Adapted from the LexAlert legal terms approved October 11, 2026; entity name and Chimeloom-specific changes pending counsel confirmation.
Privacy Policy
Last updated: November 4, 2026
1. Who we are
LineyGroup LLC, doing business as Chimeloom ("Chimeloom", "we", "us" or "our") operates the Chimeloom platform, a software-as-a-service that monitors public social media platforms (Reddit and Quora) for buying intent signals and assists businesses and agencies in drafting outreach responses. This Privacy Policy explains how we collect, use, and protect information in connection with our services.
For questions, contact us at support@chimeloom.com.
2. Information we collect
From customers:
- Name, email address, and phone number of customer contacts
- Business name, size, and industry
- Billing information (processed by our payment processor — not stored by Chimeloom)
- Platform connection metadata — which accounts you have linked through the Chimeloom browser extension and per-device session tokens. We do not collect or store your platform passwords; you authenticate in your own browser
- Configured keywords, source targets, and system prompts
From platform operations:
- Public posts identified as matching your business's criteria across every active source (publicly available content)
- AI-generated draft responses and your edits / approvals / rejections
- Audit logs: timestamps, action types, post identifiers
- Usage data: API calls, pipeline stage throughput, error rates
3. How we use your information
- To operate and maintain the Chimeloom pipeline for your business
- To deliver lead notifications to your dashboard and by email
- To generate AI-drafted responses using your business's configured prompts
- To require customer review and approval of every reply before it is posted
- To maintain immutable audit logs for customer accountability
- To diagnose and fix technical issues
- To communicate with you about your account and service updates
We do not sell your information to third parties. We do not use your client data to train AI models without explicit opt-in consent.
4. Data retention
Post data and draft responses are retained for 90 days after the pipeline processes them, then permanently deleted. Audit logs are retained for 24 months. Account data is retained until account termination plus 30 days.
5. Third-party services
We use the following third-party services to operate Chimeloom:
- Anthropic API — AI classification and response drafting (Claude Haiku, Claude Sonnet)
- Reddit, Quora — Source monitoring via official APIs and the Chimeloom browser extension operating within your own signed-in browser session
- Resend — Transactional email delivery (lead notifications and account email)
- Stripe — Payment processing (billing details are handled by Stripe and not stored by Chimeloom)
- Supabase / PostgreSQL — Database and authentication (production)
Each service has its own privacy policy. We choose providers that meet appropriate security standards for B2B SaaS.
6. Security
You connect your platform accounts through the Chimeloom browser extension in your own browser, so your platform passwords never reach our servers. Session tokens and any service secrets we do hold never appear in logs, error messages, or API responses. We use HTTPS for all data in transit, and data in our managed database is encrypted at rest. Access to production systems is restricted to authorized personnel only. See the Security section below for details.
7. Your rights
You have the right to access, correct, or delete your personal information held by Chimeloom. To exercise these rights, contact support@chimeloom.com. We will respond within 30 days.
8. Changes to this policy
We will notify clients of material changes to this Privacy Policy by email at least 30 days before the change takes effect.
Security
1. Platform access & session security
Chimeloom posts to the platforms you monitor (Reddit, Quora) through the Chimeloom browser extension running in your own browser, where you are already signed in. Your platform passwords are never transmitted to or stored on Chimeloom's servers — they never leave your browser.
Each extension is paired to your business with a per-device session token. That token is scoped to your business, is never shared across businesses, never appears in URLs or access logs, and can be revoked at any time — revoking a session immediately stops any further action from that device. Any secrets Chimeloom does hold (for example, internal service API keys) are kept in restricted environment configuration, are never returned in API responses, and are never written to logs. Data stored in our managed Postgres database is encrypted at rest by the database provider.
2. Audit log immutability
Every approval, edit, rejection, post, and customer-approval decision is appended to an immutable audit log with the customer's identity, a timestamp, the platform, the post identifier, and (for edits) the diff. The log is append-only — no row is ever updated or deleted. CSV export is available on request.
3. Customer approval
The customer reviews and approves every reply before it is posted, and the customer is responsible for posted content and for compliance with the rules of Reddit, Quora and any applicable laws.
4. Access control
Production database access is restricted to a small set of authorized engineers via Railway and Supabase IAM. Supabase Row-Level Security (RLS) enforces tenant isolation at the DB layer in addition to application-layer query scoping.
5. Compliance posture
SOC 2 Type II is in progress. We will publish our completion status on this page when available. In the interim, we contractually agree to applicable security controls in customer DPAs.
6. Reporting issues
Suspect a security issue? Email support@chimeloom.com. We respond to all reports within one business day.