Privacy Notice

This notice covers the public Digital Keep website, contact requests and early-access waitlist. The invitation-only beta has a separate data policy.

Who is responsible and how to reach us

Digital Keep determines how information submitted through this website and waitlist is used. For privacy questions, access, correction, export, objection or deletion requests, email contact@digital-keep.com. You can also remove a waitlist entry with the unsubscribe link in any waitlist email. For test accounts and content in the private beta, read the beta data policy.

Information we collect

For the first-user beta campaign we record invitation codes, their source, email-bound claims and setup milestones (verified account, tutorial, first item and first person). We do not copy item titles, bodies, files or contact details into growth analytics. Only the primary administrator can inspect the campaign dashboard. A referrer sees counts, never your identity.

With your separate optional measurement choice, a random browser identifier links visits and calls to action to the original acquisition source. Anonymous visitor records expire after 90 days; campaign event records, unclaimed waitlist attribution, research and abandonment responses expire after 180 days. Account milestones follow the beta account retention policy. Original source labels persist with the campaign account until deletion. Only the referring origin is retained, not its full URL or query.

Trust and pricing feedback is a deliberate submission encrypted separately from the vault. Interview participation is optional. Optional setup and feedback emails require a separate checkbox and can be stopped in the workspace. Invitation, verification and security emails remain necessary to deliver requested account access. Verified export and deletion requests include campaign information.

• your email address and optional first name;
• the time you joined and the version of the consent wording;
• source, campaign, medium, content and search-term parameters when they are present in the link you followed;
• the referring page reported by your browser;
• confirmation-email delivery identifiers, timestamps, attempt counts and a generic failure category;
• a keyed hash derived from your IP address for short-term abuse prevention. The waitlist database does not store your raw IP address.
• the contents of messages you choose to send us and the information needed to respond to them.

We receive the email, name and consent choice directly from you. Campaign and referrer information comes from the page URL and your browser when you submit the form.

Why we use it and our legal bases

We rely on your consent to save your place and send the confirmation, early-access availability, meaningful product updates and closely related feedback invitations. You can withdraw that consent at any time without affecting processing that occurred before withdrawal.

We rely on legitimate interests to secure the form, prevent abuse, diagnose delivery failures, maintain minimal operational records and understand which campaigns led to a voluntary signup. We also use this basis to reply to enquiries and security reports. Those interests are limited to operating and improving the service and do not involve advertising profiles, sale of data or tracking across websites.

Is providing the information required?

Joining is voluntary. An email address and consent are required because the waitlist cannot operate without them. Your first name is optional. Refusing to join does not restrict access to the public website.

Service providers and recipients

• Vercel hosts and delivers the website;
• Cloudflare stores waitlist records in a dedicated D1 database;
• Cloudflare receives incoming Digital Keep email and stores the correspondence and attachments in a private mailbox using separate D1 and R2 resources in the EU;
• Resend sends confirmations, agreed waitlist messages and email replies;
• professional advisers or competent authorities may receive limited information when legally necessary.

These providers process data under their own security and contractual controls. We do not sell, rent or disclose the waitlist for unrelated advertising.

International processing

Infrastructure providers may process information outside your country or the European Economic Area. Where data-protection law requires it, such processing must rely on an adequacy decision, approved contractual safeguards or another lawful transfer mechanism. You may ask us for information about the safeguard relevant to your data.

How long we keep it

An active waitlist entry is kept for no more than 24 months from signup unless you renew your consent, request earlier deletion or a legal obligation requires a limited extension. A daily retention task removes entries that pass this period.

When you use the unsubscribe link, the waitlist row is removed. A keyed, non-reversible hash of the email may be retained for up to 36 months as a minimal record that the withdrawal was processed. Expired rate-limit records are deleted automatically; they normally remain for no more than about 25 hours.

The private mailbox automatically removes messages and attachments more than 365 days after receipt or sending. We may delete them earlier when they are no longer needed or in response to an eligible request. Correspondence needed for a specific security or legal obligation may be exported and retained separately for that purpose. Hosting and email providers may retain operational records under their own applicable retention schedules.

Your rights

Subject to applicable law, you may ask us to:

• confirm whether we process your data and provide access to it;
• correct incomplete or inaccurate information;
• delete your information;
• restrict or object to certain processing;
• provide eligible information in a portable format;
• withdraw consent at any time.

Every waitlist email includes an unsubscribe link that removes the entry without requiring an account. You can also email contact@digital-keep.com. We may ask for limited information to verify that a request concerns your address. We aim to respond without undue delay and within one month where the GDPR applies.

Complaints

You may complain to the data-protection authority where you live, work or believe an infringement occurred. If Romania is the relevant authority, this is the National Supervisory Authority for Personal Data Processing (ANSPDCP). We invite you to contact us first so we can try to resolve the concern, but doing so does not limit your right to complain.

Cookies and analytics

Public pages do not use analytics or advertising cookies or a tracking vendor. The restricted administration area uses a necessary sign-in cookie. See the Cookie Notice for details.

Automated decisions

We do not use waitlist data for automated decisions or profiling that produces legal or similarly significant effects.

Security

Database and email credentials remain on the server, requests are size and rate limited, raw IP addresses are not stored in the waitlist database, and access to provider accounts is restricted. The private mailbox is restricted to the primary administrator with two-factor authentication. No internet service can promise absolute security. Do not submit passwords, recovery phrases, private keys, identity documents or vault contents through the waitlist or ordinary email.

Children

The early-access waitlist is intended for adults aged 18 or over. We do not knowingly invite children to join. Contact us if you believe a child supplied information so it can be reviewed and removed.

Changes to this notice

We will update the date and version above when this notice changes. Invitation-only platform data is described in the beta data policy.We will publish updated information before launching a production vault service or taking payments.