Privacy policy

Keanan is built on the idea that companies should own their data. This policy explains what personal data we process, why, and which rights you have. It covers two things: this website, and the Keanan platform when we host it for a customer.

Who is responsible

Samuel Ssekizinvu, operating Keanan from Kampala, Uganda (see the imprint for the full address), is the controller for this website. For any privacy matter, write to privacy@keanan.app.

This website

No cookies, no trackers

This website sets no cookies, runs no analytics and loads no resources from third party servers. Fonts are served from our own domain. There is nothing to consent to, which is why you saw no banner.

Server logs

The site is delivered by Netlify, our hosting provider. Netlify processes technical access data such as IP addresses in server logs for a short period to operate and secure the service. The legal basis is our legitimate interest in serving a secure and functional website (Art. 6 (1) f GDPR).

When you email us

If you contact one of our addresses, we process your email address and the content of your message to respond. The legal basis is our legitimate interest in handling your request, or steps prior to entering a contract if you are asking about our services (Art. 6 (1) b and f GDPR). We keep correspondence only as long as needed and as required by statutory retention duties.

When you buy from us

Purchases and subscriptions are processed by Whop, our merchant of record. Checkout happens on Whop’s platform under Whop’s privacy policy; Whop handles payment data and applicable taxes. We receive confirmation of the purchase and the subscription status, never your card details.

The Keanan platform, hosted by us

When a company uses our cloud plan, that company is the controller for the employee data inside its workspace. We process that data only as a processor, on the company’s instructions, under a data processing agreement.

What the platform stores

• Account and profile data such as names, addresses and photos
• Contract and compensation records, invoices and payslips
• Paid time off balances and requests
• Expense receipts and reimbursement records
• Meeting schedules and uploaded slides
• Support tickets and notifications
• An audit trail of administrative actions

Where it lives

Hosted workspaces run on Amazon Web Services in the European Union (Frankfurt region). Transactional email is delivered through Resend. The current list of subprocessors is part of the data processing agreement.

Access from outside the EU

Keanan operates from Uganda. Workspace data stays hosted in the EU, and administrative access from outside the EU is limited, authenticated and logged. Where the GDPR requires safeguards for such access, we enter into the EU standard contractual clauses with our customers as part of the data processing agreement.

How long we keep it

Workspace data is kept for the duration of the contract. Every workspace can be exported in full at any time from the admin dashboard. After termination, we delete the workspace within 30 days, once the customer has had the opportunity to export it.

Self hosted deployments

If a company runs Keanan on its own infrastructure, we host nothing and process no personal data from that deployment. The operating company is fully responsible for its installation.

Your rights

Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to lodge a complaint with a supervisory authority. If your data is in a customer’s workspace, please direct requests to that company first; we support our customers in answering them. For anything else, write to privacy@keanan.app.

Security

Connections are encrypted in transit. Access to hosted systems is restricted, authenticated and logged. The platform supports two factor authentication and records administrative actions in an audit trail. Our security page describes our practices in more detail.

Changes

We will update this policy when our practices or legal requirements change, and the date above will always tell you when we last did.