Privacy Policy

Tideline is operated by Quant Technologies Ltd. For the personal data of people who use Tideline, and for content we collect through platform APIs to provide the Service, we act together with the organisation that uses Tideline (“customer organisation”), which decides what is monitored and why. Contact: info@quanttechnologiesltd.cloud.

This policy is written to meet the Nigeria Data Protection Act 2023 (NDPA) and the developer terms of the platforms we connect to.

About people who use Tideline:

• account details set up by an administrator: name, email address, role, unit and clearance level;
• sign-in data: password hash (never the password itself), one-time email sign-in codes (stored only as a keyed hash), last sign-in time, failed sign-in counts;
• what you create: watchlists, cases, notes, alerts and configuration changes, with your name attached where relevant;
• technical logs needed to run and secure the Service, such as request times and errors.

Publicly available content from connected platforms, as configured by the customer organisation:

• X: public posts matching configured keywords, hashtags or accounts, with the author’s public username and display name, public engagement counts, attached media and, where the author chose to share it, place information;
• YouTube: public video titles, descriptions, channel names and public statistics;
• News services (GNews, World News API): published articles’ titles, summaries, sources and links.

If you connect an X account through “Sign in with X” or a similar authorisation, we receive the access tokens and the X user ID for the permissions you approve, and use them only to perform the actions you authorised. You can revoke this at any time in your X settings or by asking us.

We do not collect content that is not public, and we do not attempt to bypass any platform’s privacy settings.

• to provide the Service: authenticate users, run the searches the customer organisation configured, score content against its threat rules, detect events, and send the emails it set up;
• to keep the Service secure, prevent misuse, and investigate problems;
• to meet legal obligations and the requirements of the platforms we connect to.

We do not sell personal data, use it for advertising, or use content obtained from X or other platforms to train or fine-tune AI models. Automated scores are indicators for human reviewers; no decision with legal or similar effect about a person is made solely by the Service.

We process personal data where it is necessary for the performance of our agreement with the customer organisation and its users, for compliance with legal obligations, and for legitimate interests or public-interest tasks pursued by the customer organisation within the law — balanced against the rights of the people concerned. Where we rely on consent (for example, connecting your X account), you can withdraw it at any time.

We share data only with service providers needed to run Tideline, under their terms:

• X Corp. — the X API (search queries we send; post IDs for X’s compliance checks);
• Google — the YouTube Data API, and Google Gemini when AI-assisted analysis is switched on (the text of a post or article, and an image only when an analyst requests image analysis);
• GNews and World News API — the search terms we send;
• Hostinger — delivery of sign-in codes and notification emails;
• our hosting and infrastructure providers.

Within the customer organisation, data is visible to its authorised users according to their roles. We disclose data to authorities only when required by law.

Some providers above process data outside Nigeria. Where they do, we rely on the safeguards the NDPA allows, such as the provider’s contractual commitments, and limit what is sent to what is needed.

• User accounts are kept while the account is active and removed or deactivated by administrators when access ends.
• Content from X is checked against X every day; posts that were deleted, made private or suspended, or whose author’s account was suspended, are removed within 24 hours, and location data is removed when the author removes it.
• Other collected content and case material is kept for as long as the customer organisation needs it for its purposes, and is deleted at its request or when its use of Tideline ends.
• One-time sign-in codes expire after a few minutes and cannot be reused.

• access only through accounts issued by administrators, with role-based permissions and optional email sign-in codes;
• passwords stored with Argon2 hashing; sessions in secure, HttpOnly cookies that can be revoked;
• encryption in transit (HTTPS) and API keys kept on the server, never in the browser;
• an audit trail of compliance removals that stores no removed content.

No system is perfectly secure; we will notify affected customer organisations and the regulator of a personal-data breach as the NDPA requires.

Under the NDPA you can ask to:

• access the personal data we hold about you, and receive a copy;
• correct inaccurate data;
• have data deleted, or its processing restricted;
• object to processing based on legitimate or public interests;
• withdraw consent where processing relies on it.

This includes people whose public posts were collected. Write to info@quanttechnologiesltd.cloud; we will respond within the time the law requires, working with the customer organisation where it decides the processing. You can also complain to the Nigeria Data Protection Commission (NDPC). Deleting a post on X also removes it from Tideline within 24 hours.

Tideline uses one essential cookie to keep you signed in. There are no advertising, analytics or tracking cookies. The public pages (home, Terms, Privacy) set no cookies.

Tideline is intended for professional use by adults and is not directed at children.

We will update this policy when our practices change and show the new effective date at the top. Material changes will be notified to administrators.

Quant Technologies Ltd — info@quanttechnologiesltd.cloud