Privacy Policy

Last updated: April 20, 2026

This Privacy Policy explains how Vincent Lebrun (sole trader trading as Synnervate), SIRET 889 664 488 00034, registered office at 4 allée Catherine Sauvage, 35136 Saint-Jacques-de-la-Lande, France ("we", "us", "our"), collects, uses, stores, and protects personal data when you use the Keptly application ("Keptly", "the App") or visit getkeptly.com.

1. Who we are

We are the data controller for personal data collected through the Keptly website (getkeptly.com).

For personal data processed within the App on behalf of a Shopify merchant (i.e. their customers' data), the merchant is the data controller and Keptly acts as a data processor in accordance with Article 28 GDPR.

Contact: hello@getkeptly.com

2. What data we collect

2.1 From Shopify merchants (App users)

Shop domain, Shopify store ID, shop email
Shop metadata: currency, language, country, timezone, plan
Encrypted Shopify OAuth access token
App usage data (pages visited, actions performed)
Settings and preferences (alert day, health score thresholds, integrations)

2.2 From the merchant's customers (on behalf of the merchant)

Customer ID (Shopify)
First name, last name, email
Order history: order IDs, totals, currency, dates, sales channel
Computed metrics: health score, RFM segment, customer lifetime value, days since last order

2.3 From website visitors (getkeptly.com)

IP address, browser, device, referrer (via Google Analytics)
Interactions (page views, clicks)
Email address if you join the waitlist

3. How we collect data

Automatically via the Shopify API (when a merchant installs the App)
Via webhooks (order updates, customer updates)
Via cookies and analytics on the website
Directly from you (when filling a form, emailing us)

4. Why we process this data (legal bases)

Purpose	Legal basis
Providing the App's core functionality	Performance of a contract (Art. 6(1)(b) GDPR)
Calculating customer health scores, sending alerts	Legitimate interest of the merchant (Art. 6(1)(f))
Billing and payment processing (via Shopify)	Performance of a contract
Responding to support requests	Legitimate interest
Analytics and service improvement	Legitimate interest + consent where required
Marketing (waitlist, emails)	Consent (Art. 6(1)(a))
Legal and tax compliance	Legal obligation (Art. 6(1)(c))

5. Who we share data with (sub-processors)

We rely on the following third-party service providers to operate Keptly:

Sub-processor	Purpose	Location
Shopify Inc.	Authentication, billing, store data API	Canada / USA
Railway	Application hosting and PostgreSQL database	USA
Resend	Transactional and digest emails	USA
Klaviyo	Customer data sync (optional, merchant-enabled)	USA
Slack Technologies	Digest notifications (optional, merchant-enabled)	USA
Cloudflare	DNS, CDN, security	Global
Lovable	Landing page hosting (getkeptly.com)	USA
Sentry	Error monitoring and debugging	USA
Google Analytics	Website analytics (getkeptly.com only)	USA / EU

We do not sell your personal data. We do not share data with third parties for their own marketing purposes.

6. International data transfers

Some sub-processors are located outside the European Economic Area (EEA), primarily in the United States. Such transfers are covered by:

Standard Contractual Clauses (SCCs) approved by the European Commission
Adequacy decisions where applicable (e.g., the EU-US Data Privacy Framework)
Provider-specific safeguards (encryption in transit and at rest)

7. How long we keep data

Data category	Retention period
Shop and customer data (in-App)	For the duration of the App installation
Upon app uninstallation	Deleted immediately (cascade deletion of all related data)
Customer redaction requests (GDPR Art. 17)	Deleted immediately upon webhook receipt
Billing records (via Shopify)	Retained by Shopify per their own policy
Support emails	3 years after last contact
Website analytics data (Google Analytics)	14 months
Waitlist emails	Until you unsubscribe or 3 years of inactivity

8. Your rights

Under the GDPR and French Data Protection Act, you have the right to:

Access the personal data we hold about you
Rectify inaccurate or incomplete data
Erase your data ("right to be forgotten")
Restrict processing
Object to processing based on legitimate interests
Portability (receive your data in a structured, machine-readable format)
Withdraw consent at any time (where processing is based on consent)
Lodge a complaint with the CNIL (French data protection authority — www.cnil.fr)

To exercise these rights, email hello@getkeptly.com. We will respond within one (1) month.

9. Cookies and analytics

9.1 Landing page (getkeptly.com)

We use Google Analytics to understand how visitors use our website. This sets cookies on your browser. You can opt out using your browser settings or ad-blockers.

9.2 Within the App

We use only strictly necessary session cookies to maintain your authenticated session with Shopify. No marketing or tracking cookies are set within the App.

10. Security

We implement industry-standard security measures, including:

AES-256-GCM encryption of Shopify access tokens at rest
HTTPS/TLS encryption in transit
HMAC-SHA256 verification of all Shopify webhooks
Rate limiting and abuse prevention
Regular dependency and security updates
Access logs and error monitoring via Sentry

11. Children's privacy

Keptly is not intended for persons under the age of 16. We do not knowingly collect personal data from children. If you believe we have, contact us and we will delete it promptly.

12. Changes to this policy

We may update this Privacy Policy. Material changes will be notified to active App users by email or in-App notice. The "Last updated" date at the top indicates the latest revision.

13. Contact

For any privacy question or to exercise your rights:

Vincent Lebrun — Synnervate
4 allée Catherine Sauvage, 35136 Saint-Jacques-de-la-Lande, France
Email: hello@getkeptly.com