Privacy Policy

Last updated: July 14, 2026

This Privacy Policy explains how Keptova (“we,” “us”) collects, uses, and shares information when you use the Keptova website and service (the “Service”). By using the Service you agree to this Policy and to the Terms of Service.

1. Information we collect

• Account information — your name, email address, password (stored as a hash, never in plain text), and optional role/title.
• Team content — organizations, teams, workstreams, weekly commitments and their outcomes, and related activity your team records in the Service.
• Billing information — handled by Stripe, our payment processor. We receive plan, invoice, and payment-status details but never see or store full card numbers.
• Usage and device data — log data such as IP address, browser type, pages viewed, and timestamps, collected automatically to operate and secure the Service.
• Cookies — we use essential cookies to keep you signed in and remember preferences (like your theme). We do not use third-party advertising cookies.

2. How we use information

• to provide, maintain, and improve the Service;
• to send transactional email — invitations, weekly reminders and recaps, receipts, and account notices. Recaps and reminders can be adjusted in the product; transactional notices are part of the Service;
• to send occasional product updates, which you can opt out of at any time;
• to secure the Service, prevent abuse, and comply with law;
• to build aggregated or de-identified statistics that do not identify you or your team, which we may use for analytics, benchmarking, and marketing.

We do not sell your personal information.

3. Visibility inside your team

Keptova is a team-transparency tool by design: your name, role, commitments, and their done/missed record are visible to members of your team and organization, and to organization administrators. Keep this in mind when writing commitment text.

4. How we share information

• Service providers — infrastructure and processing partners that host and operate the Service on our behalf: Supabase (database and authentication), Vercel (hosting), Stripe (payments), and Amazon Web Services (email delivery). Each processes data only to provide its service to us.
• Legal — if required by law, subpoena, or to protect the rights, safety, or property of Keptova, our users, or the public.
• Business transfers — in connection with a merger, acquisition, or sale of assets, in which case this Policy continues to apply to transferred data.

5. Data retention

We keep your information while your account is active. After account deletion or an extended period of inactivity, we delete or de-identify personal data within a reasonable time, except where retention is required for legal, billing, or security purposes. Residual copies may persist briefly in encrypted backups before rotating out.

6. Security

Data is encrypted in transit (TLS) and at rest by our infrastructure providers, and access is limited by row-level security and least-privilege controls. No system is perfectly secure; notify us at hello@keptova.com if you suspect a problem, and we will notify affected users of any breach as required by law.

7. Your rights

You can access and update your account information in the product. Depending on where you live (including under GDPR and CCPA), you may have rights to access, correct, export, delete, or restrict processing of your personal data, and to non-discrimination for exercising them. Email hello@keptova.com and we will respond within the time required by applicable law. Note that data your team recorded about shared work may be retained by your organization even if your individual account is deleted.

8. International transfers

We are based in the United States and process data there. By using the Service you understand your information will be transferred to and processed in the US, which may have different data-protection laws than your jurisdiction; where required, we rely on appropriate safeguards for such transfers.

9. Children

The Service is for business use and not directed to children under 16. We do not knowingly collect personal information from children; if you believe a child has provided us data, contact us and we will delete it.

10. Changes to this Policy

We may update this Policy from time to time. Material changes will be announced by posting here, updating the date above, or emailing your account address. Continued use after changes take effect constitutes acceptance.

11. Contact

Privacy questions or requests: hello@keptova.com.