Integrations Data Policy

This policy is part of our Terms of Service. It explains what happens to your data when you connect Linq to another app or tool, alongside our Privacy Policy.

1. What this policy covers

It covers every way your contacts can leave Linq for another service:

Integration	Plan	What it does
Connected apps: HubSpot, Zoho CRM and Slack	Business	Sends your new contacts straight to your CRM or team chat
Webhooks	Pro and Business	Sends each new contact to an address you choose, such as Zapier, Make or your own server
REST API	Business	Lets your own scripts read and write your contacts with a key
AI assistants (MCP)	Business	Lets an assistant such as Claude or Cursor work with your contacts, with a key

For the contacts you collect, you decide how they’re used, and we process them for you (see section 1 of our Privacy Policy). The apps and tools you connect are services you choose. They aren’t our service providers: once your contacts reach them, their own terms and privacy policies apply.

2. Nothing is sent until you connect

• An integration only starts when you set it up: by connecting an app, adding a webhook, or creating a key. We never connect one for you.
• For a team, only its owners and admins can connect apps for the team. Every contact the team’s cards capture then goes through them, whoever captured it.
• You can see every connection, webhook and key, and how its last delivery went, on the Integrations page (or Team → Integrations).
• Integrations only work while you, or your team, are on a plan that includes them. If the plan changes, they’re kept but stop sending.

3. What each integration receives

Integration	What it receives	Never sent
HubSpot	A contact: name, email, phone, company, job title and website	Private notes, where you met, tags, their message, form answers, consent record
Zoho CRM	A lead: name, email, phone, company, job title, website, Linq as the lead source, and a description with where you met, tags, their message and form answers	Private notes, consent record
Slack	A message in one channel: name, job title, company, email, phone, where you met, which card, the first 500 characters of their message, and a link to Linq	Private notes, tags, form answers, consent record
Webhooks	The fields listed in What’s sent, including tags, form answers and the consent record	Private notes
REST API and AI assistants	What the key is used to ask for, from the contacts of the person who created the key, including notes	Anyone else’s contacts, including the team’s

When things are sent. HubSpot and Zoho CRM get each new contact as soon as it’s added, and an update each time you edit it. Slack and webhooks get each contact once, when it’s added. Contacts you import are sent only if you tick Also send them to my webhooks and connected apps.

In one direction. Connected apps and webhooks only receive. We don’t read, import or delete anything in the apps you connect, and changes made there don’t come back to Linq.

4. What we ask the apps for, and what we keep

App	Access we ask for	What we keep from it
HubSpot	Read and write contacts (crm.objects.contacts.read, crm.objects.contacts.write)	Its access tokens, your HubSpot account’s domain, and the ID of each contact we sent
Zoho CRM	Create, update and read leads	Its access tokens, and the ID of each lead we sent
Slack	Nothing: you give us an incoming webhook URL for one channel	The webhook URL

We use this access only to send your contacts as described above, never for anything else. We also record whether each delivery worked, and the error the app returned if it didn’t, so the Integrations page can show how the last delivery went.

5. How we protect it

• Encrypted at rest. Access tokens and Slack webhook URLs are encrypted (AES-GCM) with a key kept outside the database, so a copy of the database alone doesn’t give access to anyone’s apps.
• Only to the right place. Tokens are only ever sent to the app’s own addresses, and Slack messages only to Slack’s webhook addresses. Webhooks only go to public https addresses, never to private networks, and each request is signed so your server can check it came from Linq.
• Safe sign-in. Connecting an app uses a one-time link that expires after 10 minutes, so nobody can trick you into connecting the wrong account.
• Keys you control. API and AI assistant keys are stored only in hashed form, shown once, limited to 120 requests a minute, and can be revoked at any time. An AI assistant can’t delete contacts or send messages with them.
• Text treated as data. What people type on your card is passed to apps as plain text. In Slack it can’t mention or ping anyone, and AI assistants are told never to follow instructions found in it.

6. Disconnecting, uninstalling and deleting

• Disconnect an app on the Integrations page at any time. Sending stops at once and we delete the access it gave us. For HubSpot, we also ask HubSpot to cancel that access.
• Revoke a key, or delete a webhook, in the same place. It stops working at once.
• Uninstalling Linq from inside an app (for example in HubSpot’s connected apps) also stops sending. Linq then shows the connection as needing sign-in.
• What’s already sent stays there. Disconnecting doesn’t delete contacts from the app they were sent to, and deleting a contact in Linq doesn’t delete it there. Delete them in that app if you need to.
• Before you delete your Linq account, disconnect your apps, delete your webhooks and revoke your keys, so their access ends at once. Your account’s data is then deleted as described in our Privacy Policy.

7. Your responsibilities

• Only connect apps you’re allowed to use, and make sure you have the right to send your contacts to them, for example under data protection law or your company’s rules.
• Use the contacts in those apps lawfully, including anti-spam laws, as our Acceptable Use Policy requires.
• Keep API keys and webhook signing secrets private, as you would a password.
• If one of your contacts asks you to correct or delete their details, do it in Linq and in the apps you sent them to.

8. Changes to the apps we connect to

The apps we connect to can change how they work, or stop accepting our access. If that happens, a connection may need you to sign in again or may stop sending, and we’ll show it on the Integrations page. We may pause or end an integration to protect people or the Service, as our Terms of Service explain. When we add an app or change what we send to one, we update this policy and the app’s guide first.

9. Contact

Questions about integrations and your data: hello@linq-business.com.