Privacy policy

This policy explains what ExtraProfile (“we”) collects when you apply to rent your LinkedIn profile or send us a business enquiry, why we collect it, and what control you have over it.

Who we are

ExtraProfile runs this website and is the controller of the personal data described in this policy. For any privacy question or request, email info@extraprofile.com. Businesses can also reach us through the enquiry form.

What we collect

• What you type into the application form: name, email, phone number, LinkedIn profile URL, country, and optionally the monthly amount you are looking for, your headline, industry and free-text notes.
• Your stated preferences: connection band, commitment length and preferred payout method.
• What a business types into the enquiry form: name, company, work email, optionally a phone number, and what the business needs.
• Technical data captured when a form is submitted: your IP address and a timestamp, used for rate limiting and fraud prevention.

We do not use advertising cookies on this site. The site uses Vercel Web Analytics, which is cookieless and collects aggregated page-view data.

What we hold once an engagement starts

Everything above is about an application. Once a campaign is running, the service itself touches more than a form, and you should know what.

• Access to your LinkedIn account. Our team signs in and operates the account to run the campaigns you approved. Access is set up with you at onboarding and is held only by the specialists working on your campaigns and the person supervising them. It is never given to a client or to anyone outside our team, and it ends when the engagement ends.
• Verification codes you pass to us. A code you relay is used once, to complete that LinkedIn sign-in, and is not stored afterwards. We ask only for LinkedIn codes — never a code for your email, your bank or any other service, and nobody asking for one of those is us.
• Replies that arrive in your LinkedIn inbox. People contacted during a campaign reply to you, and the team running that campaign reads those threads in order to answer them. We do not read, copy or export message threads that have nothing to do with the campaign, and we do not contact your existing connections.
• The monthly activity log. The log we send you records what was sent from the account, including the name, job title and company of each person contacted under your name, and the templates used. The fields are listed on our safety and risk page. Those records are personal data about the people contacted as well as about you, which is why they are kept for a fixed period and then deleted rather than held indefinitely.

The lawful basis for all of the above is the performance of the engagement agreement between us, and our legitimate interest in keeping a record of what was sent from an account we operated.

Why we collect it

• To assess whether your profile matches current client demand and to quote you a rate.
• To contact you about your application, or to reply to your business enquiry.
• To prevent automated and duplicate submissions.
• To keep records we are legally required to keep once an engagement begins.

The lawful basis is your consent when you submit the form, and our legitimate interest in operating and protecting the service.

Where it is stored

Applications are stored in Upstash Redis (our system of record) and mirrored into a Google Sheet that only our team can access. Business enquiries are stored in the same database. Campaign records and the monthly activity log are held in the same systems. The site is hosted on Vercel. Each of these providers may process data outside your country of residence.

Where that means moving personal data out of the UK or the European Economic Area, the safeguard we rely on is the data-processing agreement each of those providers publishes, which incorporates the European Commission's standard contractual clauses. You can ask us for a copy of the relevant terms at any time.

Who we share it with

We do not sell your data. We share it only with:

• The infrastructure providers named above, acting on our instructions.
• Payment providers, once an engagement begins and only as needed to pay you.
• Authorities, where we are legally compelled.

What clients see

By default, clients see only a profile's industry, seniority band, region, network size band and availability — never your name, contact details or profile link.

When a client asks to see your profile

Sometimes a client wants to look at the actual profile before going ahead. We only do that with your say-so, and we ask you first — never afterwards.

If you're happy for us to, we send that one client a private link showing your public LinkedIn profile, the same page anyone on LinkedIn would see. The link covers only your profile, runs out on its own after a couple of weeks, and we can switch it off sooner if you ask. Search engines can't find it.

Your email address, phone number, payment details and the amount we pay you are never part of it. We ask the client to keep what they see to themselves and to come through us rather than contacting you directly.

You can change your mind at any point. Just tell the person from our team who contacted you (by phone or WhatsApp), or email info@extraprofile.com, and we'll switch off any links that are still open. Something already seen can't be unseen, which is why we check with you beforehand.

Apart from this, your details don't go to any client.

How long we keep it

• Rejected or inactive applications: 12 months, then deleted.
• Active engagements: for the duration, plus 12 months for dispute resolution.
• Campaign activity logs: 12 months from the end of the month they cover, then deleted. They are kept that long so either side can settle a dispute about what was sent.
• Verification codes: not retained. A code is used for the sign-in it was sent for and nothing else.
• Payment records: as long as tax and accounting law requires.
• Business enquiries: as long as we need them to respond and follow up, and deleted on request.

Your rights

You can ask us to show you what we hold, correct it, delete it, or stop processing it. Tell the person from our team who contacted you (by phone or WhatsApp), or email info@extraprofile.com, and we will respond within 30 days. Deletion requests for applications that have not become engagements are honoured immediately and without argument.

Two further rights, which apply wherever data-protection law gives them to you:

• Withdraw your consent at any time. Where we rely on your consent — the application form, and any agreement to show your profile to a client — you can take it back, by the same routes above, without giving a reason. That does not undo processing already carried out before you withdrew it.
• Complain to a supervisory authority. If you are in the UK, the EEA or anywhere else with a data-protection regulator, you can complain to the authority for the country you live or work in. You do not have to come to us first, though we would rather you did so we can fix it.

Security

Data is transmitted over HTTPS and stored with access limited to the people who need it. Admin access requires authentication and is rate-limited. No system is perfectly secure, and we will tell affected applicants promptly if a breach affects their data.

Changes

If we change this policy materially we will update the date above and, where we have your email and an active engagement, tell you directly.