Privacy Policy

Effective Date: September 16, 2026 Last Updated: September 16, 2026

This Privacy Policy explains how KeelStack ("we," "us," "KeelStack"), available at keelstack.me, collects, uses, discloses, and protects personal data when you use our Service as a Creator with an account, or as a Sponsor interacting with a magic-link Sponsor Portal.

We act as the data controller for Creator account data and as a data processor (acting on the Creator's instructions) for Sponsor personal data submitted through the Portal, except where we independently determine the purpose of processing (for example, security logging described in Section 4).

1. Information We Collect

1.1 Information You Provide

• Account information: name, email address, password (hashed), company/publication name, billing details (processed by our payment provider, not stored by us in full — see Section 6).
• Sponsor and deal data: sponsor contact details, deal values, contract dates, notes, and other pipeline information you enter.
• Sponsor-submitted content: logos, banners, ad copy, tracking links, and other assets a Sponsor uploads through a Portal link.
• Communications: messages you send to our support or billing addresses.

1.2 Information Collected Automatically

• IP addresses and request metadata: we log IP addresses, request timestamps, user-agent strings, and endpoint access records for every authenticated session and every Portal-link interaction.
• Authentication and security events: login attempts, magic-link issuance and consumption events, token expiry and invalidation events.
• Usage analytics: feature usage events (e.g., pipeline stage changes, Portal link creation, report generation) collected via our analytics provider.
• Error and performance data: crash reports and error logs collected via our error-monitoring provider.

Why we collect this: beyond operating the Service, this data lets us detect fraud and abuse, secure accounts against unauthorized access, and — importantly — establish a factual record in the event of a billing dispute, chargeback, abuse complaint, or a dispute between a Creator and a Sponsor over whether or when an asset was uploaded, a link was issued, or an action occurred. We rely on this data as evidence when such disputes arise. This processing is based on our legitimate interest in operating a secure, accountable service and, where applicable law requires, on your consent or the necessity of processing for contract performance.

1.3 Cookies

We use a minimal set of strictly necessary cookies (session authentication) and, where analytics cookies are used, we will present a consent mechanism to visitors in jurisdictions that require prior consent (e.g., EU/UK ePrivacy rules). We do not use third-party advertising cookies.

2. How We Use Personal Data

3. Who We Share Data With

We do not sell personal data. We share personal data only with service providers who process it on our behalf under contract (data processing agreements where required), or as otherwise described below:

We may also disclose personal data: (a) to comply with a legal obligation, court order, or lawful government request; (b) to enforce our Terms of Service or investigate fraud, security incidents, or abuse; (c) in connection with a merger, acquisition, or sale of business assets, subject to equivalent privacy protections; or (d) with your consent.

4. Data Retention

We retain personal data for as long as your account is active, and for a limited period afterward as follows:

• Account and billing data: retained for the duration of your account plus a period required for tax and accounting law (generally up to 7 years, depending on jurisdiction).
• Security and dispute-evidence logs (IP addresses, timestamps, authentication events, Portal-link records): retained for up to 12 months from the date of the event, or longer if needed to resolve an active dispute, chargeback, or legal claim, after which they are deleted or anonymized.
• Sponsor Portal content: retained per your account's storage settings and deleted upon account deletion, subject to the grace period below.
• Post-termination grace period: upon cancellation or termination, we retain Customer Data in a read-only or inaccessible state for a limited grace period to allow export or reactivation, after which it is deleted or anonymized, except where retention is legally required.

5. Your Rights

Depending on your location, you may have rights to access, correct, delete, restrict, or port your personal data, and to object to certain processing. Specifically:

• EU/EEA/UK residents (GDPR/UK GDPR): rights of access, rectification, erasure, restriction, portability, objection, and the right to lodge a complaint with your local supervisory authority.
• California residents (CCPA/CPRA): rights to know, delete, correct, and opt out of the sale or sharing of personal information (we do not sell or share personal information for cross-context behavioral advertising).
• Indian residents (Digital Personal Data Protection Act, 2023): rights to access, correction, erasure, and grievance redressal.

To exercise any of these rights, email privacy@keelstack.me with your account email and the right you wish to exercise. We will verify your identity before processing the request and respond within the timeframe required by applicable law (generally 30–45 days).

6. Payment Data

We do not store full payment card numbers. Payment processing, cardholder data handling, and PCI-DSS compliance are handled entirely by Dodo Payments as our Merchant of Record. Review Dodo Payments' own privacy policy for details of how it processes your payment data.

7. International Data Transfers

Our infrastructure providers operate global networks (e.g., Cloudflare). Where personal data is transferred outside your country of residence — including from the EU/EEA/UK to other countries — we rely on appropriate safeguards such as Standard Contractual Clauses, the UK International Data Transfer Addendum, or equivalent mechanisms required under applicable law.

8. Data Security

We apply industry-standard safeguards, including encryption in transit, hashed storage of authentication tokens (magic links are never stored in plaintext), single-use and time-limited Portal tokens (maximum 24-hour expiry), rate limiting, and access controls restricting who can view Customer Data. No system is completely secure; we cannot guarantee absolute security of data transmitted to or stored on the Service.

9. Children's Data

The Service is not directed to individuals under 18. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact privacy@keelstack.me and we will delete it.

10. Sponsor Data Submitted Through the Portal

If you are a Sponsor invited via a magic-link Portal, the Creator who invited you is the controller of your personal data for purposes of that relationship, and KeelStack processes it on the Creator's instructions as a processor. Sponsors with questions about how their data is used should contact the inviting Creator directly; general questions about our handling of Portal data can be sent to privacy@keelstack.me.

11. Our Address

We do not publish a physical or home address on this page. If you need our postal or registered address for a legitimate purpose — such as filing a formal data-subject request, regulatory correspondence, or legal notice that requires a mailing address — email privacy@keelstack.me stating your reason, and we will provide the appropriate address.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email or an in-app notice at least 14 days before taking effect. The "Last Updated" date at the top of this page reflects the most recent revision.

Contact

Privacy questions and data rights requests: privacy@keelstack.me General support: support@keelstack.me