Privacy Policy

PromotingLeader ("we", "our", "us") is a LinkedIn personal-branding SaaS platform built for Indian creators, founders, and professionals. Our registered business address and principal place of operations is in India. For privacy queries, contact us at privacy@promotingleader.com.

We collect the following categories of personal data:

• Account data: Name, email address, and profile picture provided when you sign in via LinkedIn, Google, or email one-time code.
• LinkedIn profile data: When you connect your LinkedIn account, we receive your public profile information (name, headline, profile URL) via the LinkedIn OAuth API. We do not access your private messages, contact list, or connections.
• Content you create: Posts, carousels, ideas, stories, and brand information you enter or generate on the platform.
• Usage data: Pages visited, features used, session duration, and actions taken (e.g., posts generated, published). Collected for analytics and platform improvement.
• Payment data: Billing is handled by Stripe. We store your Stripe Customer ID and subscription status; we never store raw card numbers.
• Device & technical data: Browser type, IP address, operating system, and referring URL, collected automatically via server logs.

We use your data to:

• Provide, maintain, and improve the PromotingLeader platform.
• Generate AI-powered LinkedIn content on your behalf using Google Gemini models.
• Send transactional emails (approval alerts, reminders, receipts). Marketing emails are opt-in only.
• Process payments and manage your subscription via Stripe.
• Detect and prevent fraud, abuse, and security incidents.
• Comply with applicable Indian laws, including the Digital Personal Data Protection Act, 2023 (DPDP Act).

We do not sell, rent, or trade your personal data to third parties for advertising purposes.

When you use our AI content generation features, your prompts and business profile information are sent to Google Gemini (via the Lovable AI gateway) to generate LinkedIn posts, carousels, and other content. This data is processed solely to generate your requested content and is not used to train third-party AI models under our agreement.

You own all content you create through the platform. We do not claim any intellectual property rights over content you generate or submit.

We share your data only with:

• Google / Lovable AI gateway – AI content generation (your prompts and business context).
• Stripe – payment processing (billing data only).
• Dropbox – if you connect Dropbox for media storage (optional).
• WhatsApp Business API – approval notifications if you enable them.
• Legal authorities – if required by Indian law, court order, or to protect our legal rights.

All third-party service providers are contractually bound to handle your data securely and only for the purposes we specify.

Your data is securely stored on encrypted PostgreSQL databases hosted in secure cloud environments. All data in transit is encrypted with TLS 1.2+. Sensitive credentials (API keys, OAuth tokens) are stored securely using environment-level encryption and are never committed to source code.

Access to your data is strictly restricted to authenticated users via application-level authentication and row-level partitioning checks. Super admins (platform operators) may access aggregated metrics solely for platform monitoring and operational support.

No system is 100% secure. If we become aware of a data breach that affects your personal information, we will notify you within 72 hours as required under the DPDP Act.

As an Indian data principal, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete personal data.
• Erase your personal data (right to be forgotten), subject to legal retention requirements.
• Withdraw consent for processing at any time.
• Nominate a representative to exercise your rights on your behalf.
• Grievance redressal – file a complaint with our grievance officer or the Data Protection Board of India.

To exercise any of these rights, email us at privacy@promotingleader.com with the subject "Data Rights Request". We will respond within 30 days.

We use browser local storage and session storage to save your drafts, preferences (dark mode, view mode), and authentication tokens. We do not use third-party advertising cookies. You may clear your browser storage at any time; this will log you out and clear saved drafts.

We connect to LinkedIn using standard OAuth 2.0. The scopes we request are limited to:openid profile email w_member_social. This allows us to read your basic profile and publish posts on your behalf when you explicitly approve them. We do not access your private messages, connections, or analytics data beyond what the standard LinkedIn API provides.

You can revoke our LinkedIn access at any time via LinkedIn Settings → Security → Authorized Applications. Revoking access will disable auto-publishing but will not delete your account or content on PromotingLeader.

We retain your personal data for as long as your account is active. If you delete your account, we will remove your personal data within 30 days, except where retention is required by law (e.g., financial records for 7 years under Indian accounting law). Content items (posts) you have already published to LinkedIn remain on LinkedIn's servers and must be deleted there directly.

PromotingLeader is not intended for persons under 18 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a minor, contact us immediately at privacy@promotingleader.com.

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top and notify you by email if the changes are material. Your continued use of the platform after notice constitutes acceptance of the updated policy.

In accordance with the Information Technology Act, 2000 and rules made thereunder, the name and contact details of our Grievance Officer are: