Privacy policy

How Tanei collects, uses, stores, and shares data — including data accessed via LinkedIn — when you use the Tanei Partnerships Content Engine.

Last updated: 30 May 2026 · Controller: Tanei (Netherlands) · Contact: guisthinio@tanei.nl

1. Who we are

Tanei is a payments infrastructure company based in the Netherlands. The Tanei Partnerships Content Engine ("the engine") is an internal tool we use to draft, approve, schedule, and publish LinkedIn posts on behalf of our founder, and to surface replies as qualified leads. It is an invitation-only product; no public sign-up exists.

2. Data we collect from you

If you have access to the engine as an approved user, we store:

Email address — used as your account identifier and for password reset.
A hashed password — handled by Google Firebase Authentication; we never see or store the plaintext.
Account status — pending / approved / admin, plus timestamps of creation and approval.

3. Data we access via LinkedIn

When the engine is connected to your LinkedIn account via OAuth, with the scopes openid, profile, email, w_member_social, and (when granted by LinkedIn) r_organization_social, w_organization_social, and r_ads_reporting, we may access:

Your basic LinkedIn profile (name, profile photo, headline) — used in the dashboard's post preview.
Your email address as registered with LinkedIn — used to identify you across LinkedIn-connected services.
Posts you author through the engine — written to LinkedIn at scheduled times, with your explicit per-post approval.
Engagement on those posts (reads, reactions, comments, DMs) — used to populate the dashboard's analytics, score audience timing, and surface replies as leads.
Public LinkedIn profile data of people who engage with your posts — used to enrich leads (title, company, headcount, region) and only when LinkedIn permits.

We do not scrape data outside LinkedIn's official APIs, automate likes/comments/follows, send bulk DMs without consent, or use any data accessed via LinkedIn for advertising, training models we do not control, or sharing with unrelated third parties.

4. How we use the data

To draft posts via Vertex AI Gemini and present them for your approval before any LinkedIn API call.
To publish approved posts at the scheduled CET times via the LinkedIn Posts API.
To detect replies that match a configured reply-trigger and queue a one-click (human-editable) auto-DM opener.
To score lead fit (ICP + intent + engagement) and present a pipeline view in the dashboard.
To learn which day, time, hook formula, and partner model drive the best reach + leads, and feed that back into next week's draft.

5. Sub-processors we share data with

The engine runs on:

Google Cloud Platform (Firebase Authentication, Firestore, Cloud Functions, Cloud Storage, Cloud Scheduler, Cloud Tasks, Vertex AI Gemini) — EU region (europe-west1 / eur3). DPA.
Cloudflare — DNS for tanei.nl. No traffic is proxied through Cloudflare for the engine subdomain. Privacy.
LinkedIn / Microsoft — when the engine reads or writes data on your behalf via the LinkedIn APIs. LinkedIn Privacy Policy.
GitHub — source control only; no end-user data flows here.

We do not sell data to any third party.

6. Retention

Account data: kept for the lifetime of the account; deleted within 30 days of an account being revoked.
Posts, drafts, and engagement: kept indefinitely while you use the engine; you can request deletion at any time.
Backups: nightly Firestore exports retained for 30 days.
LinkedIn-derived data: deleted within 30 days if you disconnect the LinkedIn OAuth grant, except where LinkedIn requires immediate deletion.

7. Your rights under GDPR

You can ask us to:

Access the personal data we hold about you.
Correct or update inaccurate data.
Delete your account and all associated data ("right to be forgotten").
Export your data in a portable format.
Restrict or object to specific processing.
Withdraw consent for LinkedIn OAuth at any time — disconnecting in LinkedIn's settings revokes our token immediately.

Email guisthinio@tanei.nl with the request. We respond within 30 days.

8. Security

HTTPS-only via Google-managed Let's Encrypt certificates; HSTS enabled.
Firestore Security Rules deny-by-default; only admins can read or write engine data.
LinkedIn client secret and similar credentials are stored in Google Secret Manager, never in code or in this browser.
Cloud Functions run as a project-scoped service account with minimum-needed roles.
Pre-deploy code review by the engineering lead; every infra change is logged in Cloud Audit Logs.

9. Cookies

The engine sets a Firebase Authentication session cookie when you sign in (stored in localStorage / indexedDB, not a third-party cookie). It does not use analytics or advertising cookies. The public marketing page sets no cookies at all.

10. Children

The engine is a business tool; we do not knowingly collect data from anyone under 16.

11. Changes to this policy

We may update this policy. The "last updated" date at the top reflects the most recent change. Material changes are emailed to all approved users.

12. Contact

For any privacy question: guisthinio@tanei.nl.

You also have the right to lodge a complaint with the Dutch data protection authority (Autoriteit Persoonsgegevens) if you believe we have not handled your data lawfully.