Who is responsible for the data
Guilherme Perotta, an individual operating as KeepMPosted, operates the platform and is responsible for account, website, billing-reference, support, and service-security data. A business using KeepMPosted decides which customer updates to send and is responsible for its subscriber relationships and message content. For that subscriber data, the business is the controller or business and KeepMPosted acts as its service provider or processor.
KeepMPosted is not a separate incorporated entity. Our legal business and mailing address is 225 Railway Street E., Cochrane, AB T4C 2C3, Canada. Privacy requests can be sent to privacy@keepmposted.com. Guilherme Perotta is the operator and privacy contact responsible for inquiries, complaints, and questions about our service providers.
Information we collect
- Account information, including Firebase user ID, name, email, profile image, country, authentication provider, email-verification status, and acceptance of the current legal terms.
- Organization information, including business name, country, physical mailing address, reply-to email, team role, delivery settings, credit balance, and purchase records.
- Subscriber information, including email address or Telegram chat ID, channel metadata, consent and unsubscribe status, and the organization selected by the subscriber.
- Message and delivery information, including subject, content, recipient channel, timestamps, provider identifiers, delivery outcome, credits charged, and the first reported email open. Business emails use a tracking image provided by Postmark. When that image loads, we record the associated subscription and time and show that activity to the sending organization. Email privacy tools can load images automatically or block them, so a reported open does not prove someone read the message. Telegram read receipts are not available to us.
- Technical and support information, including IP address, request ID, browser and device details, pages visited, diagnostic logs, and feedback submitted to us.
Stripe handles complete payment-card details. KeepMPosted receives Checkout session, product, amount, payment status, and customer reference information, but does not store full card numbers.
How we use information
- Provide accounts, subscriptions, messaging, and billing.
- Verify consent and process unsubscribe requests.
- Deliver email and Telegram messages and report outcomes.
- Secure, troubleshoot, monitor, and improve the service.
- Answer support requests and communicate service changes.
- Meet legal, tax, fraud-prevention, and compliance obligations.
Depending on location and context, we rely on performance of a contract, consent, compliance with legal obligations, and legitimate interests such as service security and support. Subscribers can withdraw consent at any time by using the unsubscribe link in an email or the Telegram bot commands.
Service providers and disclosures
We disclose only the information needed to providers that operate the service, including Google Firebase for authentication and hosting, DigitalOcean for our application server and database, Stripe for payments, Postmark for email, Telegram for bot delivery, and infrastructure, backup, security, and support providers. We may also disclose information when required by law, to protect people or the service, or as part of a business transfer with appropriate safeguards.
Our application server and primary database are hosted on a DigitalOcean VPS in Toronto, Canada. The database contains account, organization, subscriber, message, consent, and billing-reference records needed to operate the service. This hosting location does not mean that all information handled by our other service providers remains in Canada.
We do not sell personal information and do not share it for cross-context behavioral advertising. Analytics is disabled by default and is not activated without a separate consent choice.
If you allow analytics, Google Analytics measures page visits, campaign sources, signup and setup steps, and credit purchases. It uses a browser identifier and technical information such as device and approximate location. We do not send email addresses, subscriber lists, message content, or password-reset links to analytics. Advertising personalization is disabled.
You can decline or withdraw consent using “Analytics preferences” in Settings or the footer of our public pages. Withdrawal stops future collection and removes queued analytics; it does not automatically erase information already sent to Google. Your choice lasts up to 180 days; consented campaign attribution lasts 30 days. Checkout analytics links are removed within 3 days, and local event status records within 30 days. Purchase and consent records needed to operate the service follow our separate retention rules below, regardless of your analytics choice.
International transfers
Providers may process information in countries other than the one where it was collected. Where required, we use contractual and organizational safeguards intended to protect transferred personal information.
Retention
- Account, organization, subscriber, and message records are kept while the account is active and then removed or de-identified after a verified deletion request, subject to legal obligations.
- Unsubscribe records may be retained as a suppression record so a person is not added back without fresh consent.
- Unconfirmed business subscription links expire after 24 hours.
- Live demo sessions and their email or Telegram subscriptions expire 30 minutes after the demo starts. Expired demo records are removed by our cleanup worker and on subsequent demo requests. We retain keyed rate-limit identifiers for up to 24 hours to prevent abuse. Expiry does not remove messages already delivered to your inbox or chat, or copies held by delivery providers and protected backups.
- Required billing and accounting records are generally retained for six years after the end of the relevant tax year, or longer where a legal obligation or unresolved dispute requires it.
- Operational backups rotate on short-term, daily, and weekly schedules. Weekly recovery copies are retained for approximately 90 days. Deleted data may remain in protected backups until those copies expire.
Security
We use access controls, verified identity tokens, encrypted network transport, scoped provider credentials, audit records, rate limits, backups, and software-dependency review. No system can guarantee absolute security. Contact us promptly if you believe information has been exposed.
Your choices and rights
Depending on where you live, you may have rights to know, access, correct, delete, restrict, object to, or receive a portable copy of personal information, and to withdraw consent. You may also appeal a decision or complain to your local data-protection authority. We do not discriminate against people for exercising privacy rights.
Email privacy@keepmposted.com to make a request. We may verify identity and authority before responding, using only information reasonably needed for verification. We aim to complete verified deletion requests within 30 days and comply with applicable legal deadlines. If an exception or lawful extension applies, we explain the reason and expected next steps. Necessary billing and suppression records may be retained as described above. Subscribers should also contact the business whose updates they selected when the request concerns that business's subscriber list or message content.
Children
KeepMPosted is a business service and is not directed to children under 18. Do not create an account or submit a child's information without a lawful basis and any required parental authorization.
Changes and contact
We will post material policy changes here and update the effective date. Questions can be sent to privacy@keepmposted.com or support@keepmposted.com.