Privacy Policy

• Identity and contact data: name, email address, profile picture, company name and role.
• Authentication data: password hash, or the identifier of the third-party account you sign in with (for example your Google Account).
• Billing data: billing address, VAT number and subscription details. Card details are handled by our payment provider and never reach KEIX servers.

The KEIX platform is a data platform: its purpose is to let you bring your own business data into a workspace, analyse it and act on it. That data — including any personal data it contains — is processed by KEIX on your behalf and under your instructions. You remain the controller of the data you upload or connect; KEIX acts as processor.

This includes data retrieved from third-party services you choose to connect, such as Google Drive, Google Sheets, Google Calendar, Gmail, Google Business Profile and Google Ads. Section 5 describes that access in detail.

• Technical data: IP address, browser type and version, device and operating system, language settings.
• Interaction data: pages visited, features used, session statistics, timestamps and error logs.
• Trackers and cookies, as described in our Cookie Policy and controlled by your consent preferences.

• Google sign-in and account identification — identity permissions such as openid, userinfo.email and userinfo.profile allow KEIX to identify your Google account. In a data connection, userinfo.email identifies the connected account and lets you distinguish it from your other connections.
• Google Drive and Sheets — drive.metadata.readonly lists spreadsheet names and IDs in the file selector. spreadsheets reads values and tab names from the spreadsheet you select. Configured write actions append or update cells in the spreadsheet you choose.
• Google Calendar — calendar.calendarlist.readonly lists the calendars you can select. calendar.events reads event details such as titles, times and attendees and allows configured actions to create or update events, send invitations and request a Google Meet link.
• Google Analytics — analytics.readonly lists accounts and properties and reads reporting dimensions, metrics and report values for the property you select.
• Google Ads — adwords lists available customer accounts and reads campaign data such as performance and costs for reporting.
• Google Business Profile — business.manage reads account and location information, reviews and performance metrics for the locations you select.
• Gmail — gmail.readonly reads messages, including subject, body, sender and recipient details, labels and eligible attachments, to sync your mailbox into Communications, show conversations and match messages to CRM contacts. gmail.send lets KEIX send the messages you compose or configure, such as replies or survey invitations, from the connected address.

• Selected Google data can be displayed in your workspace and used in datasets, dashboards, reports, and the actions and workflows you configure.
• Mailbox data supports inbox sync, searching, conversation display, replies, and delivery or reply tracking for messages sent through KEIX. Access in the KEIX interface follows mailbox ownership and sharing permissions, including grants for individuals, groups or CRM-linked mail.

• KEIX stores connection identifiers, permissions and OAuth tokens to run connected features. The platform can provide an access token to authorised integration code to make a Google API request on your behalf.
• KEIX stores synced mail and conversation records in its database. Eligible synced attachments are stored as files in Cloudflare R2 and can be opened by anyone who has their download link. Dataset selections and data included in saved results or reports can also be stored in the workspace.

• Workspace collaborators may see data shown in shared results or under mailbox sharing permissions. When you send email or create an event with attendees, the configured recipients receive the message or event information.
• Cloud hosting and object storage providers process the data necessary to run the service. See section 8 for information about service providers.
• Where enabled, AI analysis can process samples from a connected dataset. For matching replies to survey emails, the reply classification feature can send an excerpt to the configured AI service to label and summarise the reply. If automated quote drafting is configured for a mailbox, it can send email content and eligible attachments for extraction and drafting.

• You can disconnect a Google account from the connection settings in KEIX. The platform removes the stored connection credentials and requests revocation from Google.
• You can also revoke KEIX's access directly from your Google Account at https://myaccount.google.com/permissions.
• Disconnecting or revoking access affects future access. Copies already saved in KEIX, such as messages, attachments, reports or workflow results, can remain. Deleting a conversation in the interface removes the messages you have permission to delete. The separate attachment files may remain in storage.
• For a request to delete retained Google data or a copy you cannot remove from the interface, contact admin@keix.com and identify the account and connection concerned.

Google publishes its API Services User Data Policy, including its Limited Use requirements, at https://developers.google.com/terms/api-services-user-data-policy.

We take appropriate technical and organisational security measures to prevent unauthorised access, disclosure, modification or destruction of data. Processing is carried out using computers and IT tools, following organisational procedures strictly related to the purposes indicated in this policy.

Production compute and databases are in the European Union (Germany and Finland, Hetzner). Some of the providers listed in section 8 are established outside the EU; those transfers rely on the EU-U.S. Data Privacy Framework where the provider is certified, and on Standard Contractual Clauses otherwise. See section 8 for the place of processing of each provider.

Unless stated otherwise in this document, personal data is processed and stored for as long as required by the purpose it was collected for, and may be retained longer where an applicable legal obligation requires it. In particular: data from contact and demo-request forms is kept for 24 months; newsletter subscriber data is kept until you unsubscribe, and a subscription pending confirmation is deleted after 7 days if not confirmed; blog administrator accounts are kept until the account is removed; data you connect to the platform is retained for as long as you instruct, since KEIX acts as processor for that data (see section 3.2). Retention of Google user data is covered specifically in section 5.5.

Edge network, hosting (Cloudflare Pages) and object storage (Cloudflare R2), provided by Cloudflare, Inc. Cloudflare filters all traffic to this website and to the platform; R2 stores attachments, workflow results and database backups, which may contain personal data. Personal data processed: trackers, IP address, usage data, and any personal data contained in stored artifacts and backups. Place of processing: Cloudflare's default jurisdiction (not EU-committed); edge processing is global. Transfers rely on Cloudflare's Data Processing Addendum and Standard Contractual Clauses.

Google Analytics 4 runs only after you enable the 'measurement' category in the cookie banner (Consent Mode v2; IP addresses are anonymised). Personal data processed: usage data, number of users, session statistics, trackers. Place of processing: United States.

Google Drive, Google Sheets, Google Calendar, Gmail, Google Business Profile and Google Ads, provided by Google LLC, are accessed by the platform on your behalf when you connect them. This access is governed in full by section 5 of this policy.

Transactional email delivery — account verification, password reset and other service emails — provided by Postmark (ActiveCampaign / Wildbit). Personal data processed: recipient email address, message content. Place of processing: United States, under a Data Processing Addendum and Standard Contractual Clauses.

Site emails — password-reset messages for the platform and newsletter subscription confirmation — provided by Resend. Personal data processed: recipient email address, message content. Place of processing: United States, under a Data Processing Addendum and Standard Contractual Clauses.

Payment processing for platform subscriptions and for purchases made directly on this website, provided by Stripe. Personal data processed: payment and billing details, name, email address. Place of processing: European Union and United States, under Stripe's standard Data Processing Agreement.

Hosting and compute for our production infrastructure, provided by Hetzner Online GmbH. This infrastructure hosts the platform services and their databases. The other providers listed here process the data described in their entries. Place of processing: Germany and Finland (European Union).

Identity and authentication, self-hosted by us on our own infrastructure. Personal data processed: login identity, session and permission data. Place of processing: Germany and Finland (European Union), on the Hetzner infrastructure listed above.

Some AI features of the platform (for example document analysis and AI-assisted actions) send the relevant content to Claude, provided by Anthropic. Personal data processed: any personal data contained in the content you submit to that AI feature. Place of processing: United States, under a Data Processing Addendum and Standard Contractual Clauses.

Some AI features send relevant content to Gemini, provided by Google LLC. The content can include personal data. Section 5.4 describes the cases that may involve data from connected Google services. Place of processing: United States, under a Data Processing Addendum and Standard Contractual Clauses.

Call transcripts and AI-generated summaries, provided by Fathom and connected to the platform only when you choose to do so. Personal data processed: call recordings, transcripts and participant names. Place of processing: United States.

Map tiles rendered in the platform interface, provided by Mapbox. Personal data processed: location coordinates displayed on the map; typically no other personal data. Place of processing: United States.

Web search used by the platform's AI assistant when you ask it to find a dataset, provided by Brave. Personal data processed: the text of your search query, which may contain personal data you typed. Place of processing: United States.

Real-time email address verification on certain platform forms, provided by mailinput.com. Personal data processed: the email address you are typing, sent to this service as you type. Place of processing: not yet confirmed by the provider.

SMS delivery, provided by BulkGate. Personal data processed: recipient phone number, message content. Place of processing: Czech Republic (European Union).

Messaging integrations — WhatsApp Business API, Facebook, Instagram and Telegram — that you connect to the platform at your own instruction, provided by Meta Platforms, Inc. and by Telegram. Personal data processed: message content and contact identifiers you route through the channel you connect. Place of processing: depends on the provider; governed by your own connection to each service and its own terms.