Privacy notice

LOBSTR, located at 14 AV DU GENERAL DE GAULLE 94160 SAINT-MANDE - RCS Créteil 841840499, acting as data controller for the personal data of the users of its Services as defined by Regulation (EU) 2016/679 (GDPR) and by the amended Law No. 78-17 of 6 January 1978, attaches great importance to the protection of personal data.

This policy (the "Policy") applies to all websites and services, including the lobstr.io Account Sync Chrome extension (the "Extension"; together the "Services") offered by LOBSTR ("We", "Us").

1. DEFINITIONS AND DATA COLLECTION

Through this Policy, We wish to inform You of the means used and the purposes pursued for the collection of any information that identifies You ("Personal Data").

When using our Services, We may collect:

• Identity Data: Name, email address, company.
• Technical Data: IP address, browser type, and operating system.
• Authentication Data (Extension): The login cookies of the websites You connect and, for LinkedIn and Sales Navigator, the session headers of LinkedIn's own requests, read by the Extension only after You approve each request.
• Connection Location: The country, city and network operator of your connection when You sync an account (see section 3.2).

2. PURPOSES OF PROCESSING

Your Personal Data is processed for the following purposes:

• Management of your access to and use of our Services.
• Execution of automated data extraction (scraping) as requested by the User.
• Sending newsletters and promotional offers (subject to your consent).
• Compliance with our legal and regulatory obligations.

3. SPECIFIC DISCLOSURE FOR EXTENSION USERS

3.1 What the Extension reads, when, and for whom

The Extension connects the accounts You use on supported websites (LinkedIn, Sales Navigator, Leboncoin, X, Instagram and Facebook) to your lobstr.io workspace, so that the scrapers You launch on lobstr.io work with your own login session and You never give Us your password.

• Only after your approval: nothing is read until You click Approve in the Extension's own confirmation window, which names the website, the cookies it would read and what they are used for. One request at a time; a request expires after two minutes. The first time for a website, Chrome also asks You to allow access to that one website.
• Only what is listed: the Extension reads only the login cookies named for the website You approved and, for LinkedIn and Sales Navigator, the session headers (CSRF token, user agent, LinkedIn identity headers) of LinkedIn's own requests, in a LinkedIn tab it opens for a few seconds. It never reads your password, another website, or your browsing history.
• Only to lobstr.io: the Extension hands this data to the https://app.lobstr.io page that requested it, which sends it to our servers over HTTPS and saves it to the connected account in your workspace. No other website can communicate with the Extension.
• Nothing kept in your browser: the Extension itself stores nothing, makes no network request of its own, and contains no ads, analytics or remote code.

You can remove the Extension's access to a website at any time in Chrome's extension settings, and delete a connected account in Accounts on lobstr.io.

3.2 Location of your connection

At each sync, lobstr.io derives the country of your connection with the connected account (and may derive its city and network operator) from its IP address, with an IP geolocation database run on our own servers, so that its scrapers run from the same location as You. The IP address itself is not stored: we only keep a one-way fingerprint of it, which cannot be turned back into the address, to tell a new connection from the same one.

3.3 Chrome Web Store User Data Policy and Limited Use

The use of information received through the Extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements:

• Purpose Limitation: We only use the session data to run the scrapers You launch on lobstr.io.
• No Data Sale: We do not sell, trade, or rent your session data or any Personal Data to third parties.
• No Advertising: Your data is never used for serving advertisements, retargeting, or building marketing profiles.
• Human Review Limitation: Our employees do not access your session data unless it is strictly necessary for security purposes, to comply with applicable law, or for internal troubleshooting (after your express consent).

4. DATA SECURITY AND TRANSMISSION

All data collected by the LOBSTR Services is transmitted via secure, encrypted HTTPS protocols. We implement strict technical and organizational measures to ensure that session data is handled with the highest level of security.

Authentication tokens and cookies are stored using encryption and are only kept for the duration necessary to execute the automation tasks requested by the User.

5. RECIPIENTS OF YOUR DATA

Your Personal Data is only accessible to:

1. Authorized LOBSTR staff: For technical support and service management.
2. Our technical subcontractors: Who host our servers or provide specialized tools (e.g., cloud infrastructure), provided they offer the same level of protection as required by the GDPR.

6. DATA RETENTION

Personal Data is kept only for as long as necessary for the purposes for which it was collected:

• Account Data: Kept as long as your account is active, plus three years after the last contact.
• Session Data (Cookies): Kept temporarily for the execution of automation tasks and deleted periodically.

7. YOUR RIGHTS

In accordance with Regulations, You have the following rights:

• Right of access, rectification, or erasure of your Personal Data.
• Right to limit or object to the processing.
• Right to data portability.
• Right to withdraw consent at any time.

To exercise these rights, contact Us at: contact@lobstr.io

8. AMENDMENTS

We may update this Policy to comply with legal or technical developments. We recommend checking this page regularly.