Last updated: September 10, 2026
In compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (General Data Protection Regulation, "GDPR"), applicable under its Article 3(2) to the processing of data of persons located in the European Union in connection with the offering of services, and, where applicable, with Spanish Organic Law 3/2018 of December 5 on the Protection of Personal Data and Guarantee of Digital Rights, users are informed that the controller of the personal data collected through the Clonio platform and the Clonio browser extension for Google Chrome (together, "the Services") is ZIPGENIAL LLC, a company organized under the laws of the State of Florida (United States of America), Employer Identification Number (EIN) 38-4286172, with address at 655 S Le Jeune Rd, Ste 905, Coral Gables, FL 33134 (United States of America) and email address contact@clonio.es, to which the user may write to exercise any of the rights recognized by applicable data protection law. Pursuant to Article 27 GDPR, the Controller, not being established in the Union, will designate in writing a representative in the European Union; the representative's contact details will be published on this page as soon as the designation is formalized, and until then communications will be handled through the email address indicated. The Controller has not appointed a Data Protection Officer (DPO), as none of the mandatory appointment cases under Article 37 GDPR apply.
The following categories of personal data are collected and processed through the Services, in accordance with the purposes and legal bases detailed below: (i) account data, primarily the email address provided during registration and the associated password, which is stored exclusively in encrypted form using one-way hash algorithms; (ii) data linked to the user's LinkedIn account, such as the OAuth 2.0 access token, public profile name, LinkedIn user ID, and, where applicable, public post performance metrics, all voluntarily provided by the user when connecting their LinkedIn account to the Platform via the standard OAuth authorization flow; (iii) data collected by the Clonio browser extension, including exclusively data from the user's own profile (name, professional headline, description, profile picture, follower and connection count, profile URL) and data from the user's own posts (text content, content type, publication date, associated images, and performance metrics such as reactions, comments, reposts, and impressions), all extracted only from the authenticated user's own profile and activity, never from third-party profiles, and transmitted via HTTPS to the Clonio server for storage and display on the analytics panel; (iv) content generated by the user through the Platform, including texts, images, drafts, schedules, and any other materials created via the integrated AI tools, stored associated with the user's account; (v) technical data automatically collected during navigation and Platform use, such as IP address, browser type and version, screen resolution, operating system, pages visited within the Platform, session times, and other technical information necessary to ensure security, availability, and proper service operation; (vi) billing and payment data, including name, billing address, tax identification number (where applicable), and payment card data, the latter being processed and stored exclusively by Stripe, Inc. as a PCI-DSS Level 1 certified payment processor, without the owner of the Services having access at any time to the full card number; and (vii) contact data, specifically the email address voluntarily provided by the user via the contact form on the Platform.
To allow the user to generate personalized images incorporating their face, the Platform offers an optional avatar feature through which the user can voluntarily upload a facial photograph of themselves. That photograph, as it allows the unambiguous identification of the individual based on their facial features, is considered biometric data included in the special categories of personal data set out in Article 9(1) of the GDPR. The processing of this special category of data is carried out exclusively on the basis of the data subject's explicit consent under Article 9(2)(a) of the GDPR, given through the voluntary and deliberate action of uploading the image to the Platform via the AI identity settings feature. The photograph is stored in the user's account's private storage bucket and is transmitted, only when the user expressly requests image generation, to the AI image model provider identified in section 6 of this policy, acting as a data processor. The user may revoke consent and delete the photograph at any time from the Platform's settings section, without such revocation affecting the lawfulness of processing carried out beforehand. The user undertakes to upload only their own photograph; uploading facial images of third parties without their explicit consent is expressly prohibited and is the user's sole responsibility, under the Image Generation Rules.
Regarding the Clonio browser extension for Google Chrome, the user is informed that it uses the following browser permissions, both justified by active and necessary functionality: (i) storage: to store locally on the user's device, via chrome.storage.local, the user's authentication token (with a maximum validity of twenty-four hours, after which it is automatically deleted), the email address associated with the account, the timestamp of token reception, the date of the last synchronization performed, the number of posts synchronized, and a temporary post cache (with a maximum validity of thirty seconds); and (ii) alarms: to schedule periodic checks (every five hours) of authentication token validity and maintain the functional connection without requiring repeated authentication. The injection of sync code into the user's own profile pages is done declaratively via content_scripts in the manifest, with no additional permissions required. The user's session cookie on the professional social network is read exclusively via document.cookie in the context of the user's own browser, without requiring the chrome.cookies permission, and that cookie remains in the user's browser at all times and is never transmitted to Clonio's servers or to third parties.
The data collected via the extension includes exclusively: from the authenticated user's own profile (name, professional headline, description, photo, follower and connection count, industry, location, language, and internal profile identifiers) and from the user's own posts (text content, content type, publication date, associated images, performance metrics such as reactions, comments, reposts, impressions, and video views, and the original post ID when it is a repost). Additionally, when the user has a paid account on the professional social network that enables access to advanced metrics, daily aggregated data may optionally be collected (followers gained per day, impressions per day, and profile views over the last ninety days); without such paid account, this data is not collected.
The extension operates exclusively on the authenticated user's own profile and activity, never on third-party profiles. It does not access the user's browsing data outside the professional social network's pages, does not collect other users' data, does not modify the network's content or functionality, does not inject ads or trackers, and does not transmit data to third parties other than the Clonio server (clonio.es). Data synchronization is done only at the user's initiative or automatically when they visit their own profile with the extension active and authenticated.
The user's personal data is processed for the following purposes: managing the user's account and authenticating their identity on the Platform and in the browser extension; collecting and presenting performance statistics for the user's own LinkedIn posts via automated data synchronization through the browser extension; generating and scheduling text and visual content for the LinkedIn social network using third-party AI models, including automated analysis of the user's LinkedIn profile during onboarding to detect their writing style, tone, and topics, and generating personalized images that may incorporate the profile photo (avatar) voluntarily provided by the user under section 3; automated or semi-automated publishing of such content on the user's LinkedIn account, with their express authorization; managing subscriptions and recurring payments via Stripe; and statistical measurement of service use, technical error detection, and session recordings with automatic masking of sensitive fields (passwords, email addresses, and phone numbers), solely to improve the operation, stability, and user experience of the Platform. The legal bases legitimizing processing are: (a) performance of a contract to which the data subject is a party, or pre-contractual measures at the data subject's request, under Article 6(1)(b) of the GDPR, to the extent that processing is necessary to provide the service contracted by the user; (b) the data subject's consent, under Article 6(1)(a) of the GDPR, specifically for connecting with the user's LinkedIn account, collecting metrics on their posts via the browser extension, publishing content on their behalf, and collecting usage statistics, error detection, and session recordings via the analytics tools described in section 6, with the latter consent expressly given via the cookie configuration banner under the Cookie Policy and revocable at any time from the cookie page, without revocation affecting the lawfulness of processing carried out beforehand; and (c) the data subject's explicit consent under Article 9(2)(a) of the GDPR for processing the user's facial photograph as biometric data, in the terms detailed in section 3.
For service provision, the Controller relies on the following providers, acting as data processors under Article 28 of the GDPR, with whom the corresponding processing agreements have been signed and, where applicable, the appropriate safeguards for international transfers under Articles 44 and following of the GDPR:
Data is hosted in data centers located in the European Union (Supabase, Vercel, Upstash and PostHog in the EU region). Access to such data by the Controller from the United States, the data having been collected directly from the data subjects, does not constitute an international transfer within the meaning of Chapter V GDPR according to Guidelines 05/2021 of the European Data Protection Board. Processors established in the United States (OpenAI, Stripe, PostHog Inc.) process data under the standard contractual clauses approved by the European Commission or, where certified, under the EU-U.S. Data Privacy Framework.
The Controller may expand or modify this list of providers when necessary for proper service provision, updating this policy accordingly. The user may request at any time, via the contact address indicated in section 1, additional information on the specific safeguards applicable to international transfers.
AI connectors: if you connect Clonio to an assistant (Claude, ChatGPT or another MCP client), that assistant accesses the data you authorize and acts on your behalf with those permissions, which you can revoke at any time in Settings → Connections. Clonio never transfers your password or your LinkedIn credentials to the assistant. The assistant provider's own processing of that data is governed by its own policy.
The user's personal data is retained while they maintain an active account on the Platform and, once cancellation or account deletion is requested, a grace period of fourteen (14) calendar days begins, during which the account can be recovered by the user via request through contact@clonio.es; after this period without the user requesting recovery, the personal data associated with the account is deleted or anonymized definitively and irreversibly through an automated purge process, which includes deleting the biometric photograph from the storage bucket, deleting in the AI model provider the inputs and outputs associated with the user (to the extent the contractual conditions with that provider allow), and invoking the corresponding API of the analytics provider (PostHog Inc.) to delete the events, pseudonymous profiles, and session recordings associated with the user. However, certain data must be retained by legal mandate beyond account deletion: (i) billing and financial transaction data will be retained for the periods required by the tax and commercial legislation applicable to the Controller in the United States of America and, for sales to European Union consumers under the VAT One-Stop-Shop (OSS) scheme, for ten (10) years pursuant to Article 369 of Directive 2006/112/EC; and (ii) any data that by its nature must be blocked and made available exclusively to public administrations, judges, and competent courts during the statute of limitations period for actions that may derive from the relationship with the user. Data stored locally by the browser extension is automatically deleted when the extension is uninstalled or when the retention periods indicated above expire (twenty-four hours for the authentication token, thirty seconds for the post cache). The user may exercise at any time the rights of access, rectification, deletion, objection, restriction of processing, and data portability recognized by Articles 15 to 20 of the GDPR, as well as revocation of consent given under Article 7.3 of the GDPR, by sending their request to contact@clonio.es, accompanied by a copy of their national identity document or equivalent document certifying their identity, clearly indicating the right they wish to exercise and, where applicable, the specific data they wish to exercise it on. The user also has the right to lodge a complaint, if they consider that the processing of their personal data does not comply with applicable law, with the data protection supervisory authority of their country of habitual residence; for users residing in Spain, the Spanish Data Protection Agency (www.aepd.es).
The Platform is a deployer of generative AI systems within the meaning of Regulation (EU) 2024/1689 (AI Act). The Controller adopts reasonable technical measures to mark the outputs generated by the AI models used, under Article 50(2) of the Regulation, whose transparency obligations become fully enforceable from August 2, 2026. The user is informed that they themselves, when publishing on LinkedIn or other platforms images generated with the Platform, assume the disclosure obligations under Article 50(4) of the Regulation when the published content constitutes a deepfake or informs the public on matters of public interest, as detailed in the Aviso Legal and in the Image generation rules.
The Services are intended exclusively for persons over eighteen (18) years of age. The Controller does not knowingly collect data from minors; if it becomes aware that data from a minor has been collected, it will delete it immediately.
The owner of the Services applies appropriate technical and organizational measures to ensure a security level adequate to the risk of processing, including encryption of communications in transit via TLS protocols both on the Platform and in the browser extension, encryption at rest of user passwords, role-based access control, Row Level Security policies in the database to ensure data isolation between users, origin validation in communications between the browser extension and the server (issuer domain verification), automatic authentication token expiration, two-factor authentication where applicable, periodic backups, and continuous system monitoring to detect unauthorized access or anomalous behavior, all in accordance with Article 32 of the GDPR and other complementary regulations.
In the event of a personal data breach, the Controller will notify the breach to the competent supervisory authority within seventy-two (72) hours of becoming aware of it, under Article 33 of the GDPR, and when such breach poses a high risk to the user's rights and freedoms, will notify the affected user without undue delay under Article 34 of the GDPR.