Privacy & cookies

Analytics & cookies on this website

Analytics and marketing cookies on our marketing site are off by default, with one exception noted below. When you first visit you can accept all, reject all, or choose by category, and you can change that choice any time from the Cookie preferences link in the footer. Only after you opt in do we load tools that set cookies and collect usage data such as pages viewed, referrer, approximate (city-level) location, and device or browser type:

• Google Analytics 4 - aggregate traffic and engagement analytics (analytics category).
• Meta - advertising measurement. When you start a trial, our servers send Meta one signup event containing a SHA-256 hash of your account email address. The raw address is not sent, and nothing from inside a workspace reaches it. The Meta Pixel itself runs on this marketing site only (marketing category, opt-in).
• Microsoft Clarity - usage analytics and session recording: it records your visit and replays it to us, including pointer movement, scrolling, clicks and the page as it appeared. Form-field values, and text containing a digit or an “@”, are redacted (analytics category).
• Metricool - traffic and marketing-performance measurement (analytics category).
• Meta (Facebook) Pixel and first-touch campaign attribution - advertising measurement (marketing category).

The exception is partner referral tracking. If a partner or affiliate link sent you here, we record that so the partner can be paid for a signup they sent us. Two things do it: FirstPromoter’s own script, and a first-party cookie we set ourselves so the referral is not lost when a browser extension blocks that script. This is the one marketing purpose that does not wait for consent: it runs for every visitor arriving on a partner link, whatever you choose in the banner, and no toggle turns it off. The cookies involved and how long they last are listed on our Cookie Policy.

We do not sell your personal information. We honor Global Privacy Control and Do Not Track signals by leaving the optional categories off, and you can also block cookies in your browser. Blocking these does not affect your ability to use the site. For the full list of cookies and how long each lasts, see our Cookie Policy.

The Keel app

When you create a workspace and use the product, we process the account and compliance data you put in so the service can function. Each workspace’s data is isolated at the database level with PostgreSQL row-level security, so one workspace can’t reach another’s data. The app uses essential cookies to keep you signed in and to remember the choices you make in it, including your active workspace and how pages are displayed. These are needed for the app to work or hold a choice you asked us to remember, and none of them is used for advertising. Our Cookie Policy lists the app’s cookies in full.

We currently run no analytics in the signed-in app. There is no product analytics tool, no session recording and no advertising tag on app.keelgrc.com: no analytics vendor receives your in-app pageviews, the pages you open, or what you click on your controls, evidence and documents. Google Analytics, Microsoft Clarity, Metricool and the Meta Pixel run on this marketing site only. The only third parties that receive data from the app are the sub-processors listed below, plus one server-side measurement call to Google described next.

If you accepted analytics on keelgrc.com before signing up, our servers send Google Analytics two events when you create a workspace: sign_up and trial_start. They carry the analytics identifier from your marketing-site visit and your plan, and no email address, name or workspace data. The call comes from our servers, so Google does not receive your IP address from it. If you declined analytics on keelgrc.com, or never visited it, nothing is sent.

Keel used a product-analytics tool in the signed-in app until August 2026, when it was removed and not replaced. That collection has stopped and the vendor is no longer a sub-processor. We have kept the app’s consent mechanism in place rather than removing it: the analytics category is still offered and currently loads nothing, so that anything we add later cannot run before you have accepted it.

Sub-processors

We rely on a small set of reputable providers to run Keel:

• Cloudflare - hosting, CDN, and edge delivery.
• Neon (PostgreSQL) - primary application database.
• Clerk - authentication and session management.
• Stripe - subscription billing (we never see or store full card numbers).
• Resend - transactional and opt-in newsletter email.
• Cloudflare R2 - evidence and document storage.
• Sentry - error monitoring to keep the service reliable.
• Anthropic - powers optional in-product AI features you choose to run.
• Zoho - our CRM and helpdesk. From 27 October 2026 it will also receive the name and email address of each person who creates a Keel workspace. It receives nothing from inside a workspace.
• Microsoft Clarity - session recording and usage analytics on this marketing site only, not in the app (analytics category, opt-in).
• Metricool - traffic and marketing-performance measurement on this marketing site only, not in the app (analytics category, opt-in).

Every analytics provider in that list is limited to this marketing site. None of them processes data from the signed-in app.

The current, maintained list - with each provider’s purpose and the kind of provider it is - lives on our sub-processors page.

Email

If you subscribe to our newsletter, from a signup form or by ticking the newsletter box on a download or tool form, we store your address to send it and you can unsubscribe at any time. Transactional emails (invites, notifications, your opt-in weekly digest) are sent only in connection with your account.

Your rights

If you’re in a region with data-protection rights (for example under GDPR or CCPA/CPRA), you can request access to, correction of, or deletion of your personal data. Email privacy@keelgrc.com and we’ll help.

Contact

Questions about privacy or this page? Email privacy@keelgrc.com.