Privacy Policy

Last updated: October 28, 2026

1. Who is responsible

Tenkai is operated by Romain Lanz, sole proprietorship, Entreprise individuelle, Switzerland, IDE CHE-375.491.965. References to "Tenkai", "we", "us" and "our" mean Romain Lanz.

We are the controller of personal data used to manage accounts, billing, security and our relationship with you. When we process personal data in your applications, databases, deployment logs or backups on your team's instructions, we act as a processor. Your team remains responsible for its own purposes, notices and lawful instructions. If your team is itself a processor, Tenkai may be its subprocessor.

This policy explains our practices. It is not a data processing agreement. A separate agreement is needed where applicable law requires one.

2. What we process

We receive data from you, your team members, connected providers and the servers you authorise us to manage.

• Account and authentication data: name, email address, password hash, sessions and linked sign-in identities. For each sign-in, we record the IP address and the user agent of the browser, how you signed in, when, the last activity of the session and how it ended, so that you can see and close your sessions.
• Waitlist and invitation data: email address, answers about your software stack and hosting, request and confirmation times, and invitation sender and date. These records support access to the private beta, not an automatic subscription to advertising.
• Team data: team names, membership, roles and permissions, and identifiers linking actions to members or authorised agent tokens.
• Billing data: the email used to create the team's billing customer, customer and subscription identifiers, plan, billing interval, subscription status, payment events and invoice information. Our payment provider handles payment details through its own checkout. Tenkai does not collect full card numbers or card security codes in its own forms.
• Infrastructure and connection data: server addresses, provider resource identifiers, regions, machine details, SSH host fingerprints, per-server automation keys, server administration passwords, your uploaded SSH public keys and their labels, provider API credentials, and storage bucket endpoints, names, regions, prefixes and access credentials. Your personal SSH private keys are not uploaded to Tenkai.
• Deployment data: project and resource configuration, repository or image references, the code hosting accounts and organizations you connect, registry credentials, uploaded deployment files, environment variables and sensitive values, deployment status and logs.
• Backup data: encrypted backup objects in your team's bucket, backup status and object references, and current and previous private backup keys held encrypted by Tenkai. Key exports are recorded without recording the exported key contents in the export audit.
• Operational data: host operating system and hardware facts, CPU, memory, disk and network metrics, per-application counts of web requests by status class with their sizes and response times (without visitor IP addresses, URLs or other request details), package-upkeep reports, Docker availability, operation timestamps, errors and audit records. MCP audit records identify the tool, team, member, agent token and outcome. Live server and container terminals transmit commands and output through Tenkai; container-log viewing transmits application logs. Requests and diagnostics can also contain technical metadata such as IP addresses and request identifiers.
• Hako data: the questions your team members ask Hako, Tenkai's assistant, with the page they asked from, Hako's answers, and what the tools it calls return, such as project, resource, server and deployment details, health metrics, and deployment, application and container logs. When a deployment fails, Hako diagnoses it from the last lines of its logs. Hako never receives the values of your variables, but logs and other tool results can contain personal data or secrets.
• Usage data: the pages of Tenkai you open, with their path but without query strings, the referring page and the time, the campaign parameters (utm_source, utm_medium, utm_campaign, utm_term and utm_content) of the address you arrived from, and some of the actions you take, such as starting a checkout or opening the dialog that creates a server. A help search that finds no guide sends its text. These records carry no account or team identifier.
• Browser error data: when the Tenkai page fails in your browser, the error message, its stack trace and the address of the page without its query string.
• Support data: information you provide when asking for help. Logs, files and database content can contain personal data or secrets, even when you did not intend to include them.

3. Why we use it

We use these data to manage beta access, authenticate users, enforce team permissions, provision and configure servers, deploy and manage resources, perform configured backups and restores, verify provider connections, manage subscriptions, diagnose failures, answer questions asked to Hako, answer support requests, learn which pages are used to improve the service and protect the service. We also use necessary records to meet legal obligations and handle disputes.

Swiss data protection law requires lawful, proportionate and transparent processing. Where GDPR applies, we rely on contract performance for account and service administration when the individual is a party to the contract, legitimate interests for security, diagnostics, page usage measurement and business contact administration, and legal obligations for required records. We rely on consent where a feature or optional processing requires it, and you can withdraw that consent for future processing.

For application data processed on your team's behalf, we follow your team's lawful instructions and the applicable processing agreement. Your team determines its own legal basis for that data.

4. Access to your infrastructure and data

Tenkai needs privileged access to carry out authorised operations. It connects over SSH as the tenkai user using a separate automation key for each server, and can execute administration commands as root. Authorised team members can open root terminals and authorise selected personal SSH public keys on servers. Provider credentials allow operations within the permissions you grant, which can be broader than the operations exposed by Tenkai. Repository and registry credentials enable the access you configure for deployments. A credential for your code host's container registry belongs to the user who adds it; when linked to a resource, it supports deployments by team members permitted to deploy that resource.

This access can expose source code, application data, databases, files, logs and secrets. Customer-owned servers do not mean that Tenkai is technically unable to access their data. Encryption of stored credentials does not prevent Tenkai from decrypting them to perform operations. Authorised team members can also reveal sensitive variable values through permission-controlled features.

We limit access and use to operating the service, authorised support, security and legal requirements. We do not use your private code or application data for advertising or sell it to others.

The backup feature uses an S3-compatible bucket supplied by your team. It encrypts backups on the node before sending them to that bucket. Tenkai holds the team's current and previous private backup keys in encrypted form and supplies the required key to a restore operation. This is not encryption that only the customer can decrypt. Owners and administrators can download the keys to recover encrypted backups independently. Rotation changes the key for future backups; it does not re-encrypt old backups or remove the old keys from Tenkai.

5. Who receives data

We do not sell, rent or lease personal data. We share only what is needed for the purpose concerned.

• Our payment provider receives billing information to handle subscriptions and payments. It sells the subscription to you; its checkout names the seller and the terms of the purchase.
• Our monitoring and analytics provider receives the diagnostic data sent by our monitoring integration and the usage data and errors sent by your browser. This is separate from the server telemetry that Tenkai stores to show your team's infrastructure status. For Hako, it receives the model used, the token counts and a conversation identifier, but not the questions or the answers.
• Our AI model provider provides the language model behind Hako. Each time Hako answers, Tenkai sends it the Hako data described in section 2: the conversation so far, the tool results and Tenkai's instructions to the model. Hako answers when a team member asks it a question or acts on a diagnosis, and diagnoses a failed deployment when a team member allowed to read its logs opens the page of its resource. The provider does not use this data to train its models, and deletes it within 30 days unless it is flagged under its usage policies.
• Our DNS provider receives default-route hostnames and server IP addresses for DNS publication. These records are configured as DNS-only, not as a traffic proxy. Certificate issuance uses a public certificate authority through the server's router; hostnames in public certificates are publicly discoverable.
• Our email delivery provider receives recipient addresses, message content and confirmation or invitation links to deliver service emails.
• Your chosen infrastructure and storage providers receive instructions and relevant configuration. Your bucket provider holds the objects you place there.
• Our application hosting provider hosts Tenkai's application and its uploaded files.
• Our database hosting provider hosts Tenkai's database, which holds the account, team, waitlist and configuration data described in section 2.

Other authorised team members can access team data according to their roles. We may disclose necessary information to professional advisers or authorities to comply with law or establish, exercise or defend legal claims, subject to applicable safeguards. Customer-selected providers also have their own terms and privacy notices.

6. Locations and international transfers

Your team's servers and buckets are located where you and your providers arrange them. The region you choose for a server does not change where Tenkai's own data is processed.

We know where these data are stored:

• Switzerland: Tenkai's application and its uploaded files, at our application hosting provider.
• Germany: Tenkai's database, in a Frankfurt region of our database hosting provider, and the data our monitoring and analytics provider keeps.
• France, Germany and Belgium: the databases of our email delivery provider.

Storage is not the only processing. The providers described in section 5 can also process or access the data they receive from other countries:

• Our database hosting provider operates the database from the United States.
• Our AI model provider processes Hako data in the United States.
• Our payment provider processes billing data in Ireland, the United States and the other countries where it operates.
• Our DNS provider, which only publishes our DNS records, keeps its data mainly in the United States and the European Economic Area, and can access it from other countries.
• Our email delivery provider and our monitoring and analytics provider can use providers of their own outside the European Union.

So this is not a complete list of the countries your data can reach. Switzerland recognises the member states of the European Union as providing adequate data protection. For the United States, our payment, DNS and database hosting providers state that they are certified under the Swiss-U.S. Data Privacy Framework, which Switzerland recognises for certified companies. Our AI model provider relies on the standard contractual clauses of its data processing addendum. For other countries, the providers rely on safeguards such as standard contractual clauses.

Before transferring personal data to another country, we assess the applicable requirements under Swiss law and, where relevant, GDPR. Transfers must use an applicable adequacy decision, appropriate contractual safeguards such as standard contractual clauses with necessary Swiss adaptations, or another lawful transfer mechanism. You can request information about applicable safeguards at [email protected].

7. Security and browser storage

The application hashes passwords, encrypts stored sensitive variables and connection secrets, checks team permissions and pins SSH host fingerprints. It configures secure session cookies in production and CSRF protection for browser mutations. These measures reduce risk but cannot guarantee that data will never be lost, disclosed or misused.

We use browser cookies for sessions and request security, including __Host-tenkai-session and XSRF-TOKEN. The configured session inactivity lifetime is three days. Browser local storage remembers your display theme. Blocking these features can affect sign-in or preferences. Pageview measurement uses neither cookies nor browser storage. We do not use these features for advertising.

8. Retention and deletion

We retain account and team data while needed to provide the service. We retain billing records, security records and dispute-related information only for the applicable legal requirement or necessary purpose. We delete or anonymise personal data when it is no longer needed, subject to those requirements.

We keep the record of a sign-in, with its IP address and user agent, for 90 days after its session ends; a daily cleanup job then deletes it. Hako conversations stay in Tenkai's database with your team's other data, so that your team members can read them again. Target telemetry has a configured 30-day retention window, with an hourly cleanup job. This is not a 30-day deletion promise for accounts, logs, invoices or copies held in system backups. Cancellation stops subscription renewal; it does not delete the account, team data or provider resources.

Backup retention depends on the kind of backup. Database backups keep the seven latest successful backups per resource. Web application backups keep the seven latest successful sets taken under a stop and, separately, the seven latest live sets. Continuous database backups keep the two latest scheduled full backups and the history that depends on them. Bucket copies in snapshot mode keep 24 hourly, 7 daily, 4 weekly and 12 monthly snapshots; in mirror mode with trash, replaced or deleted files stay in the trash for 30 days. Running backups, relevant recent failures and backups needed by a running restore also stay. Object deletion depends on access to your bucket and can require a later retry. Removing a bucket connection does not delete its objects. Live terminal and container-log streams are not saved as transcripts by those features; commands, output or diagnostics may still be retained by the server or other logging systems.

You can request deletion at [email protected]. We explain any information we must retain and why. Erasing control-plane records does not erase application data or backup objects in your own infrastructure. Unless you choose to delete the provider machine, removing a server from Tenkai leaves that machine, installed automation access and agent in place. Your team must remove or revoke that access and manage provider data separately.

9. Your rights and contact

Under Swiss law, you can request information about your personal data and seek correction, deletion or restriction where the legal conditions are met. Portability rights also apply in qualifying cases. Where GDPR applies, you may have rights of access, correction, erasure, restriction, portability, objection and withdrawal of consent, subject to legal conditions.

Address privacy questions and requests to [email protected]. We may need proportionate identity verification before disclosing or changing data. We respond within the applicable legal deadlines and explain any lawful restriction. For data controlled by your team, contact that team first; we assist it with requests as required by our processing obligations.

You can report concerns to the Swiss Federal Data Protection and Information Commissioner. Where GDPR applies, you can also complain to the competent supervisory authority and use the remedies available under that law. Tenkai is not intended for children.

10. Changes

We will date revised versions of this policy and notify users of material changes through an appropriate service notice or direct communication.