Privacy Policy

Effective Date: August 31, 2026 Last Updated: August 31, 2026

Nolibox (Hong Kong) Limited ("Dynal", "we", "us", or "our") operates dynal.ai, Dynal web applications, browser extensions, and related services (the "Services").

This Privacy Policy explains how we collect, use, store, transfer, and disclose personal information when you use the Services. Where applicable law requires separate consent for a specific activity, we will request that consent separately.

Dynal is an independent tool. It is not affiliated with, endorsed by, or sponsored by LinkedIn.

If you have questions or requests, contact us at hello@dynal.ai.

Information We Collect

Information You Provide

• Account information: name, email address, password or authentication method, company, country, time zone, profile photo, and account preferences.
• Workspace and profile information: goals, brand voice, language preferences, ideal customer information, saved settings, and other materials you enter to configure Dynal.
• Social integrations: when you authorize an integration, we receive the profile, account identifiers, tokens, permissions, and related information needed to provide that integration.
• Customer Content: prompts, messages, drafts, comments, uploaded files, saved resources, product information, case studies, and other content you submit, upload, import, or ask Dynal to process.
• Communications: support requests, emails, surveys, feedback, and related correspondence.
• Payment information: payment details are processed by third-party payment providers such as Stripe. We do not store full card numbers.
• Testimonials: with your permission, we may publish your feedback with your name or attribution you approve.

LinkedIn Browser Extension Information

If you use the Dynal browser extension for LinkedIn, the extension reads content that is already rendered on the page you are viewing. It does not fetch LinkedIn content that you cannot already see.

On LinkedIn, the extension may read:

• Comments and engagement on your own posts: commenter public name, headline, profile link, comment text, source post link, timestamp, and, only when opened by you, reaction or repost lists.
• Your LinkedIn notifications page: to aggregate people who engaged with your posts.

On dynal.ai, the extension reads your Dynal login session so signed-in extension features can work.

The extension is designed as a read-only assistant. It does not auto-scroll, auto-load, scrape in the background, poll LinkedIn pages in the background, or post or send anything on your behalf.

Information We Collect Automatically

• Device and usage data: IP address, browser type, operating system, device type, referring URLs, access times, feature usage, and diagnostic events.
• Cookies and similar technologies: we use cookies and similar technologies for authentication, product functionality, security, analytics, and service improvement.
• Security and diagnostic information: logs, crash data, error reports, and security signals needed to maintain and protect the Services.

Information from Third Parties

• Login and identity providers: if you sign in using Google, LinkedIn, or another provider, we may receive your profile information, email address, and account identifiers.
• Service providers: providers that support hosting, infrastructure, analytics, payment processing, communications, customer support, and AI processing may provide operational information to us.
• Public sources and social media: we may collect information from public interactions with our brand or public materials you choose to connect to the Services.

How We Use Information

We use information to:

• Provide, operate, maintain, secure, and support the Services.
• Authenticate users and manage accounts, workspaces, subscriptions, and permissions.
• Process transactions and manage billing.
• Save preferences and personalize your experience.
• Generate, rank, draft, translate, summarize, or otherwise process content you ask Dynal to handle.
• Send security alerts, service updates, support messages, and other essential communications.
• Send marketing communications where permitted, with opt-out options where required.
• Analyze feature usage, reliability, and performance.
• Detect, prevent, and respond to fraud, abuse, policy violations, and security incidents.
• Comply with legal obligations and enforce our terms.
• Create aggregated or de-identified analytics that do not identify you.
• Carry out other purposes with your consent.

LinkedIn Browser Extension Processing

When you use AI features in the Dynal browser extension, relevant data is sent over HTTPS/TLS to Dynal's backend service to generate the results you request:

• Prospect scoring: for prospects shown to you, signals such as name, headline, profile link, comment text, source post link, and timestamp may be sent so the backend can rank or classify them.
• Reply drafting: the selected comment, reply language, original post text, your past replies used as writing-style examples, instructions you type, and relevant saved resources may be sent to generate a draft.
• Translation: when you are signed in, text you choose to translate, including comments, headlines, and drafts, may be sent to the backend for AI translation subject to plan limits. When you are not signed in, or when quota is unavailable, translation may be performed locally in your browser.
• Settings and resources: if you are signed in, the backend returns your saved language, goal, account, subscription, and resource-library information.

If you are signed in to Dynal, extension requests may include your Dynal session token or related authentication state so the backend can provide account-specific results.

The extension may store the following locally in your browser through Chrome extension storage: session and preference data, cached drafts, current page lead snapshots, account selection, resource-library cache, handled or hidden items, and UI state. You can clear locally stored extension data by removing the extension.

Chrome Limited Use

Information obtained from the Dynal Chrome extension is used only to provide and maintain user-facing extension features, comply with law, protect security, or prevent abuse. Our use and transfer of information received through the Dynal Chrome extension complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. We do not use extension-derived LinkedIn page content or Customer Content for advertising, retargeting, unrelated market research, or general-purpose model training unless you provide separate affirmative consent.

Legal Bases for Processing

Depending on your location, we process personal information on one or more of these grounds:

• Contractual necessity: to provide the Services you request.
• Legitimate interests: to secure, maintain, improve, and communicate about the Services, where those interests are not overridden by your rights.
• Consent: for activities that require consent, such as certain marketing communications or optional integrations.
• Legal obligation: to comply with applicable law.

How We Share Information

We share information only as reasonably necessary for the purposes described in this Policy:

• Service providers and processors: cloud hosting, database, infrastructure, security, logging, analytics, payment, email, support, and AI model providers.
• AI processing providers: third-party AI model or infrastructure providers may process Customer Content or extension-derived content when needed to generate a requested AI result.
• Payment processors: payment providers such as Stripe process billing information.
• Analytics providers: analytics tools such as Google Analytics or Mixpanel may process product usage events. We do not intentionally send full user prompts or full LinkedIn page content to analytics tools.
• Integration partners: when you choose to connect or use a third-party integration.
• Affiliates and business transfers: within our corporate group or in connection with a merger, acquisition, financing, or asset transfer.
• Legal and safety purposes: when required by law, legal process, or to protect rights, safety, security, and service integrity.
• With your direction or consent: when you ask us to share information or authorize a specific use.

We do not sell personal information. We do not share extension-derived LinkedIn page content or Customer Content for cross-context behavioral advertising.

Your Rights and Choices

Depending on your location, you may have the right to access, correct, delete, export, restrict, or object to processing of your personal information, withdraw consent, opt out of marketing, or lodge a complaint with a supervisory authority.

You may choose whether to provide optional information. If you do not provide information needed for a feature, that feature may not work.

To exercise rights or ask questions, contact hello@dynal.ai. We may need to verify your identity before completing a request.

Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, unless a longer period is required or permitted by law.

Typical retention categories include:

• Account and billing records: while your account is active and as needed for legal, tax, accounting, dispute, and fraud-prevention obligations.
• Workspace settings and saved resources: while your account or workspace remains active, or until you delete them.
• Customer Content and AI processing records: as needed to provide the requested feature, support your account, debug service issues, and maintain safety and abuse-prevention records.
• Extension local storage: until you clear it, sign out where supported, or uninstall the extension.
• Security and diagnostic logs: for a limited period needed for security, reliability, fraud prevention, and troubleshooting.

When information is no longer needed, we delete, anonymize, or de-identify it.

International Data Transfers

We may process and store information in countries other than where you live. Those countries may have data protection laws different from your own. Where required, we use appropriate contractual and organizational safeguards for international transfers.

AI generation, scoring, drafting, and translation may be performed by Dynal's backend using third-party AI model or infrastructure providers. These providers may process data on servers outside your country.

California Users

If you are a California resident, you may have rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, including the right to know, access, delete, correct, and opt out of certain sharing.

We do not sell personal information. We do not share extension-derived LinkedIn page content or Customer Content for cross-context behavioral advertising. Where legally required, we will respond to legally recognized opt-out preference signals.

To submit a request, contact hello@dynal.ai. You may use an authorized agent where permitted by law, and we may verify the request.

European Users

If you are located in the European Economic Area, United Kingdom, or Switzerland, you may have rights under applicable data protection laws, including access, correction, deletion, portability, restriction, objection, withdrawal of consent, and complaint to a supervisory authority.

For most direct use of the Services, Nolibox (Hong Kong) Limited acts as the controller of personal information. Where we process personal information on behalf of an organization under a separate agreement, we may act as that organization's processor.

Cookies and Analytics

We use cookies and similar technologies for authentication, security, preferences, analytics, and product functionality. You can control cookies through your browser settings, but disabling some cookies may affect the Services.

We do not use extension-derived LinkedIn page content or Customer Content for advertising cookies or retargeting.

Data Security

We use technical and organizational measures designed to protect information, including encryption in transit, access controls, monitoring, and security review. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Children

The Services are not directed to children under 16. Paid accounts and subscriptions are intended for users who are at least the age of legal majority in their jurisdiction or who have valid authorization from a parent, guardian, or organization.

Changes to This Policy

We may update this Privacy Policy from time to time. We will update the "Last Updated" date above. If changes materially affect how we process personal information, we will provide notice as required by law and request consent where required.

Contact

Nolibox (Hong Kong) Limited

hello@dynal.ai