KEELHQ

Privacy Policy

Last updated: 2026-07-10

Quick summary

Keel HQ is an operations platform for DTC brands. On the marketing site we collect:

  • The email address you give us if you join the waitlist.
  • Anonymous, cookieless analytics about which marketing pages you visit (via Fathom Analytics).
  • Standard server logs (your IP address, user agent) when you load a page.

Merchants who install the Keel HQ Shopify app also authorize us to sync their store's order data — including customer email addresses — as described in the Merchant and customer data section below.

We don't sell your data. We don't track you across other websites. We don't use third-party advertising cookies.

Questions? Email privacy@keelhq.io.

Who we are

This site is operated by Lindahl Studios LLC (“we”, “us”, “our”), a studio based in Washington, USA, building Keel HQ at keelhq.io.

What we collect, and why

Waitlist email address

When you submit the waitlist form on the marketing page or the coming-soon page, we store your email address so we can notify you when Keel HQ opens to early access. We also store the source of the signup so we can understand which surface is converting.

We do not subscribe you to any other emails. You will only hear from us about Keel HQ's launch.

Anonymous analytics

We use Fathom Analytics, a privacy-focused, cookieless analytics service, to measure aggregate traffic to our marketing pages — which pages are visited, where visitors come from, etc. Fathom does not use cookies, does not collect personal data, and does not track visitors across websites. Read Fathom's privacy commitment for more.

We also use Vercel Web Analytics on both the marketing pages and inside the signed-in dashboard — cookieless, IP-anonymized aggregate page-view counts that we see alongside our deployment dashboard. For each view it records the page path — query parameters (such as a conversation or filter id carried in a dashboard link) are stripped in your browser before the analytics event is sent, so they are not stored in the Web Analytics dataset. (Because Vercel also hosts the app, the underlying page request can still carry the full URL to Vercel's servers — see Server logs below.) Each view also records a timestamp, the referrer, coarse geography (country / region), and device type (browser, OS, screen size). It does not set cookies or collect names, emails, or any other personal identifiers, and it does not tie these page views to your account. And we forward Core Web Vitals (LCP, CLS, INP) to Fathom as bucketed events (good / needs-improvement / poor per Google's thresholds) so we can spot performance regressions. None of this involves cookies, personal identifiers, or cross-site tracking.

We do not use Google Analytics, Facebook Pixel, advertising trackers, or any cross-site behavioral tracking on this site.

Server logs

Our hosting provider (Vercel) records standard request information when you load a page: IP address, user agent, request path, response status, and timestamp. We use this only to debug errors and detect abuse. Vercel retains these logs for a short period and we don't query them for individual visitors.

Merchant and customer data

When a merchant installs the Keel HQ Shopify app, they authorize Keel HQ to sync their store's order data into Keel's analytics pipeline. This sync includes the customer_emailfield on each order. That email is Shopify customer data — it belongs to the merchant's customers, not to the merchant themselves — and Shopify classifies it as protected customer data under their API terms.

We store customer_email for three specific purposes:

  • GDPR compliance webhooks. When Shopify fires a customers/data_request webhook (a customer requesting their data) or a customers/redact webhook (a customer requesting deletion), we use the stored email to identify and act on the correct rows. Customer emails are never displayed in Keel's UI and are never sent to end-customers or shared with third parties beyond the sub-processors listed in the Sub-processors section below (Supabase, which stores it as part of database rows).
  • Reporting and analytics.The email acts as the customer identifier when Keel generates a merchant's reports — classifying each order's buyer as a new or returning customer and computing trailing-twelve-month lifetime value. These are aggregate metrics; the email itself is never shown in the reports, never used for marketing, and never sent to any AI provider.
  • Internal audit trails.When a merchant asks which orders belong to a specific customer during operational triage, the email allows us to look up the matching records on their behalf — server-side only, within their org's data scope.

Retention and deletion schedule:

  • Customer data is active while the shop's Shopify integration is connected.
  • When a merchant uninstalls the app, Shopify fires a shop/redact webhook 48 hours later. On receipt, we delete all storefront-scoped rows including customer_email from sales_snapshots and all related tables.
  • When Shopify fires a customers/redact webhook for an individual customer, we null the customer_email field on all matching rows within 30 days of the request.
  • Supabase point-in-time recovery (PITR) backups auto-expire on a 7-day rolling window.

Encryption and access control: All merchant and customer data is stored in Supabase (managed Postgres). Data at rest is encrypted with AES-256 (Supabase-managed). All connections between Vercel and Supabase use TLS 1.2 or higher. Merchant-facing customer-PII tables (order and customer-email data synced from Shopify) enforce row-level security (RLS) scoped to org_id, so one merchant's data is never accessible to another. A few derived aggregate tables (e.g. order_totals) are still being migrated to org-scoped RLS policies; until that lands they are read only through server-side, org_id-filtered queries and are not exposed to the browser. Tightening RLS across all derived tables is tracked in a follow-up issue. Internal GDPR compliance audit logs use service-role-only access and are not merchant-accessible.

Who we share data with

We use a small set of third-party service providers to operate the site:

  • Vercel — web hosting, server logs, and cookieless aggregate page-view analytics (Vercel Web Analytics).
  • Supabase — managed Postgres database storing waitlist emails, merchant order data, and customer email fields synced from connected Shopify stores. Data is encrypted at rest (AES-256) and in transit (TLS 1.2+). Customer-PII tables enforce row-level security scoped to org_id; a few derived aggregate tables are still being migrated to org-scoped RLS and in the meantime are read only through server-side, org_id-filtered queries (tracked in a follow-up issue). Supabase operates under its own DPA.
  • Fathom Analytics — anonymous page-view analytics.
  • Basecamp — internal team notifications. When you join the waitlist, your email address is posted to a private Basecamp Campfire room so the team is notified in real time. The address is not stored by Basecamp beyond the message.
  • Anthropic — AI features in the Keel HQ app. Anthropic receives (a) aggregate business metrics such as revenue totals, inventory levels, and forecast data for the AI-assistant surface, (b) merchant-uploaded documents such as debt-statement screenshots for the debt-extraction feature, (c) merchant-provided creative and marketing inputs — the product, format, hook, and objective fields you enter in Ads Studio, and the topic and brand-voice rules you configure for carousel generation — (d) campaign history such as your flash-sale send records for flash-sale analysis, and (e) the full monthly-report dataset — aggregate revenue, margin, and customer metrics plus product, inventory, email, and paid-ads report sections (including product and campaign names) — for the automated monthly-report narrative. These app-supplied data flows never include Shopify customer PII — customer email addresses, names, and addresses are not sent to Anthropic. Note that free-text prompts you type into the AI assistant are forwarded to Anthropic verbatim, so avoid pasting customer PII (such as a customer's email, name, or address) into chat messages. Anthropic's Enterprise API does not use API request data to train models.
  • Help Scout — in-app support widget (Help Scout Beacon) for signed-in users. On every signed-in dashboard load, your account email address and display name are sent to Help Scout to identify you — so support replies reach you and your conversation history is attached to your record — not only when you open the widget. Only loaded on authenticated app surfaces, and only when the Beacon is configured for the environment.
  • Loops — transactional email delivery and contact capture. For transactional email, Loops receives the recipient's email address and the notification's data variables (e.g. month-to-date AI spend) to send account notifications such as the AI-usage spend alert sent to workspace owners and admins. Separately, when you request demo access, the email address you submit is stored as a Loops contact (tagged with the source "demo-access") for follow-up outreach. Only used when Loops is configured for the environment.
  • GitHub — bug-report intake. When a signed-in user submits an in-app bug report, the reporter's email address, the description they wrote, the page URL, and browser context (user agent, screen and viewport size, platform, language) are filed as a GitHub issue in our private tracker so the team can triage it. If you attach an optional screenshot, the image is uploaded to our Supabase storage and a publicly accessible link to it is embedded in the GitHub issue — so avoid capturing customer PII in screenshots. Only used when bug reporting is configured for the environment.

Each provider acts as a sub-processor under their own privacy policies, linked above. We do not share your data with anyone else. We do not sell your email address. We do not share it with advertisers. We do not transfer it for cross-platform behavioral profiling.

How long we keep it

  • Waitlist email addresses: until Keel HQ launches to general availability. At that point we'll send you an opt-in to continue receiving updates, and remove your address if you don't opt in.
  • Merchant order data and customer emails: active while the shop's Shopify integration is connected. On app uninstall, all storefront-scoped Shopify data (orders, customers, inventory, sales snapshots) is deleted within 30 days of Shopify firing the shop/redactwebhook (Shopify fires it 48 hours after uninstall). Org-scoped derived data such as historical monthly reports and product-meta rollups is retained indefinitely because it is aggregated/derivative business data, separate from Shopify's storefront rows. There is currently no user-facing retention control for these tables; email privacy@keelhq.io to request deletion. Per-customer deletion requests (customers/redact) are fulfilled within 30 days — the customer_emailfield is nulled on all matching order rows. A GDPR compliance audit log entry is retained indefinitely, containing the customer's original email address, the shop domain, the customer identifier, and a timestamp. This log is service-role-only, not merchant-accessible, and exists solely to prove we processed the redaction request; issue #496 tracks migrating it to a hashed identifier for a stronger privacy posture. When Shopify fires a customers/data_request webhook, we likewise retain a GDPR compliance audit entry indefinitely in gdpr_data_requests, containing the customer's email address, a timestamp, and the webhook payload. It is service-role-only, not merchant-accessible, and exists solely to prove we processed the request — the same posture as the customers/redact audit log described above. Supabase PITR backups expire on a 7-day rolling window.
  • Demo-access contacts: the email address you submit to request demo access is kept as a Loops contact (tagged demo-access) until you ask us to remove it or unsubscribe. Email privacy@keelhq.io to have it deleted.
  • Help Scout support records: your Help Scout customer profile (email address and display name) and conversation history are retained for the life of your active workspace and for up to 24 months after account deletion, so we can reference past support history. Email privacy@keelhq.io to have your Help Scout profile and conversations deleted sooner.
  • Bug reports: the GitHub issue created from an in-app bug report — and any screenshot linked from it in the bug-screenshotsstorage bucket — is retained indefinitely as part of our engineering history. On request we will redact the reporter's email address from the issue and remove the attached screenshot from the storage bucket; email privacy@keelhq.io.
  • Server logs: retained by Vercel per their data-retention defaults (around 30 days).
  • Analytics events: Fathom aggregates events and does not retain individual session data.

You can ask us to delete your waitlist entry at any time — see “Your rights” below.

Your rights

You can:

  • Access — ask what data we have about you.
  • Correct — ask us to fix any inaccuracy.
  • Delete— ask us to remove personal data we hold about you, including your waitlist entry, your demo-access contact, your Help Scout support profile and conversations, and the email address on any bug report you filed (along with its screenshot). See “How long we keep it” above for what applies to each.
  • Opt out — unsubscribe from any future communications.

Send a request to privacy@keelhq.io. We will respond within 30 days.

If you're in the EU, EEA, or UK, the same rights apply under GDPR, plus a right to object to processing and to data portability.

If you're a California resident, the same rights apply under the CCPA / CPRA.

Cookies

The marketing site (keelhq.io) sets no cookies. Fathom Analytics is cookieless, and we don't load third-party advertising or social-media scripts that set cookies.

The Keel HQ dashboard (app.keelhq.io) sets HTTP-only session cookies via Supabase Auth when you sign in. These are strictly necessary to keep you authenticated and can't be disabled while using the app — they don't track your browsing behavior across sites.

International data transfers

Lindahl Studios LLC is based in the United States. If you submit your email from outside the US, your data is transferred to and processed in the US by our sub-processors listed above. Each sub-processor has its own data-transfer agreements that comply with EU/UK adequacy frameworks.

Children

Keel HQ is a B2B product for adult business operators. We do not knowingly collect data from anyone under 16. If you believe a child has submitted information to us, email privacy@keelhq.ioand we'll delete it promptly.

Changes to this policy

We may update this policy as we add features or services. When we do, we'll change the “Last updated” date at the top. For material changes, we'll notify waitlist subscribers by email.

Contact

Questions about this policy or your data: privacy@keelhq.io

For the legal terms governing your use of this site, see our Terms of Service.