Privacy policy

Operator and correspondence

Charlie Miller, sole trader trading as Keepalto.

support@keepalto.com

Who is responsible

Charlie Miller operates Keepalto and is responsible for account administration, support and service-security information. A business using the platform normally decides why and how its customer, staff and operator records are used; Keepalto handles those records on its instructions. The customer data processing agreement at https://keepalto.com/data-processing forms part of the subscription terms and sets out our processing instructions, security, provider, assistance and return/deletion obligations. Published provider terms have been reviewed; this is not certification of compliance or verification of every provider account’s acceptance and international transfer.

Information processed

Accounts include email, authentication and verification records, a name when supplied and confirmation that you are at least 18; a full date of birth is not required. Users may add organisation details, operating preferences, staff roles, customer contact details, operator competencies, locations, equipment photos and documents, bookings and activity records. We retain subscription and terms-acceptance records and payment-provider references, not complete card numbers or card security codes. Support enquiries contain information you send. Providers also process necessary connection and security information. Records about you may come from the organisation that employs you or supplies your equipment.

Why it is used

Account information is used to provide the service and manage access. Support information is used to answer requests. Security and activity records support our legitimate interests in protecting the service and investigating misuse. We may retain information to meet legal duties. Business-entered records are used for that business’s operational instructions. We do not use the application to make solely automated decisions with legal or similarly significant effects.

Who can access it and service providers

Authorised register members access records according to their roles. Restricted platform administration requires additional authentication. Netlify hosts keepalto.com. Supabase provides authentication, the operational database and private file storage. Stripe processes subscription payments and may act as an independent controller for payment, fraud and regulatory activities. Resend handles transactional messages and delivery events; Google Workspace handles support correspondence. Cloudflare R2 stores encrypted off-site backups using its EU jurisdiction endpoint; backup generation and 35-day expiry are enabled with a daily 02:00 UTC schedule. We have not added advertising pixels or third-party marketing analytics.

Optional demo measurement and email requests

With your permission, we count demo starts, selected successful actions and sign-up clicks by UTC day and broad source category such as Instagram, email or direct. We do not retain names, IP addresses, device fingerprints, raw referrer URLs, visitor/session identifiers or demo form contents in these counts. They are aggregates, not individual journeys. Consent is optional: declining or withdrawing it does not restrict the demo. Use the demo measurement controls to stop future counting; already anonymous aggregate counts cannot be traced back to remove one person's actions. Global Privacy Control and Do Not Track disable measurement. Hosting providers still process connection/security information for delivery and abuse protection. Separately, if you actively request a personal email follow-up, we encrypt your email address and retain its broad source, request time and consent wording version for up to 90 days. It is not linked to demo actions or automatically subscribed to campaigns. Addresses are unverified. Only the protected platform administrator can review them. Withdraw your request or object at any time by emailing support@keepalto.com or replying to a follow-up. Active enquiries may become support correspondence under the separate retention terms. Daily cleanup deletes expired demo counts and email requests; backup copies expire on their separate 35-day cycle.

Location and retention

The primary Supabase project is selected in London, but hosting, email, support and payment processing may occur internationally. This is not UK-only hosting. Restricted transfers require applicable safeguards, including contractual transfer provisions; contact support for information about providers and safeguards. Operational records are retained while needed for the service. After paid access expires, the recovery policy provides a minimum 30-day window; full restoration is not guaranteed afterwards. Encrypted off-site backup copies expire through a separate 35-day cycle. Automatic account purging is not yet active, so contact support for deletion rather than assuming everything disappears on day 30. Financial, security, dispute and legally required records and provider backups have separate retention requirements. We assess deletion requests against service needs, instructions, legal duties and other people’s rights.

Business introductions and prospect research

We may identify relevant businesses from their public business websites and directories, or from information you provide directly. We record the business name, published business contact details, relevant asset or rental categories, source URL, research date and correspondence history to assess relevance and introduce Keepalto. We do not treat a publicly listed address as consent. Where applicable electronic-marketing rules permit a business introduction without consent, our lawful basis for any personal data is our legitimate interest in finding customers for relevant asset-management software, balanced against the contact's rights and reasonable expectations. Where consent is required, we need that consent before sending. We do not use customer register contents for prospecting, buy personal contact lists or use sensitive personal information to target introductions. The first introduction identifies us, links to this notice and explains how to opt out.

Outreach providers, records and opt-outs

Google Workspace handles business introductions and replies. Authorised research and drafting tools, including OpenAI's Codex, may process published business contact information and relevant correspondence under our direction. Outreach review files are held in restricted operator-controlled storage; they are not public prospect directories. These providers may process information internationally, subject to the safeguards described in this notice. We do not add email-open tracking pixels to these introductions. You can object to direct marketing at any time, free of charge: reply to any introduction with 'no thanks', or email charlie@keepalto.com or support@keepalto.com. We stop marketing to that address and retain only the minimum suppression record needed to prevent further contact. This is separate from necessary service messages to existing customers. Uncontacted research and unanswered prospect correspondence are reviewed for deletion within 90 days of collection or last contact, unless an active enquiry or a legal need justifies longer retention. Suppression records are retained while we conduct outreach, with periodic review, so that deleting a prospect record does not result in contacting them again.

Your choices and rights

You may request access, correction, erasure, restriction or portability where applicable. You can object to processing based on legitimate interests, including an unconditional right to object to direct marketing, and withdraw any consent relied upon. Contact support@keepalto.com; we may need proportionate identity checks for account-data requests, but a marketing opt-out does not require creating an account. Where a business controls the record, contact that business too. Deletion rights have legal exceptions and do not automatically erase shared operational history.

Complaints and required information

You can complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint, and to another competent authority where applicable. Login identifiers are necessary for the signed-in service; optional descriptive information should be limited to what the business needs. You can explore the fictional demo without an account. Changes to processing will be reflected in this notice.