Privacy policy

1. Who we are

Keelpost Studio LLC is a limited liability company. We design, build and maintain websites for small teams. In this policy, Keelpost, we and us refer to that company. The laws of the State of Delaware, USA, govern this policy, without limiting any right you have under applicable data protection law.

Where we decide why and how personal data is processed — through our website, inquiries, billing and operations — we are the controller. Where we process personal data on a client's instructions during an engagement, we are a processor, and the data processing addendum (DPA) governs that work.

We work from GMT+8 and answer during support hours, 09:00–18:00 GMT+8, Monday to Friday. We are not a 24/7 service, and the timeframes in this policy assume those hours.

2. What we collect

What we collect depends on how you reach us. The categories are deliberately narrow.

• Contact form data. Name, work email, company, role, the message you send, and the page you submitted from. Required fields are marked on the form. Do not send credentials or sensitive data through it.
• Business contact details. Names, job titles, work emails and phone numbers of client staff, suppliers and prospects, held in our email, address book and customer records.
• Analytics events. Page views, referrer, device type, approximate region derived from a truncated IP address, and clicks on outbound links. These events are aggregated and are not used to build a profile of you across other sites.
• Email correspondence. The content, attachments and metadata of messages you exchange with us, including calendar invitations and call notes.
• Engagement artifacts. Notes, screenshots, HTTP requests and responses, scan output, test accounts, evidence files and report drafts created while delivering an assessment, test or build. These may contain personal data that appears in the systems we are reviewing.
• Billing and contract records. Invoice recipient, company address, purchase order reference, amount, date and payment status. Card data is addressed in section 4.

We do not merge these records with data from other websites, and we do not enrich them from data brokers.

3. Why we collect it and our lawful basis

We map each purpose to a lawful basis and collect only what that purpose needs. Where we rely on legitimate interests, we have weighed the effect on you and provided a way to object.

• Answering inquiries and preparing quotes: legitimate interests in responding to a business request, or steps taken at your request before entering a contract.
• Delivering an engagement and managing the relationship: performance of a contract.
• Invoicing, tax records, debt recovery and accounting: legal obligation and legitimate interests.
• Securing our systems, preventing misuse and investigating incidents: legitimate interests in network and information security.
• Sending service updates to existing clients: legitimate interests, with an opt-out in every message. We do not add form submissions to a marketing list without consent.
• Any purpose we ask you about separately: consent, which you can withdraw at any time.

Where we rely on consent, withdrawal does not affect processing that happened before it. We do not carry out automated decision-making that produces legal or similarly significant effects.

4. What we do not collect

• Payment card data. Card details are entered on our payment processor's page and are not stored in our systems. We keep the invoice, amount, date and payment status, not the card number.
• Special category data. We do not ask for health, biometric or genetic data, political opinions, religious or philosophical beliefs, trade union membership or sexual orientation data. If such data appears in a client system under review, we do not extract it deliberately; if we encounter it, we exclude it from the report and tell the client.
• Data about children. We do not knowingly collect it. See section 11.
• Marketing lists. We do not buy, rent or scrape contact databases; business contacts come from direct contact.
• Advertising profiles. We do not build advertising identifiers, cross-site profiles or behavioral targeting data.

We do not sell personal data. We do not share it for cross-context behavioral advertising, and we do not use client data to train general-purpose AI models.

5. Cookies and analytics

Cookies we use

The public site uses a small number of first-party cookies and similar storage. We do not set advertising cookies, embed third-party tracking pixels, use session recording or run heatmaps.

• Essential. These protect form submissions and balance requests. They are set only when needed and expire with the session.
• Preference. These remember a dismissed notice or a display choice, and are stored in your browser for up to 12 months.
• Analytics. These are first-party events used to understand which pages are read. IP addresses are truncated before storage, and events are aggregated after 14 months.

Visit counter. The public site counts visits without cookies and without third-party scripts. Each request stores only a truncated hash of the IP address and browser user-agent, kept for 30 minutes so a refresh is not counted twice. The raw IP address is not stored, and the counter is never linked to an enquiry or client record.

You can block or delete cookies in your browser. Blocking essential cookies stops the contact form from working. Where the law requires consent for analytics, we ask before the first non-essential event; declining does not restrict access to the site.

We do not use third-party advertising or session-replay tools on this site.

6. Sharing and subprocessors

We do not sell personal data. We share it only where a service needs it, where you ask us to, or where the law requires it.

• Infrastructure providers. Hosting, backup, content delivery, DNS and email. They process data on our instructions under data protection terms, and the current list is in Annex C of the DPA.
• Payment processor. For card payments and invoice collection. We receive the payment status, not the card number.
• Professional advisers. Accountants, lawyers and insurers, where needed, under confidentiality obligations.
• Authorities. Where we are legally required to disclose, or to establish or defend legal claims. We challenge requests that are overbroad and tell you unless the law prohibits it.
• Clients. Personal data found in a client's systems during an engagement belongs to the client and is reported under the statement of work (SOW). We copy the minimum needed as evidence.

We give clients advance notice before adding a subprocessor that processes their personal data on their behalf. The notice and objection process is in the DPA.

7. International transfers

Our team works from GMT+8, and our providers process data in the United States and the European Union. Personal data may therefore be transferred to or accessed from those countries, including data from clients and users in the United Kingdom.

• Standard Contractual Clauses (SCCs). The 2021/914 modules, with the client as exporter and Keelpost as importer where the GDPR applies.
• UK International Data Transfer Agreement (UK IDTA). Or the UK Addendum to the SCCs, for restricted transfers from the United Kingdom.
• Transfer impact assessments. Documented before a new route is used and reviewed annually or when the law changes.
• Supplementary measures. Encryption in transit, access control, data minimization and a documented process for challenging government access requests.

Where the SCCs or the UK IDTA apply, they prevail over this policy to the extent of a conflict. We tell the affected client if we can no longer meet the transfer obligations.

8. How long we keep data

Retention follows the purpose. These are the periods we apply unless a SOW or the law sets a different one.

• Inquiries and quotes: 24 months from the last contact, then deleted.
• Client records: 7 years from the end of the engagement, to meet tax and accounting obligations.
• Reports: 12 months after delivery, then deleted unless the SOW agrees a longer period.
• Raw scan output and test evidence: 30 days after the report is delivered, then deleted. Findings and reproduction notes that appear in the report stay with the report for its retention period.

When a period ends we delete or anonymize the data. Backups rotate and are overwritten within 90 days. If a legal hold applies — a dispute, an investigation or a statutory requirement — we keep only the affected records until the hold is lifted, then delete them.

9. Your rights

Depending on where you live, you may have some or all of the rights below. We apply them to anyone who asks, where the law allows.

• Access: a copy of the personal data we hold about you, with the purposes, categories and recipients.
• Correction: fixing data that is inaccurate or incomplete.
• Deletion: erasure of data we no longer need or have no lawful basis to keep. Tax records and live contracts can limit this.
• Objection: the right to object to processing based on legitimate interests, and to direct marketing at any time.
• Portability: a copy of the data you provided in a structured, commonly used, machine-readable format, or transfer to another controller where technically feasible.
• Complaint: the right to complain to a supervisory authority. In the EU, you can complain to the authority where you live, work or where the alleged infringement occurred. In the UK, that is the Information Commissioner's Office.

How to exercise a right

Email xcsfx@icloud.com from the address you used. We may ask for proof of identity if the request concerns sensitive data. We respond within 30 days, or the period local law requires, and tell you if we need more time. There is no fee.

10. Security measures

We treat the data we hold as a target, because it is one. The measures below apply to our own systems and to client data that passes through them.

• Access: named accounts, least privilege, multi-factor authentication (MFA) on email, code hosting, cloud consoles and the password vault. No shared logins.
• Encryption: TLS in transit; full-disk and provider-side encryption at rest for client data and backups.
• Credentials: time-boxed, stored in a dedicated vault, revoked within 30 days of project close. We do not accept credentials by email.
• Logging: authentication and administrative events are logged and reviewed during support hours. We are not a 24/7 security operations center.
• Disposal: accounts, media and test data are removed at the end of an engagement, with a written record available on request.

No set of measures makes a system impossible to breach, and we do not claim otherwise. We do not hold ISO 27001 or SOC 2 certification. If we become aware of a breach affecting personal data we control, we notify the relevant supervisory authority within 72 hours where the law requires it, and tell the affected individuals where the law requires it. Where we process data for a client, we notify that client without undue delay under the DPA.

Our current posture and the controls we apply are summarized at trust and security.

11. Children

Our site and services are for businesses. They are not directed to children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has sent us personal data, email xcsfx@icloud.com and we will delete it. If you are under 16, do not use the contact form or send us personal data.

12. Changes to this policy

We change this policy when our processing or the law changes. The date at the top is the date of the last change. Material changes that affect data we already hold are notified to active clients by email at least 30 days before they take effect, or sooner where the law requires it. The previous version is available on request.

Continuing to use the site after a change does not replace consent where consent is required.

13. How to contact us

Keelpost Studio LLC. Email: xcsfx@icloud.com. Security reports: xcsfx@icloud.com.

We answer privacy requests during support hours, 09:00–18:00 GMT+8, Monday to Friday. If you are not satisfied with our response, you can complain to a supervisory authority. We cooperate with any investigation and tell you if we cannot resolve the matter directly.

Related documents: Terms of service · Data processing addendum. This policy is a template and must be reviewed by qualified counsel before publication.