Privacy
Keptrace holds a record of your work. These five promises are the terms it is built on.
- 01
Encrypted per tenant
Each workspace has its own encryption keys. Your records are unreadable outside your tenant.
- 02
Repo-level capture is off
By default only what your tools explicitly record is kept. Repo-level capture is opt-in, per workspace.
- 03
Delete means delete
Deleting a workspace removes every record immediately. No retention window, no backups kept.
- 04
No training
Your records are never used to train models. Not ours, not anyone’s.
- 05
EU hosting
All data lives in EU data centres, governed by EU law.
Last updated 29 August 2026
- 01
Controller
Medita Development (Chamber of Commerce no. 99904500), Kempensebaan 22, 5613 JD Eindhoven, The Netherlands, is the controller for personal data processed through keptrace.com and the Keptrace apps. Questions: hello@keptrace.com.
- 02
What we collect and why
- Account data: name, email, password hash, workspace membership. To provide the service and secure your account (contract).
- Recorded content: sessions, turns, decisions, digests and references your tools send, which may contain personal data you choose to record. To provide the service (contract). You decide what is recorded.
- Billing data: billing name and address, VAT number, last four digits and type of your payment method, invoices. Full card details never reach us; Stripe holds them. To bill you and meet tax law (contract, legal obligation).
- Technical data: IP address, user agent, timestamps in server logs and device-authorisation records. To keep the service secure and detect abuse (legitimate interest). Logs are kept for 30 days.
- Waitlist and support email: email address and what you write to us. To reply and to tell you when we launch (consent, legitimate interest).
- Website analytics: Google Analytics 4 on keptrace.com with IP anonymisation, no ads features. To understand which pages are used (legitimate interest). Not used inside the app.
- 03
Processors we use
We share data only with providers that process it on our behalf under a data processing agreement:
- Hetzner Online GmbH (Germany): servers and object storage, EU data centres.
- Stripe Payments Europe Ltd (Ireland): payments, invoices, tax calculation.
- Hostinger (Lithuania): transactional email from info@keptrace.com.
- Google Ireland Ltd: website analytics on keptrace.com only.
We do not sell personal data and do not share it with anyone else unless the law requires it.
- 04
Where data lives
Recorded content and account data are stored and processed in EU data centres. Stripe and Google may transfer limited data outside the EU under the EU Standard Contractual Clauses and the EU-US Data Privacy Framework.
- 05
Retention
- Recorded content and account data: until you delete them or your workspace. Deletion is immediate.
- Server logs: 30 days.
- Invoices and payment records: 7 years, as required by Dutch tax law.
- Waitlist emails: until launch or until you ask us to remove you.
- 06
Your rights
Under the GDPR you can ask for access, correction, deletion, restriction, portability and object to processing based on legitimate interest. Most of this you can do yourself in Settings; for the rest email hello@keptrace.com. We answer within 30 days. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
- 07
Cookies
The app uses strictly necessary cookies for login sessions and CSRF protection. keptrace.com sets Google Analytics cookies only in production. No advertising or tracking cookies.
- 08
Security
Data is encrypted in transit (TLS) and at rest with per-tenant keys. Passwords are hashed. Access to production systems is limited to the operator and protected by keys and two-factor authentication.
- 09
Changes
We update this policy when our processing changes. Material changes are announced by email. See also our terms of service.