Privacy Policy
Version 1.0 · Last updated
Earlier versions: keelstamp.com/privacy/versions
1. Who is responsible for your data
PowerQuant ApS, Provstlund Skovvej 1, 8700 Horsens, Denmark, CVR 46274067, is the controller for the processing described in this policy, except where section 2 or section 5 names another controller. Keelstamp is a product of PowerQuant ApS.
Contact for anything about your personal data: privacy@keelstamp.com.
We have not appointed a data protection officer.
2. Who this policy covers
This policy covers:
- people who visit keelstamp.com;
- people who write to us;
- contact persons and users at our customers and at businesses that consider becoming customers, including Founding Partner buyers and billing contacts;
- people who apply to our Design Partner programme;
- from the release of Keelstamp: all users of Keelstamp, including Approvers, for the sign-in, authentication and security logs we keep as controller (see section 3, row F);
- people who report a security issue to us.
In this policy, the "End-Client" is the business on whose behalf our customer, typically an agency, uses Keelstamp. An "Approver" is a person whom the End-Client has designated to approve or reject automated actions.
Where we get your data. Most of the data we hold comes from you. When Keelstamp is released, the email address and display name of a user or an Approver will come from the agency or End-Client that invites that person. Data about a contact person or billing contact may come from the business that places an Order.
Our own processing for users of Keelstamp. When Keelstamp is released, we will be an independent controller for the sign-in, authentication and security logs of all users, including Approvers, to secure our platform (Article 6(1)(f) GDPR). The content of approval actions is processed on behalf of the End-Client.
Information for Approvers. When Keelstamp is released, we will show Approvers a link to this policy when they first sign in. The End-Client, through the agency that uses Keelstamp for it, informs its Approvers about the processing of the content of approval actions.
Data inside the Keelstamp service. When Keelstamp processes data on behalf of a customer, for example the details of an action shown to an Approver, the End-Client is the controller, our customer (the agency) is its processor, and we act as sub-processor under our Data Processing Agreement. For that data, please contact the End-Client or the agency. If you contact us, we forward your request to them.
3. What we collect, why, and on what legal basis
| Row | Whose data | What | Why | Legal basis (GDPR) | How long |
|---|---|---|---|---|---|
| A | Website visitors | IP address, browser and device information, the page requested, time of the request | To deliver the website and protect it against misuse. This is handled by our hosting provider. | Art. 6(1)(f): our legitimate interest in running a secure website | The request logs available to us are kept by our hosting provider for a period set by our hosting plan, and never longer than 30 days. |
| B | People who write to us | Name, email address, the content of your message and anything you attach | To reply and keep track of the conversation | Art. 6(1)(f): our legitimate interest in answering; Art. 6(1)(b) where you ask us about entering into a contract to which you would personally be a party | Emails with people who are not customers: 12 months after the last contact |
| C | Contact persons and users at customers and prospective customers | Name, business email, role, company, VAT number or tax ID (where required), billing address, Orders, invoices, our correspondence | To set up and run your account, deliver the service, invoice, give support and tell you about changes to the service or our terms | Art. 6(1)(b) where you are personally the contracting party; otherwise Art. 6(1)(f): our legitimate interest in performing the contract with the business you work for | During the customer relationship. Customer account data: 36 months after the agreement ends. Accounting records: see row D |
| D | Accounting records about customers | Invoices, payment records, VAT information | To meet bookkeeping and VAT rules | Art. 6(1)(c): legal obligation (Danish Bookkeeping Act, section 12) | 5 years from the end of the financial year they relate to |
| E | Design Partner applicants | Name, agency, website, country, role, email, your answers to our application questions | To reply to you and choose the partners | Art. 6(1)(f): our legitimate interest in running the programme; Art. 6(1)(b) once you are accepted, where you are personally the contracting party; Art. 6(1)(a): your consent, if you ask us to keep a "not yet" application for longer | Until we have decided on your application. If our answer is "not yet": up to 6 months after our answer, and longer only with your consent. Deleted earlier if you ask |
| F | From the release of Keelstamp: all users, including Approvers (our own processing as controller) | Email address, display name if given, sign-in and authentication events, security logs | To let users sign in securely, to secure our platform and to detect misuse | Art. 6(1)(f): our legitimate interest in keeping the platform secure | Email address and display name: for as long as the user has access to Keelstamp, and deleted within 30 days after the access ends. Sign-in, authentication and security logs: at least 6 months and at most 12 months |
| G | People who report a security issue | Name or alias, email address, your report | To investigate and fix the issue, reply to you and credit you if you want | Art. 6(1)(f): our legitimate interest in the security of our systems | 24 months after the issue is closed |
When Keelstamp is released, our service logs (separate from the sign-in, authentication and security logs in row F) will be kept for at least 6 months and at most 12 months. They are designed to contain no plain-text personal data.
Is giving us your data required? To become a customer, you must give us the details needed to invoice you, including a valid VAT number or tax ID if your business is established in the EU, Canada or Australia. Without them, we cannot accept the Order. Everything else is voluntary.
Automated decisions. We do not make decisions about you based solely on automated processing.
AI training. We do not use your personal data to train AI models.
4. Cookies and similar technology
keelstamp.com does not set cookies and does not load analytics, advertising or tracking scripts (checked on 13 October 2026).
When you pay for an Order, you do so on Stripe's payment page, where Stripe's own privacy and cookie notices apply.
If we later use cookies or similar technology that is not strictly necessary, for example for visitor statistics, we will ask for your consent first and update this policy. Technology that is strictly necessary for a service you have asked for, such as staying signed in, can be used without consent.
5. Who receives your data
We use the providers below. They process data on our behalf, unless stated otherwise. The places listed are what we have measured; where we have not measured a place, we say so.
| Provider | What they do for us | Where it runs |
|---|---|---|
| Vercel | Hosts the keelstamp.com website and runs the DNS for keelstamp.com | Server code and builds: Washington, D.C., USA (Vercel region iad1). Static files: Vercel's global network |
| Supabase | Database | Frankfurt, Germany (AWS region eu-central-1). Supabase's support staff may access data from outside the EU/EEA (section 6) |
| Google (Google Workspace) | Email for @keelstamp.com addresses | No data region is selected. Our edition, Google Workspace Business Starter, has no data region setting, so Google decides where the data is stored (section 6) |
| Stripe | Payments and invoicing, from the opening of Founding Partner orders. Stripe is an independent controller for certain payment data | Our Stripe account is registered in Denmark. Under Stripe's standard terms for accounts in the EU/EEA, our contracting party is Stripe Payments Europe, Limited, Ireland (section 6) |
We also use GitHub to host our source code and Hetzner for an internal build server in Germany. They do not receive the personal data described in this policy.
Public transparency log and erasure. When Keelstamp is released, we will publish aggregated batch roots of our Receipt log so that anyone can check that the log has not been changed. Batch roots contain no personal data. On erasure we destroy the key that is unique to each End-Client, after which the remaining entries can no longer be linked to the underlying data. Only batch roots are public; a hash for an individual entry is never published. Backups may contain erased data and keys for up to 7 days; backups are not used for any other purpose and are overwritten on a fixed schedule.
We also disclose personal data to public authorities when the law requires it, for example to the Danish tax authorities.
We do not sell personal data.
6. Transfers outside the EU/EEA
Some of our providers, or their affiliates, process data outside the EU/EEA, as section 5 describes for each of them. The safeguard for each provider is:
- Vercel Inc. (USA): Vercel states that it is certified under the EU-U.S. Data Privacy Framework. Vercel's data processing addendum also provides the EU Standard Contractual Clauses (2021/914) and UK international data transfer terms. These are not limited to the United States: they apply wherever Vercel or its sub-processors process the data outside the EU/EEA.
- Supabase: our database runs in the EU. Where Supabase's support staff access data from outside the EU/EEA, the EU Standard Contractual Clauses (2021/914) and the UK Addendum apply.
- Stripe and Google: under their standard terms for customers in the EU/EEA, the contracting entities are Stripe Payments Europe, Limited and Google Cloud EMEA Limited, both in Ireland, so we make no transfer ourselves. Their onward transfers outside the EU/EEA, including to their US affiliates, rely on the Data Privacy Framework and/or the Standard Contractual Clauses.
The Data Privacy Framework is the adequacy decision in Commission Implementing Decision (EU) 2023/1795. The Standard Contractual Clauses are those adopted by Commission Implementing Decision (EU) 2021/914.
The safeguard used for each provider is also shown on our sub-processor page at keelstamp.com/sub-processors. You can ask for a copy of the safeguards at privacy@keelstamp.com.
7. Your rights
You have the right to:
- get access to the personal data we hold about you (Art. 15);
- have inaccurate data corrected (Art. 16);
- have your data erased (Art. 17);
- have the processing restricted (Art. 18);
- receive your data in a portable format (Art. 20);
- object to processing based on our legitimate interests (Art. 21);
- withdraw any consent you have given, without affecting processing before you withdrew it.
Write to privacy@keelstamp.com. We reply without undue delay and within one month of receiving your request, as Article 12(3) GDPR requires. If we need more time, we tell you within that month and explain why.
You can complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, dt@datatilsynet.dk, www.datatilsynet.dk. You can also complain to the data protection authority where you live or work.
8. Security
We protect personal data with technical and organisational measures that fit the risk. How to report a security issue is described at keelstamp.com/security.
9. Changes to this policy
We update this policy when our processing changes. The date at the top shows the latest version. If a change matters to customers, we tell them by email.
10. Contact
PowerQuant ApS · Provstlund Skovvej 1 · 8700 Horsens · Denmark · CVR 46274067