Privacy notice
LKDN Autopilot (lkdnautopilot.com)
Version 1.0, 24 October 2026
Notice given pursuant to Arts. 13 and 14 of Regulation (EU) 2016/679 (GDPR) and to Law of the Republic of San Marino no. 171/2018.
1. In short #
LKDN Autopilot is a subscription service, reserved for professionals and businesses, that works on your LinkedIn account according to the instructions you yourselves give: it searches for the people you have decided to meet, visits their profile, sends a connection request and, if it is accepted, asks one single question. When the person replies, the automation stops and we notify you by email.
In this service we process data of two kinds of people:
- you, our customers (sections 4, 5 and 6): for these data Migastone is the data controller;
- the people you choose to contact on LinkedIn (section 7): for these data you are the controller and Migastone is the data processor.
We do not sell data. We do not advertise. We do not use profiling cookies. Your LinkedIn password does not reach us: we do not see it and we do not store it.
2. Who we are: the data controller #
For customer data the data controller is:
- Migastone International S.r.l., a limited liability company (società a responsabilità limitata) under San Marino law
- Registered office: Via 28 Luglio 212, 47893 Borgo Maggiore, Republic of San Marino
- Economic Operator Code (Codice Operatore Economico): SM28583
- Contact for every privacy request and for support: info@lkdnautopilot.com
The Service is sold by the same company through the MigaMATCH store. Data relating to the purchase and to payment are also processed in that context, according to the privacy notice published in the store.
3. Data protection officer and representative in the EU #
Data protection officer (DPO)
- Ing. Antonio Mirizzi
- Via Tommaso Fiore 82, 70019 Triggiano (BA), Italy
- Email: rpd@invictusaziende.it
Representative in the European Union (Art. 27 GDPR)
- Walter Coslop
- Via Ugo Bassi 11, 47822 Santarcangelo di Romagna (RN), Italy
- Email: w.coslop@migastone.com
4. Which customer data we process #
| Category | What | Where it comes from |
|---|---|---|
| Purchase and contact data | first name, last name, email, telephone | from the purchase, which creates your account |
| Access data | email, password (stored only in encrypted form), sign-in session | from you, at the first sign-in |
| Configuration data | description of your business, whom you want to meet, your best clients (label, note, LinkedIn address if any), proposed segments and your choices, texts of the invitation note and of the opening question, daily limits, hours, working days, time zone, pause days | from you, in the guided setup |
| Data of your LinkedIn account | connection status, technical identifier, name, professional headline, number of connections, type of plan (free, paid, Sales Navigator), public profile data | from LinkedIn, through the technical provider of the connection, after your consent |
| Summary of your network | only aggregate counts by sector, seniority level and region, with the sample size and the date. We do not store the list of people | calculated from your LinkedIn contacts (section 7.6) |
| Usage logs | actions performed by the Service for your account, outcome, errors, limits applied, acceptances of terms and consents with the date and version of the text | generated by the Service |
| the emails we send you (reply alerts, daily summary, disconnection alerts, subscription status changes) and those you write to us at info@lkdnautopilot.com | from the Service and from you |
We do not collect special categories of data (Art. 9 GDPR) and we do not ask you to enter them. We ask you not to enter them in the free-text fields.
LinkedIn password. The connection to your account takes place on a sign-in page hosted by the technical provider that manages the connection. Your LinkedIn password, verification codes and security answers are typed on that page and do not pass through our systems, our logs or our error-monitoring tools.
5. Why we process customer data and on which legal basis #
| Purpose | Legal basis |
|---|---|
| Creating and managing your account, performing the Service, sending the alerts and summaries that are part of the Service, providing support | Performance of the contract (Art. 6.1.b GDPR) |
| Using an artificial intelligence model to propose to you draft texts and segments of people to contact, which you edit, approve or reject | Performance of the contract (Art. 6.1.b) |
| Complying with legal obligations (tax, accounting, requests from the authorities) | Legal obligation (Art. 6.1.c) |
| Security of the Service, prevention of abuse and fraud, technical and system logs, defence of a right in court, retention of support requests | Legitimate interest of Migastone (Art. 6.1.f) |
| Respecting the objections of the contacted persons (exclusion list, section 7.5) | Obligation to act on the objection (Art. 21 GDPR) and legitimate interest in not contacting again those who have objected (Art. 6.1.f) |
| Sending you marketing communications about other products | Only with your separate and revocable consent (Art. 6.1.a). Without consent we do not send them. Service emails are not marketing communications |
Providing the purchase and configuration data is necessary to provide the Service. Without them we cannot activate it.
For the purposes based on legitimate interest we have assessed that your interests, rights and freedoms do not override them. You can ask us for information about this assessment by writing to info@lkdnautopilot.com.
Service reserved for professionals. The Service is intended exclusively for professionals and businesses acting in the course of their own business. It is not offered to consumers and consumer protection rules do not apply.
6. Automated decisions #
The Service does not take decisions based solely on automated processing that produce legal effects concerning you or other people, or that similarly significantly affect them (Art. 22 GDPR).
For clarity, this is how the automation works:
- you decide the rules: whom you want to meet (by accepting or rejecting the proposed segments and the searches), the texts, the daily limits, the working days and hours. Then you activate the Service, and you can pause it at any time;
- an artificial intelligence model only proposes drafts and segments. Nothing is used unless you have edited and approved it; every proposal and every choice of yours is recorded;
- once activated, the Service automatically performs the individual visits, connection requests and questions, within the rules you have approved, without asking you to confirm each single action;
- on the basis of the public profile, an artificial intelligence model extracts one single item of data, the sector, to complete the sentence of the invitation note;
- when a person replies, the automation for that person stops for ever: the conversation continues between you and the person, on LinkedIn;
- you can exclude any person manually.
Whoever receives a connection request or a message suffers no legal consequence from this contact and can ignore it, decline it or ask us not to be contacted any more.
7. The people the customers choose to contact (the "contacted persons") #
This section is addressed to those who have been contacted and to the customers who use the Service.
7.1 Roles #
For the data of the contacted persons:
- the data controller is the Customer. It is the Customer that determines the purposes and the essential means of the processing: it chooses whom to contact (by approving segments and searches), decides the texts, the daily limits, the days and the hours, activates the Service and can stop it at any time;
- Migastone International S.r.l. is exclusively the data processor (Art. 28 GDPR): it performs the visits, the connection requests and the questions on the basis of the Customer's documented instructions (the configuration the Customer has approved and the terms of service), with the technical means of the Service. Between Migastone and the Customer there is no joint controllership of the processing of the data of the contacted persons.
The Customer accepts the data processing agreement (appointment as processor) together with the terms of service.
7.2 Which data of the contacted persons we process #
Public professional data from the LinkedIn profile, needed to write a true sentence about the person and to avoid duplicates:
- name, professional headline, company, role, location and country, sector, language;
- a summary of the profile and some activity indicators, to the extent they are needed for the texts;
- the network distance (whether already connected) and the LinkedIn identifier;
- the text of the single message sent (and the invitation note, if any) and the fact that a reply has arrived;
- the event log (visit, invitation, acceptance, message, reply, exclusion), which does not contain the text of the messages.
We do not store the Customer's message inbox, we do not archive conversations and we do not store the full content of the profile beyond 30 days. We do not search for or add email addresses or telephone numbers. We do not sell or share the data of the contacted persons and we do not build lists shared between customers: one customer's contacted persons are never visible to another.
When a person replies, the reply may appear in the alert email we send to the Customer. For this reason the text of the reply is also stored in the archive of alert emails, for the same period as the messages (section 7.4).
LinkedIn, as the platform on which the Customer operates, in turn processes its users' data as an independent controller, according to its own terms and its own privacy notice.
7.3 Why: the Customer's legitimate interest #
The legal basis on which the Customer relies is, as a rule, the legitimate interest in developing business-to-business professional relationships (Art. 6.1.f GDPR): a single, targeted contact, based on public professional data, with one single question and no sequence of follow-ups. It is for the Customer, as controller, to verify that this legal basis is valid in its case, to inform the contacted persons (Art. 14 GDPR) and to respond to their requests. The Customer undertakes to do so in the terms of service. This notice is public and can also be consulted by the contacted persons.
7.4 How long we keep the data of the contacted persons #
| Data | Retention |
|---|---|
| Records of the contacted persons and history of the messages sent and received (including the text of a reply reproduced in the alert emails) | 180 days from the last activity concerning the person |
| Full content of the profile (raw data) | 30 days |
| Event log (without the text of the messages), for the Customer's statistics | up to 24 months |
| Technical events received from the connection provider | 30 days |
| Exclusion list (only LinkedIn identifier, reason and date) | for as long as needed to respect the objection |
At the end of the relationship with the Customer, the data of the contacted persons are returned to the Customer on request and in any case deleted within 90 days (Annex A to the terms of service).
7.5 How to object, request access or erasure #
If you have been contacted and no longer wish to be, you can:
- reply to the message asking not to be contacted any more: the Customer must put you on the exclusion list; or
- write to info@lkdnautopilot.com stating your LinkedIn profile, so as to be put on the exclusion list immediately.
The exclusion list contains only the LinkedIn identifier (or the public address of the profile), the reason and the date. It remains even if your other data are deleted: it serves to avoid contacting you again. The Service checks this list before visiting a profile, not only before sending the invitation, and does not act if it cannot consult it.
For access, rectification, erasure or other rights over the data of the contacted persons, you can contact the Customer who contacted you (the controller) or us. If you write to us, we forward the request to the Customer and, to the extent the Customer's instructions allow, we carry it out. You can also contact the DPO (section 3) and the supervisory authority (section 13).
7.6 The Customer's network #
To propose the segments, the Service reads only once, with the Customer's consent, a limited sample (a few hundred) of the Customer's existing LinkedIn connections and calculates which sectors, seniority levels and regions prevail. Of those people we store only the aggregate counts, never the list. The sample is read only for the time needed for the calculation.
8. To whom we disclose the data #
We do not sell the data. We disclose them only to the parties indicated below, which process the data on our behalf as processors or sub-processors, bound by contract.
| Party | What it does | Where |
|---|---|---|
| Hetzner Online GmbH | hosts the website, the application, the system logs and our mail servers | Germany (EU) |
| Supabase Inc. | database and functions of the Service | data in the EU (Ireland, AWS eu-west-1); functions in European regions. US company: for any access from outside the EU the standard contractual clauses apply |
| Technical provider of the connection to LinkedIn | integration with LinkedIn: connection to the account, reading of profiles, sending of requests and messages | France (EU) |
| Anthropic PBC (Claude) | artificial intelligence model for the drafts, the segments and the extraction of the sector | United States. Transfer under standard contractual clauses and/or the EU-US Data Privacy Framework; by contract the data are not used to train the models |
| Our own mail servers | sending of alerts and storage of the mail received | operated by Migastone on Hetzner infrastructure, Germany (EU) |
We also disclose the data to tax, legal and insurance advisers bound by professional secrecy, to judicial, administrative and supervisory authorities when the law so requires, and, in the event of a transfer of the business or of a branch of the business, to the successor, with prior notice.
9. Transfers of data outside the European Union #
The data of the Service are stored on servers located in the European Union (Ireland and Germany). Migastone is established in the Republic of San Marino, which is not a Member State of the EU: access by staff takes place through encrypted channels, and we have designated a representative in the Union (section 3).
Two providers are US companies:
- Supabase Inc.: the data remain in the EU; for any possible access from outside the EU the standard contractual clauses approved by the European Commission apply (Decision (EU) 2021/914);
- Anthropic PBC: the texts sent to the model are transferred to the United States on the basis of the standard contractual clauses and/or the EU-US Data Privacy Framework, and by contract they are not used to train the models.
We also adopt technical measures such as encryption in transit and at rest. You can request a copy of the safeguards adopted by writing to info@lkdnautopilot.com.
10. How long we keep customer data #
| Data | Retention |
|---|---|
| Account and configuration data | for the duration of the subscription and for 90 days after it ends, then deleted or irreversibly anonymised |
| Link to the LinkedIn account | severed at the end of the subscription and after 30 days of pause of the Service. On resumption we ask you to reconnect the account |
| Event log of the account | up to 24 months, and in any case deleted or anonymised within 90 days from the end of the subscription |
| System, technical and administrative audit logs | 12 months |
| Service and support emails (sent and received, including mail to info@lkdnautopilot.com) | 24 months. The exception is the reply alert emails, which reproduce the text of a contacted person's reply: 180 days (section 7.4) |
| Accounting and invoicing data (handled as part of the purchase) | 10 years from the close of the financial year |
| Proof of acceptances (terms, appointment as processor, consents) | duration of the relationship and 10 years afterwards, to defend a right in court |
| Data relating to disputes | duration of the dispute and 10 years afterwards |
On expiry the data are deleted or irreversibly anonymised.
11. Website, cookies and mail archives #
The public website does not use cookies and does not load third-party resources. The application uses only the browser's local storage for the sign-in session, which is strictly necessary. We do not use analytics, advertising or profiling tools. Details in the Cookie policy.
Emails written to info@lkdnautopilot.com are copied into our mail archive, together with the metadata of the attachments (name, type and size, not the content). They are not visible to other customers.
12. Your rights #
For the data of which Migastone is the controller, you can exercise at any time the rights provided for by Arts. 15 to 22 GDPR and by Law no. 171/2018:
- access to the data and a copy;
- rectification;
- erasure;
- restriction of processing;
- portability of the data provided by you;
- objection to processing based on legitimate interest;
- withdrawal of consent, where the processing is based on consent, without effect on the past;
- not to be subject to decisions based solely on automated processing (section 6).
How to exercise them. Write to info@lkdnautopilot.com, stating the right you wish to exercise. To avoid handing data over to the wrong person, we may ask you to prove your identity. We reply within one month of the request, extendable by two months if the request is complex. You can also contact the DPO or the representative in the EU (section 3). Exercising the rights is free of charge, except for manifestly unfounded or excessive requests.
13. Complaint to the supervisory authority #
Without prejudice to any other remedy, you have the right to lodge a complaint with the supervisory authority.
- Italy: Garante per la protezione dei dati personali (Italian Data Protection Authority), Piazza Venezia 11, 00187 Roma, protocollo@gpdp.it, PEC (certified email) protocollo@pec.gpdp.it, www.garanteprivacy.it
- Republic of San Marino: Garante per la protezione dei dati personali (San Marino Data Protection Authority), Contrada Omerelli 6, 47890 Città di San Marino, info.privacy@pa.sm
- Other EU States: the authority of the country in which you reside or work.
14. How we protect the data #
In plain words:
- all communications are encrypted;
- each customer sees only their own data: access to each row is restricted to its owner and write operations go through controlled functions, not through the browser;
- the LinkedIn password does not pass through our systems (section 4); the providers' keys remain on the server and not in the code that reaches the browser;
- the Service stops by itself at the first sign of a problem on your LinkedIn account and notifies you;
- the administrators' actions are logged, and support access on behalf of a customer is read-only;
- if a security check cannot be reached, the Service sends nothing;
- in the event of a personal data breach we inform the authorities and the persons concerned in the cases and within the time limits provided for by Arts. 33 and 34 GDPR.
15. Changes to this notice #
We may change this notice, for example because of new rules or new features. The version in force is always the one published on the website, with its number and date. If the change is significant, we notify you by email before it comes into force.
16. Contacts #
- Support and privacy: info@lkdnautopilot.com
- DPO: rpd@invictusaziende.it
- Representative in the EU: w.coslop@migastone.com
- Post: Migastone International S.r.l., Via 28 Luglio 212, 47893 Borgo Maggiore, Republic of San Marino
LinkedIn is a third-party trademark. LKDN Autopilot is not affiliated with LinkedIn and is not endorsed by it.