Privacy Policy

KeepUp (“KeepUp”, “we”, “us”) is operated by KeepUp Ltd, London, United Kingdom. For UK/EU data-protection purposes we are the data controller for the account and property information you store with us. You can reach our privacy contact at [email protected].

• Account data — your name, email address, and authentication credentials.

• Property data you enter, upload, or forward — addresses, appliances, serial numbers, documents, photos, maintenance tasks, issues, members you invite, and the facts extracted from documents you provide.

• Forwarded email — when you forward mail to your personal KeepUp address, we process the message and its attachments to file the contents against your property.

• Billing data — subscription status and customer identifiers. Card details are handled by Stripe and never stored by us.

• Technical data — log and request metadata (e.g. request IDs, IP address, timestamps) used to operate, secure, and debug the service.

• To provide the service — storing your records, generating maintenance schedules and alerts, filing forwarded documents, and processing billing. Legal basis: performance of our contract with you.

• To keep the service secure and improve reliability. Legal basis: our legitimate interests in running a safe, working product.

• To send transactional and reminder emails (verification, alerts, the optional weekly digest). The weekly digest is opt-in. If you sign up for a standalone deadline reminder on our website (for example the Modelo 210 reminder), we store your email address and the page you signed up on, and use them only to send that reminder — every message includes a one-click unsubscribe. Legal basis: contract and, for the optional digest, your consent.

• To understand how the service is used and to fix problems — we record first-party product-analytics events (for example, a document uploaded or a maintenance task completed) and error reports, tied to your account. This is our own measurement; it is not shared with any third-party analytics or advertising network. Legal basis: our legitimate interests in improving and maintaining the product.

We do not sell your data, and we do not use it for third-party advertising.

To extract facts from documents and photos you provide, we send the content to Google Vertex AI (Gemini) for processing on our behalf, in the European Union. This is used only to return structured data to your account — it is not used to train AI models. AI output is generated automatically and may be incomplete or wrong; you remain responsible for verifying anything that matters.

• Google Cloud / Firebase — authentication, Cloud Firestore (database) and Cloud Storage (files), and Vertex AI (document extraction).

• Stripe — subscription billing and payment processing.

• Mailgun — transactional and inbound email.

• Cloudflare — DNS, CDN, and security in front of the service, and privacy-friendly, cookieless web analytics (aggregate visit counts and referrers; no cookies and no cross-site tracking).

Each processor acts under our instructions and a data-processing agreement, and may only use your data to provide their service to us.

We host primarily in the EU/UK. Where a processor transfers data outside the UK/EEA (for example, some US-based services), that transfer is covered by appropriate safeguards such as the UK International Data Transfer Agreement or EU Standard Contractual Clauses.

We use only essential cookies: a session cookie that keeps you signed in and a preference cookie that remembers your language. We do not use advertising or third-party tracking cookies.

Our analytics are cookieless. Aggregate marketing measurement (via Cloudflare) and our first-party product-usage events set no cookies and do not track you across other sites, so no analytics consent banner is needed.

We keep your data for as long as your account is active. On account deletion we remove your personal data and property records within 30 days, subject to any legal retention obligations (for example, billing records we must keep for tax purposes).

Data is encrypted in transit and at rest, access is restricted, and files are served via short-lived signed URLs. No system is perfectly secure, but we take reasonable measures appropriate to the sensitivity of the data.

Subject to applicable law (including UK and EU GDPR) you may request access to, correction of, export of, restriction of, or deletion of your personal data, and you may object to certain processing. You can export your full vault at any time from your account, and delete your account from the account page. To exercise any other right, contact [email protected]. You also have the right to complain to your data-protection authority — in the UK, the Information Commissioner’s Office (ico.org.uk).

KeepUp is intended for adults managing their own or their organisation’s properties. It is not directed at children, and we do not knowingly collect their data.

We may update this policy; material changes will be notified in-app or by email, and the “last updated” date above will change.