within the meaning of Art. 4(7) GDPR.

2.2 In respect of the LinkedIn data processed through the Service on your instruction, including data relating to your correspondents and connections, you are the controller and Linnx is a processor. That processing is governed by the Data Processing Agreement at linnx.ai/dpa, which forms part of your contract. This Policy describes that processing for transparency; the DPA governs it.

2.3 Where you connect an artificial intelligence client of your own choosing (an "AI Client") to the Service through the interface implementing the Model Context Protocol (the "MCP Connector"), Section 8 applies.

2.4 In this Policy, "your Linnx account" means the account you hold with Linnx, and "your LinkedIn data" means the data retrieved from your connected LinkedIn account and held in your Linnx account, together with the data you add within the Service. Section 5 sets out what that comprises.

2.5 In respect of anonymised statistical information derived from use of the Service, Section 16 applies.

3. Limits on how your data is used

3.1 Linnx does not read the content of any message, connection request, post or comment in order to categorise, score, rank, prioritise, summarise, judge or otherwise assess it, its sender, or you. This applies by any means, whether or not automated. It does not restrict the anonymised statistical information described in Section 16, from which no message and no person can be identified. Categories, groups and favourites are applied by you, or by an AI Client you have connected.

3.2 Linnx applies artificial intelligence and machine learning to your data only as described in Section 16.2. Where a third party model is used, its provider is engaged as a subprocessor, is listed at linnx.ai/subprocessors, and Section 11 applies. Nothing in this clause qualifies 3.1. Section 16 applies to anonymised statistical information, which is not personal data.

3.3 Linnx carries out no automated decision making producing legal effects or similarly significantly affecting any person within the meaning of Art. 22 GDPR.

3.4 Linnx does not sell personal data and does not disclose it for the marketing purposes of third parties.

3.5 Session replay is not enabled in Linnx's analytics configuration. Linnx does not capture recordings of your screen, cursor movement or keystrokes. The usage events that are recorded are described in Section 7.

3.6 Linnx does not itself store raw IP addresses. Linnx's analytics provider is configured to derive an approximate location from the IP address and not to retain the address itself.

3.7 Linnx does not knowingly process the personal data of children. The Service is offered only to persons aged eighteen (18) or over acting in a business capacity.

3.8 This Section describes Linnx's own processing. Linnx's service providers operate their own systems, which Linnx does not control, and may apply automated techniques within them to deliver, secure and maintain their services. Each is engaged under an agreement meeting Art. 28 GDPR which permits it to process your data only on Linnx's behalf.

4. Account and contract data

Data	Purpose	Legal basis	Retention
Name, email address, profile picture, authentication identifiers	Creation and operation of the account	Art. 6(1)(b) GDPR	Duration of the account
Time zone, display preferences, category configuration	Provision of the Service	Art. 6(1)(b) GDPR	Duration of the account
Record of acceptance of the Terms and DPA, with version and timestamp	Proof of contract formation and of the processor contract	Art. 6(1)(b), Art. 6(1)(c), Art. 5(2) GDPR	Duration of the account plus the statutory limitation period
Record of acknowledgement of the LinkedIn access risk	Evidence of disclosure	Art. 6(1)(f) GDPR. Legitimate interest: proof that a material risk was disclosed and accepted	Duration of the account plus the statutory limitation period
Subscription status, plan, trial start, billing identifiers	Performance of the contract	Art. 6(1)(b) GDPR	Duration of the account
Invoices and accounting records	Compliance with tax and commercial law	Art. 6(1)(c) GDPR	Eight (8) years for invoices and booking vouchers under § 147(3) AO, § 14b(1) UStG and § 257(4) HGB. Ten (10) years for books, inventories and annual accounts. Periods do not expire while the relevant assessment period under § 169 AO remains open
Support correspondence	Handling of enquiries	Art. 6(1)(b), Art. 6(1)(f) GDPR	Three (3) years from the end of the year in which the matter concluded

5. LinkedIn data processed on your instruction

5.1 When you connect your LinkedIn account, Linnx retrieves and stores the following through its access provider:

(a) messages and chats, including message text, attachments (including images, documents and voice notes), timestamps, sender and recipient, read state, archive state and spam state; (b) connections, including each person's name, professional headline, public profile link and profile picture; (c) connection requests received and sent, including any accompanying message; (d) your posts and comments, including their text, and engagement metrics relating to them; (e) follower counts and account level activity metrics; (f) your own LinkedIn profile name, picture, professional headline and, where available, industry and location; (g) for every participant in a chat, including persons who are not your connections: their name, professional headline, public profile link, profile picture and network distance; (h) whether a person is a first, second or third degree connection; (i) for connection requests: the sender's name, professional headline, profile picture, public identifier, direction, status and timestamps; (j) for comments you have made: the name of the author of the post commented on, and the link to that post; (k) for connections: the date the connection was made and the public identifier; (l) for group members: name, profile picture and identifier.

This list reflects the data made available by LinkedIn through Linnx's access provider at the date of this Policy. Where further data becomes available and Linnx begins to retrieve it, this Policy is updated and Section 17 applies.

5.2 Data added by you within the Service, and not obtained from LinkedIn, comprises: categories, groups, favourites, notes, saved draft text and snooze times. Linnx also records the account segment described in Section 16.2, which is derived from your profile and held against your account.

5.3 Purpose and basis. This data is processed to provide the Service to you and, as described in Section 17, to create anonymised statistical information. Linnx acts on your documented instruction as processor. Your own lawful basis as controller is a matter for you and is addressed in Clause 5 of the Terms of Service.

5.4 Retention. Data is retained for the duration of the account. On deletion of the account, Clause 12 of the DPA applies. Section 16 applies to anonymised statistical information, which is not personal data and is not deleted.

5.5 Actions taken on LinkedIn. Operations which take effect on LinkedIn are limited to: sending a message in an existing chat; accepting a received connection invitation; declining a received connection invitation; withdrawing a sent connection invitation; and marking a chat as read, which happens automatically when you open that chat in the Service and is visible to the other participant. The first four occur only upon an explicit action taken by you at that time. Where a chat is read by an AI Client through the MCP Connector instead, no read receipt is sent and the chat stays unread on LinkedIn. All other operations take effect within the Service only.

6. Third parties whose data is processed

6.1 The Service necessarily processes personal data relating to persons who are not customers of Linnx, namely your correspondents and connections. In respect of that data you are the controller and Linnx is your processor.

6.2 Linnx does not contact those persons, does not market to them, does not build profiles of them and does not use their data for any purpose of its own. Section 16 applies to anonymised statistical information, which is not personal data and from which no person can be identified.

6.3 Your obligations towards those persons under Art. 13 and Art. 14 GDPR rest with you as controller.

7. Product usage data

7.1 Linnx uses one analytics provider, PostHog, on its EU Cloud infrastructure hosted in Frankfurt, Germany. The provider's legal entity, the location of processing and the applicable transfer mechanism are stated at linnx.ai/subprocessors.

7.2 What is recorded. Pages visited, features used, actions taken, page performance, errors encountered, the source from which a visit arrived including campaign parameters, and technical information such as browser, operating system, device type, screen size, language and time zone. An approximate location is derived from the IP address and comprises country, region, city, postal code and approximate coordinates. Linnx's analytics provider is configured not to retain the IP address itself. No content of your messages, posts, comments, notes or drafts is recorded.

7.3 Storage on your device. Linnx stores information on, and accesses information stored on, your device only where strictly necessary for a service you have expressly requested, or with your consent, in accordance with § 25 TDDDG.

Strictly necessary, set without consent: authentication and session cookies, security tokens including cross site request forgery protection, and the record of your cookie preferences.

Requiring consent, set only after you accept the cookie banner: product analytics, and any storage used for campaign attribution or referral tracking. Consent rests on § 25(1) TDDDG and Art. 6(1)(a) GDPR. Nothing in this category loads or is stored before you accept.

7.4 Events sent from our servers. A limited set of events recording changes to an account is sent from Linnx's servers irrespective of the cookie banner, namely account creation, LinkedIn connection started and completed, onboarding completion, subscription start and cancellation, use of the MCP Connector, and application errors. Account creation carries your email address and LinkedIn connection carries your LinkedIn display name; the remainder carry only the account identifier. Linnx removes both fields within the analytics provider, so that only the account identifier is retained there. These involve no access to your device and rest on Art. 6(1)(f) GDPR, the legitimate interest being the operation, security, diagnosis and improvement of the Service. You may object under Art. 21 GDPR to privacy@linnx.ai.

7.5 Withdrawal of consent. Consent may be withdrawn at any time through the cookie settings on the Website, with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before it.

7.6 Retention. Analytics events are retained for as long as your account is active. On deletion of your account, the analytics profile held by our analytics provider is deleted within one month. That provider applies its own retention periods to data held on its systems, which are set out in its published documentation. Application logs held by our hosting provider, which record operational and account lifecycle alerts, are retained for fourteen (14) days.

8. The MCP Connector

8.1 The MCP Connector allows you to connect an AI Client to your account.

8.2 Data disclosed. A connected AI Client may read your chats and their full message history, the text of your messages and comments, your posts and their metrics, your connection requests, your categories, groups and notes, and the name, professional headline and public LinkedIn profile link of every one of your connections. It may also create, amend and delete categories and groups, apply categories to chats, posts and connection requests, change the state of a chat, set favourites and save draft message text.

8.3 Third party personal data. By connecting an AI Client you instruct the disclosure of that data to it.

8.4 Absence of granular control. Linnx does not offer per function permissions, field level restriction, read only mode or separate authorisation for write operations. A connected AI Client has access to the full set of functions. Your control is the decision whether to connect an AI Client, and the ability to disconnect it at any time.

8.5 No effect on LinkedIn. No function available through the MCP Connector transmits anything to LinkedIn. An AI Client may read your data, organise it within the Service, and write draft text into your composer for review. It cannot send a message, accept, decline or withdraw a connection invitation, or cause any communication to reach LinkedIn.

8.6 Position after disclosure. Once data reaches an AI Client you have connected, Linnx cannot observe, restrict, retrieve or delete it, and cannot determine whether it is retained, logged or used to train a model. That processing is governed by your own agreement with the provider of that AI Client. In respect of it, you are the controller and Linnx has no role.

8.7 Logging. Linnx does not record the content of requests made through the MCP Connector, the parameters supplied or the data returned, and does not read your exchanges with a connected AI Client. Linnx records the name of the function invoked, whether it succeeded, how long it took and a session identifier, for operational and diagnostic purposes, and the date on which the MCP Connector was last used.

8.8 Acknowledgement. The endpoint of the MCP Connector is a public address, identical for all customers, and does not function as an access control. Access is controlled by an authorisation token issued to your account. The matters described in this Section are set out in Clause 6 of the Terms of Service, which you accept on creating an account.

8.9 Recommendation. Linnx recommends connecting only a business or enterprise account with a provider whose terms exclude the use of submitted data for the training of models, and with whom you have a data processing agreement in place. Consumer and free tier plans of AI Clients frequently permit such use. This is provided for information only, is not legal advice, and does not replace advice you obtain for yourself.

8.10 The provider of the AI Client you connect is not a subprocessor of Linnx. Where that provider also appears at linnx.ai/subprocessors, it is listed there because Linnx engages it for its own purposes, not because you have connected it.

9.1 Linnx sends transactional messages necessary to the operation of the account, including confirmation, connection reminders, billing notices and service notices. These are sent on the basis of Art. 6(1)(b) GDPR and are not marketing.

9.2 The newsletter is sent only on the basis of consent under Art. 6(1)(a) GDPR, obtained through a double opt in procedure: consent is indicated at sign up or in the account, a confirmation message is then sent, and the newsletter is sent only after the link in that message has been followed.

9.3 Linnx records the time consent was indicated, the time it was confirmed, and the time of any withdrawal, on the basis of Art. 5(2) and Art. 7(1) GDPR.

9.4 Consent may be withdrawn at any time with effect for the future, using the unsubscribe link in every message or by writing to privacy@linnx.ai. Records of consent and withdrawal are retained for three (3) years from withdrawal as evidence.

10. Website visitors

10.1 When you visit linnx.ai our hosting provider processes server log data comprising IP address, date and time, page requested, referrer, status code and user agent, on the basis of Art. 6(1)(f) GDPR. The legitimate interest is the secure and stable operation of the Website. Retention: fourteen (14) days.

10.2 Where you join the waitlist or contact us, we process the data you supply for the purpose of responding, on the basis of Art. 6(1)(b) and Art. 6(1)(f) GDPR.

11. Recipients and subprocessors

11.1 Linnx engages the service providers listed at linnx.ai/subprocessors. That page forms part of this Policy and states, for each provider, its purpose, its legal entity, the location of processing and the transfer mechanism where processing occurs outside the EEA.

11.2 Each provider is engaged under a written agreement meeting the requirements of Art. 28 GDPR.

11.3 Linnx will notify you of the addition or replacement of a subprocessor, by electronic mail to the address registered on the account and by publication on that page, not less than thirty (30) days before that provider begins processing, or as early as reasonably practicable where a change is urgent. Objection rights, and what happens if you do not object, are set out in Clause 7 of the DPA.

11.4 Linnx may disclose data to public authorities where legally obliged to do so, on the basis of Art. 6(1)(c) GDPR, and to professional advisers under a duty of confidentiality.

12. International transfers

12.1 Certain providers listed at linnx.ai/subprocessors process data outside the European Economic Area.

12.2 Where they do, transfers are made on the basis of the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, together with a transfer impact assessment and, where appropriate, supplementary technical and organisational measures.

12.3 Where a provider is additionally certified under the EU-U.S. Data Privacy Framework, that certification is treated as a supplementary and not as the primary safeguard.

12.4 A copy of the relevant safeguards is available on request to privacy@linnx.ai.

13. Security

13.1 Linnx implements technical and organisational measures appropriate to the risk in accordance with Art. 32 GDPR. A current description of those measures is available on request to privacy@linnx.ai. They are reviewed on material change and at least annually.

13.2 Linnx does not currently hold a third party security certification such as ISO 27001 or SOC 2, and makes no claim to hold one.

13.3 Where a personal data breach occurs in respect of data processed on your instruction, Linnx will notify you without undue delay in accordance with Clause 6 of the DPA.

14. Your rights

14.1 Where Linnx is the controller you have the rights of access (Art. 15), rectification (Art. 16), deletion (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21) under the GDPR, and the right to withdraw consent under Art. 7(3).

14.2 An export of your data is provided on request to privacy@linnx.ai, at no charge and within one month, in accordance with Art. 12(3) GDPR.

14.3 Requests may be sent to privacy@linnx.ai. Linnx will respond within one month, extendable by two further months where necessary under Art. 12(3) GDPR.

14.4 Where Linnx acts as a processor under Section 2.2, requests by a customer's correspondents and connections must be addressed to that customer as controller. Where such a request is made to Linnx, Linnx will not respond on the merits and will refer it to the customer without undue delay.

14.5 You may lodge a complaint with a supervisory authority. The authority competent for Linnx is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit Alt-Moabit 59-61, 10555 Berlin, Germany mailbox@datenschutz-berlin.de

You may also complain to the authority of your habitual residence or place of work.

15. Deletion of your account

15.1 You may request deletion of your account within the Service or by writing to privacy@linnx.ai.

15.2 On deletion, data processed on your instruction is deleted in accordance with Clause 12 of the DPA. Data which Linnx is required to retain under Section 4 is retained for the periods stated there and is restricted from further processing.

15.3 Deletion includes the analytics profile held by our analytics provider, which is deleted within one month.

16. Aggregated data

16.1 Linnx creates statistical information from the data held in customers' Linnx accounts and from use of the Service. That information is irreversibly anonymised before it is used, within the meaning of Recital 26 GDPR, so that no person and no organisation can be identified from it. Once anonymised it is no longer personal data and the GDPR no longer applies to it. This Section is included for transparency.

16.2 Sources used. Information about how the Service is used, and the shape of content rather than its content: counts, volumes, dates and times, intervals, states, the categories you apply in the Service, degree of connection, whether connection requests were accepted, declined or withdrawn, and the length and composition of your own posts and comments.

Your account may also be placed into segments describing the account itself: its industry, its region, and the band your follower count falls into. Each segment is a choice from a fixed list, worked out from the industry, location and professional headline fields of your own LinkedIn profile, by a fixed lookup or using an artificial intelligence model. Only those fields are used and only the segment is kept. Where a third party model is used, its provider is listed at linnx.ai/subprocessors and Section 11 applies. Where the model runs on Linnx's own infrastructure, nothing is sent outside it and no other company is involved.

Segments are never based on personal data within the meaning of Art. 9 or Art. 10 GDPR. Segments are used only to group statistics. They apply to your account and never to your contacts, are not used to assess any person, and do not affect the service you receive.

16.3 Sources excluded.

(a) Names, professional headlines, public profile links, profile pictures and any other identifier of a person or organisation, except for the segments described in 16.2.

(b) The content of messages, notes and drafts, or anything derived from that content, including length. The date and number of messages may be used. Their content may not.

(d) Attachments, images, documents and voice notes.

(e) The text of your posts and comments. Individual words may be counted, but no sequence of words is kept, and no word from which a person or an organisation could be identified is kept.

16.4 Method. Anonymisation is carried out by Linnx within its own systems, by fixed rule based processing which produces the same result from the same input. No artificial intelligence or machine learning is applied to your data during the anonymisation itself, and your data is not sent to a third party for that purpose, other than as described in 16.2. Section 3.1 applies without qualification.

16.5 Analysis after anonymisation. Once the information has been anonymised, Linnx may analyse it, including by means of artificial intelligence, and may send it to a provider of an artificial intelligence model for that purpose. What is sent is anonymised statistical information and not personal data.

16.6 Purposes. Operating, evaluating and improving the Service, informing product decisions, and preparing and publishing benchmarks, industry research and marketing material.

16.7 Publication. Anonymised statistics are published only where they are drawn from at least twenty (20) customer accounts and where no individual and no organisation can be inferred from them.

16.8 Retention. Because it is not personal data, anonymised statistical information is kept without time limit and is not affected by deletion of your account.

16.9 Your rights. The rights set out in Section 14 apply to personal data. Anonymised statistical information is not personal data and no person can be identified from it, so those rights do not attach to it. Your rights in respect of the personal data held in your Linnx account are unaffected.

16.10 This is set out in Clause 16 of the Terms of Service and, where Linnx acts as processor, in Clause 3.6 of the Data Processing Agreement.

17. Changes to this Policy

17.1 Linnx may amend this Policy where necessary for legal, regulatory, technical or operational reasons. The version and date appear at the head of this document.

17.2 Where an amendment is material, Linnx will notify account holders by electronic mail not less than thirty (30) days before it takes effect.

Linnx Solutions UG (haftungsbeschränkt) Kollwitzstraße 76, 10435 Berlin, Germany privacy@linnx.ai