Privacy Policy

Last updated: September 2026

Policy version: 2026-09-23

1. Who We Are

The data controller for your personal information is NEANDERTECH SERVICOS DE TECNOLOGIA LTDA, located at AV SETE DE SETEMBRO, 2775, REBOUÇAS - 80230-010 - Curitiba, Paraná - Brazil (“we”, “us”, “Link Into The SSI”).

Privacy enquiries: contact@linkintothessi.com.

Data Protection Officer / EU–UK Representative: Henriko Alberton.

2. Data We Collect & Sources

LinkedIn sign-in (OIDC). When you connect your LinkedIn account we receive your LinkedIn member ID, full name, profile picture URL, and email address through LinkedIn’s OpenID Connect flow.

Profile attributes you set. You may voluntarily provide your industry and country in your profile settings.

Posts you submit. We store the posts you submit to the shared feed through the platform.

Engagement activity. When you choose to react to or comment on a post in the feed, we record that engagement (the reaction type, or the comment text you use) to measure your activity and interaction counts. The reaction or comment itself is made by you, directly on LinkedIn. The Service opens the post so you can act; it does not react or comment on LinkedIn on your behalf.

Billing. Subscription payments are processed by Stripe. We store your Stripe customer ID and subscription status; we do not store payment card details. One-off purchases (a featured post) are charged by Stripe the same way and appear on your Stripe receipt; we store the purchase record (session id, amount, date) on the post it featured.

Technical & session data. We collect standard server logs (IP address, browser type, pages visited, timestamps) for security and performance monitoring.

Error reports. When something breaks in the app, Sentry receives an error report with the error message, the page, and your browser and operating system. We strip cookies, request headers, and account details from a report before it is sent. Sentry also records the screen for 10% of app sessions and for every session with an error. These recordings mask all text and block images, so they show the page layout and your clicks, not what you read or type.

Website visit statistics. On our website, DataFast counts visits without cookies. It receives the page you view (without any invite code), the site that sent you, and your browser, device, and country. It tells visitors apart by a code derived from your IP address and browser that changes every day, so it cannot link your visits across days. We also count, on our own servers, how many visitors see our pricing and click our sign-up buttons. To count each visitor once per day, we keep a code derived from your IP address and browser that changes every day and is deleted within two days, after which only the daily totals remain. Cloudflare Web Analytics measures page loads on the website and in the app, without cookies.

App usage analytics (only with your consent). If you turn on analytics in Settings → Privacy & Data, PostHog and DataFast record the pages you visit in the app, and PostHog also records which features you use. Both link this to your internal member ID. We do not send them your name, email, posts, or payment details.

No scraping. We do not scrape LinkedIn or any other third-party website. We receive data from your own use of our platform and from LinkedIn OpenID Connect sign-in, which returns your member ID, name, profile picture, and email. We hold no permission to post, comment, or react on LinkedIn, and we write nothing to your LinkedIn account.

3. Why We Use It & Legal Bases

Contract (Art. 6(1)(b) GDPR). Providing the core service: authenticating you, displaying your feed, letting you submit posts and record your engagement, and managing your subscription.

Legitimate interests (Art. 6(1)(f) GDPR). Optimising feed quality, preventing abuse, ensuring platform security, and maintaining aggregate, non-identifiable analytics about service performance. This covers error monitoring in the app (Sentry) and the cookieless visit statistics on our website (DataFast and Cloudflare Web Analytics). We also rely on legitimate interests to send a 3-day activity digest by email, and you can object at any time from the unsubscribe link in the email or in Settings → Emails. Signed-in members can also see the site-wide ranking of the most active posters and interactors, and you can opt out of appearing in it at any time in Settings → Emails.

Consent (Art. 6(1)(a) GDPR). Marketing communications and optional app analytics (PostHog and DataFast) are processed only with your explicit consent. Both are off by default and can be toggled at any time in Settings → Privacy & Data.

Legal obligation (Art. 6(1)(c) GDPR). Retaining billing records for tax and financial compliance, maintaining consent records, and responding to lawful requests from supervisory or law-enforcement authorities.

4. Who We Share It With

We engage the following sub-processors who may process personal data on our behalf:

LinkedIn — authentication (OpenID Connect sign-in).
Stripe — payment processing and subscription management.
Convex — backend database and serverless functions.
Cloudflare — hosting for the landing site and the application, plus DNS, CDN, DDoS protection, and cookieless visit statistics (Cloudflare Web Analytics).
Resend — transactional email delivery.
OpenRouter (AI inference) — generating reaction suggestions and draft comments from your public post content, including its images. OpenRouter routes only to inference providers with zero data retention (prompts are not stored or used for training).
Sentry — error monitoring for the app, including screen recordings with all text masked.
PostHog — product analytics in the app, only if you turn on analytics. PostHog stores this data in the EU.
DataFast — cookieless visit statistics on our website and, only if you turn on analytics, page views in the app.

Stripe’s own role. Stripe processes payments on our behalf, and Stripe also acts as an independent controller of the payment data it collects from you, which it uses to prevent fraud and to meet its own legal and regulatory duties. Stripe governs that use under Stripe’s privacy policy. Your card number goes to Stripe, and we never see or store it.

We do not sell or share your personal information for cross-context behavioural advertising or any other commercial purpose.

5. International Transfers

Our sub-processors are primarily based in the United States. DataFast is a Singapore company that runs mostly on servers outside the EU, including in the United States. PostHog stores the app analytics data in the EU. Where data is transferred outside the European Economic Area or United Kingdom, we rely on the European Commission’s Standard Contractual Clauses (SCCs) as the transfer mechanism for each processor. A copy of the relevant transfer safeguards is available on request by contacting contact@linkintothessi.com.

6. How Long We Keep It

Account deletion. When you delete your account (or request erasure), your personal data is marked for deletion immediately. A 30-day grace period applies to allow accidental-deletion recovery, after which data is permanently purged.

Dormant accounts. Accounts with no activity for 24 months are automatically treated as deletion requests; we will notify you before purging.

Billing records. Transaction and subscription records are retained within Stripe for as long as required by applicable tax and financial regulations (typically 7 years).

We apply data minimisation: we collect only what is necessary to provide the service and remove data as soon as it is no longer needed for its original purpose.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

Access — obtain a copy of the personal data we hold about you.
Rectification — correct inaccurate or incomplete data.
Erasure — request deletion of your data (“right to be forgotten”).
Restriction — ask us to limit how we process your data.
Objection — object to processing based on legitimate interests.
Portability — receive your data in a structured, machine-readable format.
Withdraw consent — withdraw consent for marketing or analytics at any time without affecting prior processing.
Lodge a complaint — with your local supervisory authority (e.g. your national data-protection authority within the EU/UK, or the relevant state AG in the US).

How to exercise your rights. The quickest way is through Settings → Privacy & Data, where you can export your data, delete your account, and manage consent toggles. You may also contact us at contact@linkintothessi.com. We will respond within 30 days (or the statutory deadline where shorter).

8. California Residents (CCPA / CPRA)

Categories collected. Identifiers (name, email, LinkedIn ID, IP address); professional or employment-related information (headline, industry); Internet or network activity (session logs, error reports, pages viewed on our website, and, if you turn on analytics, how you use the app); commercial information (subscription status via Stripe).

No sale or sharing. We do not sell personal information. We do not share personal information for cross-context behavioural advertising.

Your CCPA/CPRA rights. California residents may exercise the right to know what personal information we collect, have personal information deleted, have inaccurate personal information corrected, and opt out of any future sale or sharing. We will not discriminate against you for exercising these rights.

Authorised agents. You may designate an authorised agent to submit a request on your behalf. We may require verification of your identity and written authorisation for such requests.

To submit a California privacy request, use Settings → Privacy & Data or email contact@linkintothessi.com.

9. Brazilian Users (LGPD)

In accordance with Brazil’s Lei Geral de Proteção de Dados (LGPD), you have the rights set out in Art. 18 of the LGPD, including: confirmation of the existence of processing; access to your data; correction of incomplete or inaccurate data; anonymisation, blocking, or deletion of unnecessary or excessive data; portability; deletion of data processed on the basis of consent; information about public and private entities with which we share data; information about the possibility of refusing consent and the consequences; and revocation of consent.

Complaints may be filed with the Autoridade Nacional de Proteção de Dados (ANPD).

Our encarregado (Data Protection Officer / LGPD representative): Henriko Alberton.

10. Cookies & Storage

We use browser storage to keep you signed in and to remember your choices, such as your language and theme. Our website counts visits with DataFast, which uses browser storage instead of cookies, and the app keeps a short-lived Sentry record in session storage for error monitoring. In the app, DataFast and PostHog set analytics cookies only if you turn on analytics in Settings → Privacy & Data, and we delete them when you turn analytics off or sign out. We do not use advertising or cross-site tracking cookies. For the full list, see our Cookie & Storage Policy.

11. Children & Minimum Age

The service is intended for users 16 years of age and older. We do not knowingly collect personal information from anyone under 16. If you believe a child under 16 has provided us with personal information, please contact us at contact@linkintothessi.com and we will delete it promptly.

12. Changes to This Policy

We may update this policy from time to time. For material changes (new data categories, new purposes, or new sub-processors), we will notify you by email and/or an in-app notice, and we will re-prompt you for acknowledgment before the changes take effect. The policy version date at the top of this page reflects the most recent revision.