Privacy notice

1. Two roles: controller and processor

For your own account (your name, email address and sign-in data) we are the controller.

For the data you and your team put into your workspace — contacts, companies, deals, emails, form submissions and similar records — your company is the controller and we act as its processor: we process that data only to provide Keel and only on your company’s instructions, as set out in the data processing terms in our Terms of use. Questions about that data should go to the company whose workspace holds it.

2. What we collect

• Account data: name, email address, job title, and sign-in data handled by our authentication provider (passwords are stored as hashes, never in plain text).
• Workspace content: the records your company stores in Keel, including email you send and receive through Keel.
• Connected accounts: when someone connects Gmail, Outlook or another app, the access tokens it issues, stored encrypted (AES-256-GCM).
• Email engagement: when tracking is switched on for an email, opens and clicks of that email.
• Technical data: IP address, browser, device and timestamps in server logs, used for security and troubleshooting.

3. Why we use it and on what basis

• To provide and support Keel under our agreement with you or your company (performance of a contract).
• To keep Keel secure, prevent abuse and protect email deliverability for everyone on the platform (legitimate interests).
• To meet legal obligations, such as tax records or lawful requests from authorities.
• To send occasional product updates — only if you ticked the box when you signed up (consent, which you can withdraw at any time).

4. Who we share it with

We use service providers (sub-processors) to run Keel: Supabase (database and authentication), Vercel (hosting) and Resend (email delivery and reply capture). When a workspace connects them, data also flows to Google (Gmail), Microsoft (Outlook), Twilio (text messages) and the social or advertising platforms it connects. We do not sell personal data.

Some providers process data outside your country, including in the European Union and the United States. Where that happens we rely on appropriate safeguards such as the EU Standard Contractual Clauses or, for Turkey, standard contracts under Article 9 of Law No. 6698 (KVKK).

5. How long we keep it

Account data: while your account exists, then for up to [retention period] for legal and security reasons. Workspace content: until your company deletes it or closes its workspace; deleted data leaves our backups within [backup period]. Server logs: [log retention period].

6. Your rights

Depending on where you live, you can ask for access to your data, correction, deletion, restriction, portability, and object to processing based on legitimate interests. You can withdraw consent at any time. Write to [contact email]; for data in a company’s workspace we pass your request to that company. You can also complain to your data protection authority (in Turkey, the Personal Data Protection Authority).

7. Cookies

Keel uses only cookies it needs to work: your sign-in session, the workspace you have open and your language. We do not use advertising or analytics cookies.

8. Security

Data is encrypted in transit (TLS). Each workspace’s records are separated by row-level security in the database, people get access through roles, and connected-account tokens are encrypted at rest. No system is perfectly secure; if a breach affects your data we will tell you as the law requires.

9. Changes and contact

We will post changes on this page and, for significant changes, tell account owners by email. Questions: [contact email], [Company legal name], [Registered address].