Hirlen Connector — Privacy Policy
Last updated: May 18, 2026
This privacy policy describes what the Hirlen Connector for LinkedIn Chrome extension does with the data it touches. It is short on purpose.
What the extension reads
When you visit a LinkedIn profile page (https://www.linkedin.com/in/…) and click Save to Hirlen, the extension reads the following fields from the page you have already opened in your browser:
- Full name
- Headline
- Location
- Current company and title
- Public "About" text
- Work experience list (company, title, dates, description)
- Education list (school, degree, field, dates)
- Skills list
- Public profile image URL
The extension does notmake any additional requests to LinkedIn. It does not call LinkedIn's private API. It does not read the network requests LinkedIn's own site makes. It only reads the DOM that your own browser has already loaded with your LinkedIn account.
What the extension does not read
- Phone numbers (only visible via paid LinkedIn Recruiter — outside the scope of public profile data)
- Email addresses
- Direct messages, InMail, conversation history
- Connections lists
- Recruiter Search / Sales Navigator data
- Anything outside of profile pages (feed, jobs, messaging)
Where the data goes
When you click Save to Hirlen, the extension sends the fields listed above to the Hirlen backend at https://nexuhr.com so they can be stored as a candidate in your Hirlen workspace.
The data:
- Is stored in your company's Hirlen database
- Is visible only to members of your company (your company's RLS policies enforce this server-side)
- Is never sold, shared with third parties, or used to train AI models
Authentication
To use the extension you must sign in to Hirlen. The extension stores your Hirlen access and refresh tokens in chrome.storage.local. They:
- Are scoped only to the Hirlen Supabase project
- Auto-refresh in the background while you are signed in
- Are deleted when you sign out from the extension popup
Permissions
The extension requests the minimum permissions Chrome's manifest system allows:
| Permission | Why |
|---|---|
storage | To remember your Hirlen auth token across browser restarts |
activeTab | So the popup can read what page you are on |
alarms | To refresh the access token before it expires |
host_permissions: https://nexuhr.com/* | To call the Hirlen API |
LinkedIn is not in host_permissions. The content script runs only on https://www.linkedin.com/in/* via the content_scripts manifest field, which is more restrictive.
LinkedIn's terms
This extension is designed to be used as a normal aid while you browse LinkedIn with your own account. It does not automate bulk extraction, does not send connection requests, and does not iterate through search results. Per LinkedIn's user agreement, automated data collection from LinkedIn is restricted. Using this extension beyond its single-profile-click design (e.g., scripting many clicks in quick succession) may violate LinkedIn's terms — don't do that.
Contact
Questions or to request data deletion: privacy@nexuhr.com