Privacy Policy

1. Who We Are

SAPvocate is an independent LinkedIn advocacy tool developed and operated by NovaBranch Pte. Ltd. ("NovaBranch", "we", "us", or "our"), a software company incorporated in Singapore.

SAPvocate is not affiliated with, authorised, maintained, or endorsed by SAP SE.

For privacy enquiries: hello@novabranch.co

2. Information We Collect

LinkedIn Account Data

When you sign in with LinkedIn, we receive via the LinkedIn API:

• Your LinkedIn member ID (a unique identifier)
• Your display name and profile picture URL
• An OAuth access token to post on your behalf

We do not receive your LinkedIn password, email address, connections list, or private messages.

Activity Data

• Posts you queue for sharing and their scheduled times
• Posts you have shared via SAPvocate, including LinkedIn engagement statistics (likes, comments, reposts) fetched after posting
• Your advocacy points total and leaderboard ranking

Technical Data

• A session state token stored in sessionStorage during the OAuth login flow (cleared after login completes)
• Firebase Authentication session credentials (managed by Google Firebase)

3. How We Use Your Information

• To authenticate you via LinkedIn OAuth and maintain your session
• To display curated SAP news posts available for sharing
• To schedule and publish posts to LinkedIn on your behalf at the times you specify
• To track your sharing activity and calculate your advocacy points for the leaderboard
• To fetch post engagement statistics from LinkedIn after sharing

We do not use your data for advertising, profiling, or any purpose unrelated to operating SAPvocate.

4. LinkedIn OAuth and Posting

SAPvocate posts to LinkedIn strictly on your behalf and only for posts you explicitly queue. We request the minimum LinkedIn API scopes required to post on your behalf. Your OAuth access token is stored securely on our backend and used only to execute scheduled posts.

You can revoke SAPvocate's access to your LinkedIn account at any time via LinkedIn Settings > Data Privacy > Permitted Services. Revoking access will prevent any pending scheduled posts from being published.

5. Information Shared With Third Parties

We do not sell your personal data. We share data only with the following service providers:

• Google Firebase: Authentication, Firestore database, and Cloud Run hosting (Google LLC, USA)
• LinkedIn: Post content and scheduling via the LinkedIn API (LinkedIn Corporation, USA). Data shared is limited to the text and link of each post you approve for sharing.

6. Data Retention

• Your Firebase Auth session is maintained until you sign out or revoke LinkedIn access
• Your queued and shared post records are retained in Firestore to maintain your points history and leaderboard position
• If you wish to have your data deleted, email hello@novabranch.co and we will remove your profile and post history within 30 days

7. Data Security

SAPvocate enforces a strict Content Security Policy (CSP) on all pages. Data in transit is encrypted via TLS. Firestore access is restricted by security rules that prevent users from reading or modifying other users' data. OAuth state tokens are stored only in sessionStorage and are never persisted beyond the login flow.

8. Your Rights (PDPA)

Under Singapore's Personal Data Protection Act (PDPA), you have the right to:

• Access the personal data we hold about you
• Correct inaccurate personal data
• Withdraw consent and request deletion of your data

To exercise these rights, email hello@novabranch.co. We will respond within 30 days.

9. Changes to This Policy

We may update this policy from time to time. The "last updated" date at the top of this page will always reflect the most recent version. Continued use of SAPvocate after an update constitutes acceptance of the revised policy.

10. Contact

NovaBranch Pte. Ltd.
Singapore
hello@novabranch.co