Privacy Policy — Chrome Extension.
What the extension reads, and what it keeps.

Marvin SAS — marvin-recruiter (France). The extension is a professional tool intended for an authenticated recruiter user with an account on app.marvins.ai. No processing is performed for an unauthenticated user.

The extension collects the following categories of data, only when the user has explicitly initiated an action (opening the side panel, importing a profile, sending a message):

The extension does not collect: browsing history outside LinkedIn, private LinkedIn messages (outside threads opened via a Marvin outreach), payment data, geolocation.

Data leaves the extension only to the following recipients. All flows are encrypted with TLS 1.2+.

No data is sold. No advertising sharing. No data is transmitted to LinkedIn outside the user's normal browser traffic.

AI writing assistant

When the user clicks an action in the Write tab of a record, the extension sends the Marvin API the text they typed in the side panel (draft, instruction), the selected channel and the identifier of the displayed Marvin record. The Marvin API processes this request with its AI providers (listed in the sub-processors annex); the record context is built server-side, without contact details: position, company, skills and, where applicable, at most the last 8 verified one-to-one LinkedIn/WhatsApp exchanges with the person already in Marvin, which are sent to the AI provider for this feature. The record's name is masked: the full name in the record fields (position, company), and the first or last name alone too in messages, where the social security number (NIR) and IBAN are masked as well. A name written in lower case, a compound name after a hyphen (“Dupont-Zorglub”, “Jean-Dominique”), a first name shorter than 3 letters and third parties' names may remain. Group threads, unverified messages and emails are excluded. For this feature, the extension neither reads nor writes anything on the LinkedIn page: the suggestion is copied to the clipboard and the user pastes it themselves.

• Contract performance (GDPR art. 6.1.b) for the recruiter user: providing the Marvin service.
• Legitimate interest (GDPR art. 6.1.f) for the LinkedIn profiles processed: allowing the recruiter to organize their professional prospecting in accordance with LinkedIn's public purpose. The candidate is informed at the first outbound interaction.

Any concerned individual may exercise their rights of access, rectification, erasure, restriction, portability and objection:

• Recruiter user — via the app.marvins.ai interface or by writing to privacy@marvins.ai.
• Candidate / imported profile — by writing to privacy@marvins.ai. An identity verification procedure is in place before processing.

Complaints may be addressed to the CNIL (www.cnil.fr).

The extension uses chrome.storage.local (browser API, isolated per extension) to persist:

• The authentication JWT (encrypted at rest by Chrome).
• User preferences (locale, last opened panel).

No third-party cookies are set. chrome.storage does not leave the user's machine.

When the user clicks Connect in the side panel to link their LinkedIn account, the extension reads the li_at (LinkedIn session) and, if present, li_a (Premium token) cookies via the chrome.cookies API — and only at that specific moment. They are never read in the background, never stored in chrome.storage, never persisted on the extension side.

These values transit encrypted via TLS to the Marvin API, which immediately forwards them to Unipile to provision the session server-side. The Marvin API never stores li_at / li_a in database: only the Unipile identifier (account_id) is persisted after the exchange. The user can revoke the connection at any time from Settings > Integrations.

No broad <all_urls> permission is requested.

Any material change to this policy is the subject of a new version of the extension and an in-panel notification on first startup after the update.

Contact: privacy@marvins.ai.