Privacy policy

Last updated 2026-10-15

This policy explains what personal data we handle when you use keklik.io and the application at https://app.keklik.io, why we handle it, and what rights you have. It covers two quite different things: data about you, our customer, and data you collect through the Service. Sections 2 and 6 deal with those separately, because our role differs in each.

1. Who is responsible

For data about you as a customer, the data controller is:

Privacy questions: legal@kekliktech.com.

2. Data we hold about you

• Account data — your email address, the name you give us, and a hashed password. We never store your password itself.
• Workspace data — your workspace’s name, who is in it and their roles, and the email addresses you send invitations to.
• Account history — a log of account and team changes, such as who invited whom, role changes and deletions, so we can secure accounts and settle disputes.
• Session data — a session identifier stored in a cookie. Our web server also logs the IP address and browser user-agent of each request, so we can secure accounts and detect misuse.
• Ideal-customer profiles — what you tell us about who you sell to. Our AI provider reads it to draft your profile and to write your lead briefs.
• Usage and billing records — your plan, credit balance, and a ledger of credits granted and spent. We keep this to run billing and to answer questions about it.
• Support and enquiry correspondence — what you send us when you contact us, including your name and email address.

We do not run advertising trackers, we do not sell personal data, and we do not profile you for marketing.

3. Why we handle it, and on what basis

• To provide the Service — performance of our contract with you.
• To take payment and keep accounts — contract, and our legal obligations for financial records.
• To keep the Service secure — our legitimate interest in preventing abuse and unauthorised access.
• To answer you — our legitimate interest in responding to enquiries, or your consent where you asked to be contacted.

4. Cookies

The application sets two essential cookies: one holds your session identifier and keeps you signed in, and the other is a security token that protects your account from forged requests. Neither can be switched off without making sign-in impossible, and neither is used for analytics or advertising.

This marketing website sets no cookies of its own and runs no analytics or advertising scripts.

5. Who else processes it

We use the following providers. Each handles data only on our instructions and under contract.

Some of these are outside the UK and EEA. Where personal data is transferred internationally we rely on the standard contractual clauses or equivalent safeguards offered by the provider.

6. Data you collect through the Service

The Service retrieves publicly available business information on your instruction. Some of it can be personal data — a review carries the reviewer’s display name and what they wrote, and a business website may list named staff or personal email addresses.

For that data you are the controller and we are your processor. You decide what to collect, why, and what happens to it next. We process it only to deliver it to you, to store it in your account, and to let you export or delete it.

This means, practically:

• You are responsible for having a lawful basis to collect and use it, and for honouring the rights of the people it concerns.
• You are responsible for complying with marketing law before contacting anyone using details collected through the Service.
• Public business information and reviews we collect go into a shared store that never records which customer asked for them, and can be served to other customers who ask for the same business.
• What is yours stays in your workspace: your projects and runs, your lead lists with their statuses, tags and notes, your ideal-customer profiles, and the reports and briefs written for you. We do not sell any of it, or share it with anyone other than the providers listed above.
• A report or brief leaves your workspace only if you share it. When you turn on its share link, anyone with the link can read it and download it as a PDF, without signing in, until you turn the link off. Apps that show link previews show its title and summary. Shared pages ask search engines not to list them. We count how often a link is opened, and log who turned it on and off.
• You can ask us to delete your projects, runs or whole workspace at any time. That removes them from your workspace; the public data itself stays in the shared store.
• Anyone can ask us to remove data about them from the shared store, and we will not collect it again.

If someone contacts us about data you collected, we will refer them to you as the controller, and tell you.

7. How long we keep it

• Account data — while your account is open, and up to 90 days after closure so it can be restored if you change your mind.
• Your workspace’s data — until you delete it, or until your account is closed.
• The shared store — public business information and reviews are kept until someone asks us to remove data about them.
• Billing records — as long as tax and accounting law requires, typically six years.
• Enquiry correspondence — up to two years from our last exchange.

8. Your rights

Depending on where you live you may have the right to access a copy of your personal data, correct it, delete it, restrict or object to how we use it, receive it in a portable format, and withdraw consent where consent is the basis we rely on.

Exercise any of these by writing to legal@kekliktech.com. We will respond within one month. If you think we have handled your data badly you can also complain to your local data protection authority.

9. Security

Passwords are stored hashed with a modern algorithm. Traffic is encrypted in transit. Access to production systems is limited to people who need it. No system is perfectly secure, but if a breach affects your personal data we will notify you and the relevant authority as the law requires.

10. Children

The Service is for business use and not intended for anyone under 18. We do not knowingly collect data about children.

11. Changes

We will update this policy when our practices change, and revise the date at the top. Material changes will be notified by email or in the application.

12. Contact

legal@kekliktech.com, or write to the postal address in section 1. See also our terms of service and acceptable use policy.