Privacy Policy

1. Who this covers

Two groups of people. Customers: the agencies and teams with a CampaignStack account. Professionals in the database: the people whose public work profiles CampaignStack holds so that customers can contact them. Most of this policy is about the second group, because they never signed up and cannot read a settings page.

2. What we hold about customers

Your email address and name. Billing is handled by Stripe; we hold the subscription state and never a card number. Connected third-party keys (Apollo, Clay, Instantly, HubSpot and similar) are encrypted with AES-256-GCM. If you connect a Google account, we hold the OAuth tokens and the mailbox and calendar data you asked us to read or mirror.

LinkedIn accounts. The session cookie is used once, to open an encrypted Chrome profile on our automation server, and is never written to our database. Recovery credentials (email and password) are held only if you opt in, encrypted with a separate key. Disconnecting destroys the profile.

The browser extension. When you set up a workspace from the extension, it reads your own LinkedIn profile (name, member id, public address, headline) and sends it to us to create your account and workspace. It reads the contact email address on your own LinkedIn profile to prefill the claim field; that address reaches us only when you click Claim, and you can edit it first. On a LinkedIn message thread it looks at the text on screen, inside your browser, to decide where to place the meeting badge; the only thing it sends us is the thread’s id from the address bar. The extension holds one API key in browser storage, which can read your workspace and can send nothing, and which you can revoke from the dashboard. It reads no profile but yours, no connections, and it collects no browsing history.

Usage. Product analytics (PostHog), error reporting (Sentry) and advertising conversion tags (Google Tag Manager) load only after you accept cookies. On the marketing pages the tag container runs the Google Ads and LinkedIn Ads pixels. Inside the product it loads only to report a sign-up or a purchase to Google Ads, and it runs nothing but Google's own tags there. If you accept, we also keep the ad click id from the link that brought you, for up to 90 days (see section 5). Operational logs of the automation server go to Axiom stripped to an allowlist of technical fields.

3. The shared professional database

CampaignStack keeps one shared database of professional profiles: name, title, seniority, location, employer, public headline, LinkedIn URL, a work email when one was found, and dated professional events such as a job change or engagement with a public post. It is built from public LinkedIn pages, from the profiles customers look at, and from data providers customers connect. Every authenticated customer can read it, the way a directory like Apollo works.

We also read companies' own public team pages. When a company is already in that database, our crawler reads the pages it publishes about its own people, the team, leadership, staff or authors page, and takes three things: the name, the job title the page prints, and the LinkedIn address the page links to. It does not take an email address or a telephone number printed next to you, and it does not keep your photograph. If the page names you with a LinkedIn address, you enter the database as a profile like any other. If it names you with no address at all, we record only that the company published that name and title, we do not create a profile for you, and we delete that record 18 months after the page stops naming you. Everything on this page, including the request form in section 6, applies to a name read this way.

For this database CampaignStack is the controller: we decide what is collected, how long it is kept, and who can read it. The legal basis is legitimate interest (GDPR Article 6(1)(f)): reaching business decision-makers with relevant, capped, human-reviewed outreach. The balancing assessment is on file and summarised on the data protection page.

What stays private to one customer: anything the customer does. Which profiles it added to a list, which campaign contacted whom, what was said, tags, notes, scores against its own criteria, and anything imported from a CSV or a CRM. For that data the customer is the controller and we process it under the terms of service.

Telling every professional individually when their public profile enters the database would mean writing to people no customer may ever contact, so we rely on Article 14(5)(b) and inform through this page instead. The first message a customer sends you comes from an identifiable person you can answer, ignore, or ask to stop. A customer can also switch on a one-line notice in that first message, naming this basis and linking to the request page; when it is on, it goes to everyone in the EU and the UK and to anyone whose country we do not know.

4. How long

• A professional profile that no customer has attached to a workspace, a list or a conversation is deleted 18 months after it was last updated, by a daily sweep.
• Customer accounts: for as long as the account exists. You can delete your account from Settings; the workspaces you own go with it. Deleting a workspace stops everything in it at once; the private leads, lists, imports and conversations it held are deleted 90 days later by a daily job. Profiles in the shared database are not customer data and follow the 18-month rule above.
• A name and job title read off a company's own team page: 18 months after that page stops naming the person.
• Outbound attribution records: 90 days. Mirrored calendar events: 90 days.
• Free-tool data that nobody claims: 7 days (voice) to 90 days (account safety). For the account safety audit that includes the LinkedIn session, which stays connected in the encrypted browser profile so the rechecks at 28, 56 and 84 days can run; disconnecting a claimed account deletes it at once.
• Erasure requests are carried out within one month and confirmed to you.

5. Who processes it

Hosting and infrastructure: Convex (database and backend, United States), OVH (automation server, Canada), Cloudflare (CDN and DNS), Resend (email delivery), Webshare (residential proxies that carry LinkedIn traffic), Stripe (billing), Sentry and PostHog (only after cookie consent), Google Tag Manager with Google Ads and LinkedIn Ads pixels (only after cookie consent), Axiom (technical logs).

Advertising platforms. If you accepted cookies, we tell the platforms we buy ads from when you sign up, when your workspace sends its first message and when you pay. That is how they measure our ads and stop showing them to people who are already customers. Meta Platforms Ireland and X Corp. get this from our server: a SHA-256 hash of your email address, a SHA-256 hash of your account id, the ad click id from the link you came through, your browser's user agent (its name and version, which Meta asks for), the event, and for a payment its amount and currency. Never your name, your workspace, the people in your lead lists or your IP address. Google Ads gets the sign-up and the payment from your own browser, through Google Tag Manager: the event, the amount and a transaction id, plus what any browser request carries. Each platform uses this under its own business terms. It is about your own account only, never about the professionals in the database. If you reject cookies, nothing is sent. To withdraw consent later, reset the cookie banner as the cookie page explains and choose Reject: what was not yet sent is dropped.

AI providers: profile text and message text used to draft outreach go to DeepSeek V4.1 Flash hosted by DeepInfra, with OpenAI and Anthropic as fallbacks, all under data processing agreements. The browser agents that read LinkedIn pages and inbox threads on the automation server run on the same DeepInfra-hosted model, with Anthropic as fallback, and an OpenAI model describes the screenshots they take. TypeSafe AI checks a draft and reads a reply for us, so it receives that reply text, that draft text and role fields such as a job title, also under a data processing agreement. Perplexity receives company and market queries only, no personal data. Search: Serper runs web searches for us, and when you use LinkedIn profile match it receives a person's name and company to find their public profile. Apify searches public LinkedIn posts by topic for the free lead magnet finder. The full list with what each one receives is on the security page and is updated when a provider is added.

Data providers you connect yourself (Apollo, Clay, Instantly, HubSpot, BetterContact for the Contact Finder) receive the identifiers needed for the lookup you request. We do not sell data and no provider may train models on it under our agreements.

AI assistants you connect yourself. You can connect an assistant such as ChatGPT or Claude to a workspace. When you do, whatever you ask it to read is sent to that assistant's operator and handled under their terms, not ours: lead names, job titles, employers, LinkedIn profile addresses, work email addresses and phone numbers when the workspace has them, the text of messages sent and received, meeting details, and your campaign and workspace settings. You choose at connection time whether the assistant may read, edit, or send, you can see every connection in Settings, Connections, and revoking one there ends its access immediately. An owner or administrator can also end a connection anyone on the team made into their workspace.

Transfers outside the EEA rest on the provider's standard contractual clauses or its EU-US Data Privacy Framework certification, as stated in each provider's agreement.

6. Your rights, and how to use them

Whether you are a customer or a professional in the database, you can ask what we hold, have it corrected or deleted, receive a copy, or object to the processing. Use the form at campaignstack.io/your-data. An objection or an erasure lands your email address and LinkedIn URL in a suppression register that every customer's sending path checks, so that you are not contacted again through CampaignStack. That register is the only thing we keep after an erasure.

You can also write to privacy@campaignstack.io. We answer within one month. If you are in the EEA and are not satisfied, you can complain to your national data protection authority.

Every outbound email a customer sends through CampaignStack carries a one-click unsubscribe link. Using it stops that customer's email to you.

7. Security

TLS in transit, AES-256-GCM for stored keys and credentials, encrypted browser profiles on the automation server, role-based access inside the product, and no LinkedIn session in any database. The architecture, and what we have not done yet (no SOC 2, no external penetration test), is described on the security page.

8. Cookies

Essential cookies for sign-in. Analytics, error reporting and advertising measurement only with your consent. Details on the cookie page.

9. Children

CampaignStack is for businesses. We do not knowingly hold data about anyone under 18.

10. Changes

Material changes are emailed to customers. The date at the top is the last revision.

11. Contact

CampaignStack, privacy@campaignstack.io.