Privacy Policy

Account and profile data

When you create an account we collect your email address and, optionally, your first name. If you sign in with Google, we receive your name and email address from Google. This is used to authenticate you and personalise your experience. Legal basis: contract performance.

Contact records

You choose what contact information to store: names, emails, phone numbers, LinkedIn and Instagram profile links, profile photos, company details, notes and interaction history. This data is stored in your organisation's workspace and is not shared with third parties or used for any purpose other than providing the service to you. Legal basis: contract performance.

Usage data

We use PostHog to understand how the product is used, such as the pages you view and the features you use. These events are linked to your account email so we can help you when something goes wrong and see which features are worth improving. Legal basis: legitimate interest.

API keys

API keys, including the one the Chrome extension uses, are stored on our servers as a one-way hash (SHA-256). We cannot recover or display a key once issued. You can revoke keys from your account settings at any time.

Connecting your account

When you connect the extension, signalboxcrm.com creates an API key for your organisation and hands it to the extension, or you paste one in yourself. The key is kept in Chrome's extension storage (chrome.storage.sync), which Chrome may sync between your own browsers when you are signed in to Chrome. It is sent only to signalboxcrm.com, with each request the extension makes.

Profiles you open

When you open a LinkedIn or Instagram profile, the extension sends that profile's address to SignalBox to check whether the person is already in your CRM, so it can show their status, circles and follow-up date. We do not keep a record of the profiles you view. Our hosting provider's request logs, which can include the address, are kept for a short period for security and troubleshooting. Nothing is sent from any other page.

When you save someone

The extension reads the person's name, headline, profile photo and profile address from the page to fill in the form. Only when you click Add or Update is anything saved: the name, company and email as shown in the form, the circles, stages and note you choose, the profile address, LinkedIn's identifier for the profile, and the profile photo. SignalBox stores a small copy of the photo, because LinkedIn and Instagram photo links stop working after a while.

Filling in missing photos

Contacts imported into SignalBox often have a LinkedIn profile address but no photo. While a LinkedIn tab is open and in view, the extension asks SignalBox for contacts in your account that have a LinkedIn address and no photo, looks each one up on LinkedIn, and sends the profile photo address and LinkedIn's identifier for that profile back to SignalBox, which stores a small copy of the photo. It only looks up people who are already in your CRM, one at a time and at most 60 a day, and it stops for the day if LinkedIn declines a request. The lookups use your existing LinkedIn session in the browser, the same way LinkedIn's own pages load a profile, including the anti-forgery token LinkedIn requires on these requests. That token and your LinkedIn session are never sent to SignalBox.

Stored in your browser

• Your SignalBox API key and the SignalBox address it belongs to
• For the photo fill: which contacts have been looked up in the last 14 days, and how many today

All of it is removed when you remove the extension.

What the extension does not do

• Does not read your LinkedIn or Instagram messages, connections, feed or searches
• Does not run on, or send anything from, any other website
• Does not keep your browsing history
• Does not contain advertising, analytics or any third-party code
• Does not load code from the internet; everything it runs ships with the extension
• Does not sell or share data, or use it for anything other than your SignalBox account

Permissions used

• storage: to keep your API key and the photo-fill progress described above
• activeTab: so the toolbar popup can read the profile open in the current tab
• scripting: to load the extension's own bundled script into a LinkedIn or Instagram tab that was open before it was installed
• linkedin.com and instagram.com: to show the SignalBox bar on profiles and read the details described above
• signalboxcrm.com: to save contacts to your account and check whether someone is already saved