Privacy Policy — Netsys Growth AI

Operated by Netsys Encoders Pvt. Ltd.

Effective date: September 2025
Last updated: September 2025

1. Information We Collect

We collect information you provide directly and information collected automatically when you use the Netsys Growth AI service ("the Service").

Account and authentication

  • Username or email address and password (hashed) for local administrator accounts
  • LDAP/Active Directory credentials when directory login is enabled — transmitted only during sign-in, never stored
  • Session tokens for authenticated sessions

Service usage data

  • Content you create: drafts, templates, campaigns, social posts, calendar events
  • Contact records you import or create (name, email, company, consent status, custom fields)
  • Organisation records you create or enrich
  • AI Assistant conversations (encrypted at rest)
  • Audit logs of significant actions (login, settings changes, campaign approvals, exports)

Third-party OAuth connections

  • When you authorize LinkedIn: your LinkedIn member URN (unique identifier), name, profile picture, email (if granted), and the OAuth access/refresh tokens
  • When you authorize Google Business Profile: your Google account identifier, accessible location identifiers, and OAuth tokens

Automatic collection

  • IP address, browser user agent, and request timestamps for security and audit logging
  • Email delivery events (opens, clicks, bounces, unsubscribes) via webhook from the configured email provider

2. How We Use Information

  • Provide and operate the Service: authentication, content creation, campaign management, social publishing, calendar, reporting
  • Send transactional and operational emails (login alerts, campaign approvals, system notifications)
  • Send promotional emails only to contacts who have opted in; every promotional email includes an unsubscribe link
  • Enforce suppression lists and consent status before every campaign send
  • Run AI-assisted drafting and research using your configured AI providers; conversation history is encrypted and private to each user
  • Publish social posts to your authorized LinkedIn personal profile when you explicitly approve or schedule them
  • Enrich company records via Google Places when you trigger Company Discovery
  • Security monitoring, fraud prevention, and compliance with legal obligations

3. LinkedIn / OAuth Data

This section explains how Netsys Growth AI handles LinkedIn personal-profile OAuth data for the Social Planner.

What we request

  • Scopes: openid, profile, email, w_member_social
  • We do not request organization scopes (r_organization_social, rw_organization_admin, r_liteprofile). Company-page posting is not supported.

Profile information obtained

  • Member URN (e.g., urn:li:person:...) — your unique LinkedIn identifier
  • Full name
  • Profile picture URL
  • Email address (only if you grant the email scope during authorization)

How we use it

  • Display the connected account in the Social Planner with your name and photo
  • Publish text posts to your personal LinkedIn profile only when you click "Publish Now" or schedule a post
  • Verify connection health via LinkedIn's /v2/userinfo endpoint

Credential and token handling

  • OAuth access tokens and refresh tokens are encrypted at rest using the application's AES encryption key before storage in the social_connections table
  • Tokens are never returned to the browser or logged
  • Only the Social Planner publish adapter decrypts the access token at publish time, in memory
  • Refresh tokens are used automatically to obtain new access tokens when they expire

Disconnecting LinkedIn

  • From the Social Planner, click "Disconnect" on the LinkedIn connection card
  • This deletes the connection row (including encrypted tokens) from the database
  • No further API calls are made to LinkedIn on your behalf
  • You can re-authorize at any time to create a new connection

4. Third-Party Services

The Service integrates with the following third parties only when you explicitly configure and authorize them:

  • Brevo (Sendinblue) — SMTP email delivery and webhook events (opens, clicks, bounces, unsubscribes). API key and webhook secret stored encrypted.
  • LinkedIn — OAuth 2.0 for personal-profile publishing (see Section 3). Client ID and client secret stored encrypted in the provider registry.
  • Google Business Profile — OAuth 2.0 for location posting. Client ID, client secret, and user tokens stored encrypted.
  • Google Places API — Company discovery/enrichment only. API key stored encrypted. Never used for social publishing.
  • AI Providers (OpenAI, Anthropic, Google Vertex AI, Azure OpenAI, Mistral, etc.) — API keys stored encrypted in the credentials vault. Used for content generation, research, and the AI Assistant.
  • People-data providers (Apollo, ZoomInfo, Cognism, DazLeads, GrabNear, Custom HTTP) — API keys or credentials stored encrypted. Used only when you trigger Key Person Search external discovery.

We do not sell personal data. Third parties process data only as described above and under their own privacy policies.

5. Data Retention

  • Account and authentication data: Retained while the account exists. Deleted when the account is removed by an administrator.
  • Service content (drafts, campaigns, posts, contacts, organisations, calendar events): Retained until you delete them.
  • AI Assistant conversations: Retained per the configured retention period in Settings → Assistant (default configurable, up to 10 years). Encrypted at rest.
  • Audit logs: Retained for operational and compliance purposes; not automatically purged.
  • Email delivery events: Retained for reporting and suppression management.
  • OAuth tokens (LinkedIn, Google): Retained while the connection is active. Deleted immediately when you disconnect.
  • Suppression list entries: Retained permanently to honor unsubscribe and bounce preferences.

No fixed, universal retention period is enforced by the application; retention is determined by your configuration and explicit deletion actions.

6. Data Deletion / Account Disconnection

  • Delete individual records: Use the UI to delete drafts, campaigns, contacts, organisations, calendar events, AI conversations, and vault records.
  • Disconnect LinkedIn: Social Planner → Connected Accounts → Disconnect. Removes encrypted tokens and member URN immediately.
  • Disconnect Google Business Profile: Settings → Social → Disconnect. Removes encrypted tokens and location mappings.
  • Remove email provider: Settings → Email → Delete provider. Removes encrypted API key and webhook secret.
  • Remove AI credentials: Settings → API credentials → Delete. Removes encrypted keys.
  • Delete administrator account: Requires a second administrator; removes the account and session tokens.
  • Full data export: Not currently automated. Contact support (Section 8) for assistance.

7. Security

  • Encryption at rest: All API keys, OAuth tokens, webhook secrets, AI conversation history, and vault records are AES-encrypted before storage in SQLite. The encryption key is derived from a server-side secret not stored in the database.
  • Encryption in transit: HTTPS enforced in production (TLS 1.2+). The application sets Secure and HttpOnly flags on session cookies.
  • Session management: Signed, HttpOnly cookies with configurable expiry. Sessions invalidated on logout and password change.
  • CSRF protection: OAuth flows use cryptographically random state parameters tied to the user session. Callback validates state before token exchange.
  • Rate limiting: Login attempts limited to 5 per 15 minutes per IP/username combination.
  • Input validation: All API endpoints validate and sanitize input. SQL uses parameterized queries exclusively.
  • Content Security Policy: Applied to HTML responses (with allowances for inline styles/scripts required by the SPA).
  • Secrets management: No secrets in code or logs. Production secrets provided via environment variables or the encrypted credentials vault.

We implement reasonable technical and organizational measures. No system can guarantee absolute security.

8. Contact

For privacy questions, data access requests, or deletion requests:

  • Email: Sales@netsysindia.in
  • Postal: Netsys Encoders Pvt. Ltd., New Town, Kolkata, West Bengal, India

We will respond within a reasonable timeframe consistent with applicable law.

9. Policy Updates / Effective Date

This policy is effective as of September 2025 and was last updated in September 2025.

We may update this policy to reflect changes to the Service or legal requirements. Material changes will be communicated via the Service dashboard or by email to administrators. Continued use of the Service after changes constitutes acceptance of the updated policy.

The current version is always available at https://growth.netsysindia.in/privacy-policy.

Netsys Growth AI is a marketing operations workspace operated by Netsys Encoders Pvt. Ltd.

Sign in · Netsys Encoders website