Data Protection

Protecting your data is central to how Keelo is built. Your business data belongs to you. We process it only to provide the service, and we never sell it. This page summarises the technical and organisational safeguards we have in place. Our Privacy Policy explains what we collect and why.

• Encryption of data in transit (TLS) and at rest.
• Row-level security so each business can only ever access its own data.
• Role-based access controls within the platform, with roles held separately from user profiles.
• Hashed passwords and secure social sign-in through Google and Meta.
• Regular dependency scanning and security updates.
• Third-party tokens (for example Xero, Meta or Shopify connections) stored encrypted and used only for the connections you authorise.

• Access to production data is limited to those who need it to operate the service.
• Third-party providers process data on our behalf under contract and may not use it for their own purposes.
• AI providers are chosen on the basis that they do not train their general models on your data.

Depending on where you live, you may have the right to access, correct, delete, restrict or object to the processing of your personal data, and to receive it in a portable format.

• Access and portability · request a copy of your data at any time.
• Correction · most details can be updated in your account settings; contact us for anything else.
• Deletion · see our data deletion page for how to request removal of your data.
• Cookies · manage your preferences through the cookie banner or your browser settings, as described in our Cookie Policy.

We keep your data for as long as your account is active, or as long as needed to provide the service and meet legal obligations. When you close your account we begin deleting your data within a reasonable period, except where retention is required for legal or security reasons.

If you believe your data has been mishandled, or you discover a security issue, contact us straight away at privacy@thekbigroup.com. We investigate every report and will respond within the time required by applicable law. You may also have the right to raise a concern with your local data protection authority.