Data, legal and platform risk
| D | Decision and recommendation | Decider; urgency | Safe default in use |
|---|---|---|---|
| D1 Engagement data and LinkedIn terms | Where does engagement data come from, is the route within LinkedIn's terms, and what changes if not? Recommend option B: display-only (visible to the post owner or Page admins, replies from inside Maktura, 48-hour and 24-hour clocks honoured, no export, no CRM push, no other-account tracking, no cross-workspace lists), with option C (engagement off) for anything whose source cannot be documented this week | Karl Foster rules; Dom Watts and Neil Flannery document; Alex decides the product change. Now | GREEN wording only: "See who's engaging with your posts, and reply from one place"; "Know who to talk to first". Warmth never called leads, prospects or candidates in writing; never demoed as a list of named people. Reports, share links, the digest, Slack, campaign export and the audience view are AMBER until D1; the digest heading "New hot leads" is never shown in a demo |
| D27 Legal answers pack | One written pack from Karl, quoted exactly, before the soft launch. Covers: whether Maktura or its AI provider trains on customer data; data location and sub-processors; DPA security wording (schedule a pen test or amend Schedule 2; same for encryption); disclosure that support emails are triaged by AI and read by a person; consent wording for building a prospect's voice from pasted posts; who owns drafts and a voice when someone leaves; TPS and CTPS screening | Karl Foster, Dom Watts for facts. Now | "I'll get you a written answer from our legal team" for all seven. Prospect voices built only live on the call from posts the prospect pastes in, with consent, marked test first. Sellers never send the published legal pack |
| D20 Outreach to about 6,000 companies and bought lists | Option C now (list as research for warm introductions only), option B once Karl rules (researched, trigger-based contact with corporate subscribers only, with a legitimate interests assessment, opt-out and suppression, agency bound by contract). Nothing bought or sent before then | Karl rules; Alex decides; John Cooper holds the agency conversation. Now | RED: no outbound to the list anywhere in the pack |
| D9 AI disclosure and the planned "own fingerprint" | Option B: in-product disclosure plus machine-readable marking if Karl advises. Holly identifies itself as AI; a per-post human decision keeps customers within EU AI Act 50(4). Nothing about a fingerprint is said until it exists and Karl approves the words | Karl advises; Alex decides. Public | Posts drafted by AI and approved by a person; no watermark, fingerprint or disclosure feature promised |
| D23 "Is it built on Claude?" | Option B: answer truthfully when asked, never lead with it. Suggested answer: "Yes, the AI in Maktura runs on Anthropic's Claude. What you're paying for is everything around it: each person's voice, your rules checked before anything posts, the approvals, and Holly doing the work." Data questions go to the D27 answers. A provider change is a disclosure event | Alex, with Dom Watts and Karl Foster. Now | Truthful if asked; never led with |
D1 in brief#
The founders named this the biggest risk in the business on 28 September. A breach could cost API access and restrict customers' accounts and the founder's own. This is research, not legal advice; Karl must read the source pages before anything is relied on. Our reading of LinkedIn's developer terms is that member data must not be used "for advertising, sales, or recruiting use cases (including to identify sales or marketing prospects or prospective talent for hire, for lead creation, to enhance customer data in a CRM or marketing automation platform...)", cannot be exported or combined with other data, may only be displayed to individuals associated with the Page or Profile, and is subject to 48-hour (social activity) and 24-hour (profile) storage limits. The reactions permission is closed to most developers. On a plain reading, the push of engagers to a recruitment CRM, other-account tracking, shared lists, warmth scoring to choose whom to approach, candidate use by recruiters and the overnight history may conflict. The product's own words sit on the RED line: screens and the daily digest say "leads" and "hot leads"; Dom's tagline is "Find the people who respond". The pack lead has not seen the route as it stands. UK law adds a lawful basis, an Article 14 notice and an absolute right to object, and SRA Code 8.9 for law firms.
Actions: Dom and Neil write a one-page data-route note per engagement field; Karl rules in writing (route, what sellers may say, customer terms, the "never scrapes" line); meanwhile switch off or hide other-account tracking, shared lists and CRM push (and warmth too if Karl reads scoring as itself prohibited); relabel every screen and email saying "leads", "hot leads" or "named leads" before soft-launch customers connect, and withdraw "Find the people who respond" from public copy; take "Official platform APIs only. Maktura never scrapes" off the live site now. The approved spoken answer:
Say"Publishing runs through LinkedIn's own connection: we don't ask for your password and we don't hold one. On the engagement side, I'll get you a written answer from our legal team rather than paraphrase it, because your compliance people will want it exactly right."