Privacy Policy

Draft for legal review. Keeta Workspace prepared this draft, and it has not yet been reviewed by counsel. Text in [square brackets] needs a decision from counsel. Remove this note when the document is published.

Last updated: [date of publication]

This policy explains what personal data Keeta, Inc. (Keeta, we, us) collects through Keeta Workspace (Workspace), keeta.ai and our phone apps, why, who we share it with, where it is kept, and the rights you have.

1. Two roles: controller and processor

• Your organization's content. When your organization uses Workspace, the content it puts in (tasks, projects, knowledge, files, messages, code, and data from connected tools) is controlled by your organization. Keeta processes it only on your organization's instructions, as its processor, under our Data Processing Agreement. If you have questions about how your organization uses your data, ask your organization first.
• Everything else. Keeta is the controller for the data in this policy: your account, how you use Workspace, billing, the referral program, our websites, and our communication with you.

2. What we collect

Account data. Your name, email address and profile picture from Google or your organization's identity provider when you sign in; your organization and role; passkeys you register (we keep only the public key); your chosen data region; and your settings.

Usage data. What happens in your account: screens you open and actions you take (as fixed event names, never what you typed), the agents you connect and their kind and model, tokens used, sign-ins, device and browser type, IP address, and errors. We use it to run, bill, secure and improve Workspace.

Agent and connection data. For each agent you connect: its name, the command line it runs, the model it uses, when it was online, and the usage it reports. For each tool you connect: the account it belongs to and the credentials, which we store encrypted.

Billing data. Your organization's balance, purchases and charges. Card payments are handled by Stripe; we receive the card brand, its last four digits and its expiry, never the full number. Stablecoin deposits and swaps are recorded on the Keeta network as account addresses and amounts.

Referral program data. If you join the referral program and link a Keeta wallet, your wallet shares your full name, address, date of birth and identification numbers (including your tax ID) from its KYC certificate with us, encrypted, so we can pay you and meet tax reporting duties. We also record the organizations you referred and the commission paid.

Communications. What you send us by email or through support, and whether you open our service emails where your email client reports it.

Phone app. Your device's push notification token and the app version. Passkeys stay on your device.

Website visitors. keeta.ai sets no cookies for its own pages. If you use Talk to us, we receive your name, work email, company and message. If we measure visits with Google Analytics or run website tests with Coframe (see the Cookie Policy), they set cookies and record the pages you view and what you click only after you allow them.

We do not knowingly collect data from children under 16, and Workspace is not for them.

3. Why we use it, and our legal bases

Where we rely on legitimate interests, we have balanced them against your rights; you can ask us for that assessment. We do not make decisions that have legal or similarly significant effects on you based solely on automated processing.

4. AI and your data

Keeta does not use your data or your organization's content to train AI models, and does not sell it. When Workspace calls a model for you (Ask Workspace, Hosted Agents, a model your organization added), the call goes through OpenRouter only to model providers that neither keep nor train on what they are sent (zero data retention). Organizations in the EU region use OpenRouter's EU endpoint, so prompts and replies are handled by providers in the EU. To label the kind of work tasks are (such as "bug fix" or "docs") for aggregated product statistics, a small model reads a task's own words under the same zero-retention terms, and only the label is kept. See the AI Terms.

5. Who we share it with

• Subprocessors that run parts of Workspace for us, such as Google Cloud (hosting), Stripe (card payments), Cloudflare (email) and OpenRouter (model calls, including describing uploaded images). Each is bound by a data processing agreement. The full, current list, with what each one handles and where, is on our Trust page.
• Website analytics and testing providers, Google (Google Analytics) and Coframe, for keeta.ai visitors who allow cookies. They process this for us as processors, and we don't use it for advertising.
• Tools you connect, such as GitHub, Slack, Notion, Google or DocuSign, when your organization asks Workspace to read from or write to them.
• Your organization. Its owner and admins can see members' names, emails, roles and activity in the organization.
• Other Workspace organizations, only if your organization turns on Spare Cycles: a lender's computer sees the borrowed task's text and code, never who the borrower is. See the Spare Cycles Terms.
• The Keeta network, a public ledger, records balance account addresses and amounts. Accounts carry no names or descriptions, so no personal data is written to it.
• Authorities, when the law requires it, or to protect the rights, property or safety of Keeta, our users or the public.
• A buyer or successor, if Keeta is involved in a merger, acquisition or sale of assets, under this policy's protections.

We do not sell personal data, and we do not share it for cross-context behavioural advertising.

6. Where it is kept

Workspace runs in two separate regions. An organization in the United States region has its data in Google Cloud in Iowa, United States. An organization in the European Union region has its data only in Google Cloud in Belgium: its database, files, backups, logs and secrets stay there and are never copied to the United States deployment. Some subprocessors handle some data outside the EU, such as card payments and email delivery; the Trust page lists each one and the basis for the transfer.

When personal data leaves the European Economic Area, the United Kingdom or Switzerland, we rely on an adequacy decision (such as the EU-US Data Privacy Framework, where the recipient is certified) or on the European Commission's Standard Contractual Clauses, with the UK Addendum and Swiss amendments where they apply, plus extra measures where needed.

7. How long we keep it

• Account data: for as long as your account exists. When you delete your account, your name and email are replaced with "Former member" everywhere at once.
• Organization data: until the organization is deleted, then from backups within 30 days.
• Logs: 400 days, then deleted.
• Security audit records and Keeta's operator records: 24 months.
• Billing and tax records, including referral program tax data: as long as tax and accounting law requires, usually 7 to 10 years. [Counsel: confirm periods.]
• Talk to us messages and leads: [24 months] after our last contact.

8. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you, and get a copy;
• correct it;
• delete it;
• port it to another service, in a machine-readable format;
• object to processing based on legitimate interests, and to direct marketing at any time;
• restrict processing in some cases;
• withdraw consent where we rely on it, without affecting earlier processing;
• complain to your data protection authority.

You can do much of this yourself: in Settings › Account you can download your data and delete your account, and an owner can export or delete the whole organization. For anything else, write to support@keeta.ai. We will answer within one month (45 days in the US), and may need to confirm your identity. If your request is about your organization's content, we will pass it to your organization, which decides on it.

California and other US states. Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other states with privacy laws have the rights above, adapted to their law: to know, access, correct and delete personal information, to opt out of its sale, sharing for targeted advertising, and profiling, and not to be discriminated against for using these rights. We do not sell or share personal information, and we do not use sensitive personal information beyond what those laws permit. In the last 12 months we collected the categories in section 2 (identifiers, commercial information, internet activity, and for the referral program, government identifiers) for the purposes in section 3, and disclosed them only to the recipients in section 5. You may use an authorized agent. We honour Global Privacy Control signals as an opt-out where the law asks.

Other countries. If you are in the UK, Switzerland, Canada, Brazil, Australia, Japan, Singapore or another country with data protection law, you have the rights your law gives, and you may contact us as below to use them.

9. Security

We keep organizations apart in the database itself, encrypt data in transit and at rest, require passkeys for our own operators and record everything they look at, and keep backups we test. No system is perfectly secure; if a breach affects your personal data, we will tell you and the authorities as the law requires.

10. Changes

We will post any change here with a new date, and tell you by email or in Workspace before a material change takes effect.

11. Contact

Keeta, Inc., [registered address]. Email: support@keeta.ai. [Counsel: name a privacy contact address, and if required, a data protection officer.]

EU representative: [name and address, under Article 27 GDPR]. UK representative: [name and address, under Article 27 UK GDPR].