Privacy Policy

1. Introduction

Keeal, Inc., a Delaware corporation, and Keeal UK Ltd (for users in the United Kingdom) operate the Keeal platform. Depending on where you are located, one of these entities acts as the data controller for your personal information. References to "we," "us," or "our" mean the Keeal legal entity that provides the Service to you (Keeal UK Ltd in the United Kingdom, or Keeal, Inc. elsewhere), unless the context requires otherwise. "Keeal" as a brand name refers to the Service; it does not by itself mean Microxen Inc.. The Keeal product/platform in the United States is built and supported with technology from Microxen Inc. (https://microxen.com). Microxen Inc. is a technology partner only: it is not the party you contract with under these Terms, it is not the merchant of record for customer payments, and customer card statements / Keeal-issued invoices identify Keeal (via Keeal, Inc.), not Microxen Inc..We are committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, disclose, store, and safeguard your information when you access or use the Keeal platform, website (keeal.com), mobile applications, APIs, and all related services (collectively, the "Service").

If you are located in the United Kingdom, you contract with Keeal UK Ltd. Otherwise, you contract with Keeal, Inc., a Delaware corporation.

As a payments platform and merchant of record, we are required to collect and process certain personal and financial information to comply with federal and state regulations, including anti-money laundering (AML) laws, Know Your Customer (KYC) requirements, and tax reporting obligations.

By accessing or using the Service, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree, please do not use the Service. This Privacy Policy is incorporated into and forms part of our Terms of Service.

2. Information We Collect

We collect various types of information depending on how you interact with our Service, the type of account you hold, and the features you use.

2.1 Information You Provide Directly

Account Registration

• Full legal name (first and last name)
• Email address
• Phone number
• Password (stored in hashed form)
• Business name and type (sole proprietorship, LLC, corporation, etc.)
• Business address and country of operation

Identity Verification (KYC)

• Government-issued photo identification (driver's license, passport, national ID)
• Date of birth
• Social Security Number (SSN) or Employer Identification Number (EIN) for U.S. users
• Tax identification numbers for international users
• Proof of address documents (utility bill, bank statement)
• Selfie or live photo for identity matching
• Business registration documents, articles of incorporation, or licenses
• Beneficial ownership information

Financial Information

• Bank account details (routing number, account number) for payouts
• Debit card information for instant payouts
• Payment card details provided by your clients (processed by Stripe; we do not store full card numbers)
• Transaction history and payment records
• Invoice data (amounts, descriptions, client details)

Communications

• Support tickets and chat messages
• Email correspondence with our team
• Feedback, survey responses, and reviews
• Any other information you voluntarily provide to us

2.2 Information Collected Automatically

When you access or use the Service, we automatically collect:

• Device Information: Device type, model, operating system and version, unique device identifiers, screen resolution, and hardware settings.
• Network Information: IP address, internet service provider (ISP), connection type (Wi-Fi, cellular), and approximate geographic location derived from your IP address.
• Browser Information: Browser type and version, language preferences, time zone, and installed plugins.
• Usage Data: Pages viewed, features used, links clicked, time spent on pages, referring and exit URLs, date and time of access, and interaction patterns.
• Log Data: Server logs including access times, error reports, and system activity.

2.3 Information from Third Parties

• Payment Processors (Stripe): Transaction results, payment method details, fraud signals, and risk assessments.
• Identity Verification Providers: Verification results, watchlist screening results, and document authenticity assessments.
• Credit Reporting Agencies: Credit checks or financial background information where permitted.
• Public Databases: Sanctions lists, politically exposed persons (PEP) databases, and adverse media.
• Banking Partners: Account verification results and ACH transaction status.

3. Legal Basis for Processing

We process your personal information based on the following legal grounds:

• Contractual Necessity: Processing is necessary to perform our contract with you (providing the Service, processing payments, settling funds).
• Legal Obligation: Processing is required to comply with applicable laws, including KYC/AML regulations, tax reporting requirements (IRS Form 1099-K), and financial services regulations.
• Legitimate Interest: Processing is necessary for our legitimate business interests, such as fraud prevention, security, analytics, product improvement, and marketing (where not overridden by your rights).
• Consent: Where required by law, we obtain your explicit consent before processing (e.g., certain marketing communications, optional cookies). You may withdraw consent at any time.

4. How We Use Your Information

4.1 Core Service Operations

• Create and manage your account.
• Process payments, invoices, and settlements.
• Facilitate fund disbursements to your bank account.
• Send transactional emails (payment confirmations, invoice notifications, settlement summaries).
• Provide customer support and respond to your inquiries.

4.2 Compliance & Risk Management

• Verify your identity and conduct KYC checks.
• Screen against sanctions lists, PEP databases, and watchlists.
• Monitor transactions for suspicious or fraudulent activity (AML monitoring).
• Comply with tax reporting obligations (e.g., IRS 1099-K filings).
• Respond to subpoenas, court orders, or lawful requests from government agencies.
• Enforce our Terms of Service and prevent abuse of the platform.

4.3 Security & Fraud Prevention

• Detect and prevent unauthorized access to your account.
• Identify and block fraudulent transactions.
• Monitor for security threats and vulnerabilities.
• Investigate and resolve chargebacks and disputes.

4.4 Improvement & Analytics

• Analyze usage patterns to improve our Service.
• Conduct research and develop new features.
• Generate aggregated, de-identified statistics about platform usage.
• Test and optimize user experience.

4.5 Communications

• Send service-related notices (security alerts, account updates, policy changes).
• Send marketing communications (with your consent, where required by law).
• Notify you about new features, promotions, or updates.

5. Information Sharing & Disclosure

We do not sell your personal information. We share your information only in the following circumstances:

5.1 Service Providers & Partners

We share information with trusted third parties who perform services on our behalf, including:

• Payment Processing: Stripe (for card processing, payouts, and connected accounts).
• Identity Verification: Stripe Identity or equivalent KYC providers.
• Cloud Infrastructure: Hosting and data storage providers (e.g., Cloudflare, AWS).
• Email Delivery: Transactional email services (e.g., Resend, SendGrid).
• Analytics: Usage analytics providers to understand how the Service is used.
• Banking Partners: For ACH transfers and bank account verification.

All service providers are contractually obligated to protect your information and use it only for the specific purposes for which it was shared.

5.2 Referral program

If you use Keeal's referral program, we attribute sign-ups to your referral code and show you progress in the dashboard. For privacy, referred users are displayed with masked names and email addresses (for example, "A*** R." and "a***@example.com") rather than full identity. Referees are not given your full profile beyond what the program requires.

5.3 Legal & Regulatory Requirements

We may disclose your information when we believe in good faith that disclosure is necessary to:

• Comply with applicable law, regulation, legal process, or governmental request.
• Respond to subpoenas, court orders, or lawful requests by public authorities.
• File Suspicious Activity Reports (SARs) with the Financial Crimes Enforcement Network (FinCEN).
• Report transactions to the IRS or other tax authorities as required by law.
• Enforce our Terms of Service or other agreements.
• Protect the rights, property, or safety of Keeal, our users, or the public.
• Investigate potential violations of law or our policies.

5.3 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, asset sale, or similar transaction, your information may be transferred to the acquiring entity. We will notify you via email and/or a prominent notice on our website of any change in ownership or use of your personal information, as well as any choices you may have.

5.4 Between Transacting Parties

When you send or receive a payment through Keeal, certain information (such as your name, business name, email address, and transaction details) may be shared with the other party to the transaction as necessary to facilitate the payment.

5.5 With Your Consent

We may share your information for other purposes with your explicit consent.

6. Payment Data & PCI Compliance

Protecting payment card data is a top priority. We adhere to PCI DSS (Payment Card Industry Data Security Standard) requirements through our certified payment processor and follow these practices:

• Full credit/debit card numbers are never stored on our servers. All card data is processed directly by our PCI Level 1-certified payment processor (Stripe).
• We only store tokenized references to payment methods, not the actual card details.
• Bank account information (routing and account numbers) is encrypted at rest and in transit using AES-256 encryption.
• All data transmission between your browser and our servers is protected with TLS 1.2 or higher.
• Access to payment data is strictly limited to authorized personnel on a need-to-know basis.

For more information about how Stripe handles your payment data, please review Stripe's Privacy Policy.

7. Data Security

We implement comprehensive technical and organizational security measures to protect your personal information, including:

Technical Safeguards

• AES-256 encryption for data at rest.
• TLS 1.2+ encryption for data in transit.
• Secure hashing (bcrypt/argon2) for passwords.
• Web Application Firewall (WAF) and DDoS protection.
• Regular vulnerability scanning and penetration testing.
• Automated security monitoring and alerting.
• Database encryption and access logging.

Organizational Safeguards

• Role-based access controls (least-privilege principle).
• Multi-factor authentication (MFA) for employee access to sensitive systems.
• Employee background checks and security training.
• Incident response plan and breach notification procedures.
• Regular security audits and compliance reviews.
• Vendor security assessments for third-party providers.

While we strive to use commercially acceptable means to protect your personal information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

8. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. Specific retention periods include:

• Account Data: Retained for the duration of your account and for up to 7 years after account closure, as required by financial regulations.
• Transaction Records: Retained for a minimum of 7 years to comply with IRS record-keeping requirements and AML regulations.
• KYC/Identity Documents: Retained for 5 years after the end of the business relationship, as required by the Bank Secrecy Act (BSA) and FinCEN regulations.
• Tax Reporting Data (1099-K): Retained for a minimum of 7 years.
• Communication Records: Support tickets and correspondence are retained for 3 years after resolution.
• Log Data: Server and access logs are retained for up to 1 year.
• Marketing Preferences: Retained until you opt out or request deletion.

When retention periods expire, your data is securely deleted or anonymized. Some information may be retained in backup systems for a limited period before deletion is complete.

9. Cookies & Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience and gather information about how the Service is used.

Types of Cookies We Use

• Essential Cookies: Required for the Service to function (authentication, session management, security). These cannot be disabled.
• Functional Cookies: Remember your preferences and settings (language, theme, layout).
• Analytics Cookies: Help us understand usage patterns (pages visited, time on site, feature usage). We may use tools such as Google Analytics or Plausible.
• Performance Cookies: Monitor Service performance and identify issues.

Managing Cookies

Most web browsers allow you to control cookies through their settings. You can typically set your browser to refuse all cookies or to indicate when a cookie is being sent. However, disabling essential cookies may prevent you from using certain features of the Service.

Do Not Track Signals

Some browsers transmit "Do Not Track" (DNT) signals. There is currently no uniform standard for how companies should respond to DNT signals. At this time, we do not respond to DNT signals, but we respect your right to control your information through the other mechanisms described in this Privacy Policy.

10. Your Privacy Rights

Depending on your location, you may have certain rights regarding your personal information. We are committed to honoring these rights.

10.1 General Rights (All Users)

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete personal information.
• Deletion: Request deletion of your personal information, subject to legal retention requirements.
• Opt-Out: Unsubscribe from marketing communications at any time using the link in any marketing email.
• Account Closure: Request account deletion (subject to outstanding obligations and legal retention requirements).

10.2 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: You have the right to request information about the categories and specific pieces of personal information we have collected, the sources of collection, the purposes of collection, and the categories of third parties with whom we share information.
• Right to Delete: You have the right to request deletion of personal information we have collected, subject to certain exceptions (e.g., legal compliance, completing a transaction).
• Right to Correct: You have the right to request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: We do not sell your personal information. We do not share personal information for cross-context behavioral advertising.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.
• Right to Limit Use of Sensitive Information: You may limit our use of sensitive personal information to what is necessary for the Service.

Categories of Personal Information Collected: Identifiers, financial information, commercial information, internet/electronic activity, geolocation data, professional information, and sensitive personal information (SSN, ID documents).

To exercise your CCPA rights, contact us at privacy@keeal.com or through your account settings. We will verify your identity before processing your request. You may designate an authorized agent to make a request on your behalf.

10.3 European Economic Area (EEA) & UK Residents (GDPR)

If you are located in the EEA or UK, you have additional rights under the General Data Protection Regulation (GDPR):

• Right to Access: Obtain confirmation of whether we process your data and request a copy.
• Right to Rectification: Correct inaccurate or incomplete data.
• Right to Erasure ("Right to Be Forgotten"): Request deletion of your data when it is no longer necessary for the purposes for which it was collected, subject to legal retention requirements.
• Right to Restriction: Request that we restrict processing of your data in certain circumstances.
• Right to Data Portability: Receive your data in a structured, commonly used, machine-readable format and transmit it to another controller.
• Right to Object: Object to processing based on legitimate interests, including direct marketing.
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent.
• Right to Lodge a Complaint: File a complaint with your local data protection supervisory authority.

To exercise your GDPR rights, contact our Data Protection team at dpo@keeal.com. We will respond to your request within 30 days.

10.4 Limitations on Rights

Please note that certain requests may be limited or denied where we have a legal obligation to retain data (e.g., AML record-keeping, tax reporting), where deletion would impair our ability to detect fraud, or where the request is manifestly unfounded or excessive.

11. International Data Transfers

Keeal is based in the United States. If you access the Service from outside the United States, your information will be transferred to, stored in, and processed in the United States and potentially other countries where our service providers operate.

These countries may have data protection laws that are different from the laws of your jurisdiction. By using the Service, you consent to such transfers.

For transfers from the EEA or UK, we rely on appropriate safeguards, including Standard Contractual Clauses (SCCs) approved by the European Commission, adequacy decisions, and other legally recognized mechanisms to ensure your data receives an adequate level of protection.

12. Children's Privacy

The Service is not directed to individuals under the age of 18 (or the age of majority in your jurisdiction). We do not knowingly collect personal information from children under 18.

If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information as promptly as possible. If you believe we have collected information from a child, please contact us immediately at privacy@keeal.com.

13. Third-Party Links & Services

The Service may contain links to third-party websites, services, or applications. This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party service before providing your personal information.

We are not responsible for the privacy practices, content, or security of any third-party websites or services, even if accessible through the Service.

14. Email & Communication Preferences

We may send you the following types of communications:

• Transactional Emails: Payment confirmations, invoice notifications, settlement summaries, security alerts, and account updates. These are essential to the Service and cannot be unsubscribed from while your account is active.
• Service Announcements: Important updates about the Service, policy changes, maintenance windows, and new features.
• Marketing Communications: Promotional offers, newsletters, product announcements, and tips. You can opt out at any time using the "unsubscribe" link in any marketing email.

You can manage your communication preferences in your account settings or by contacting us at support@keeal.com.

15. Data Breach Notification

In the event of a data breach that affects your personal information, we will:

• Notify affected users without undue delay (and within 72 hours where required by GDPR).
• Provide details about the nature of the breach, the categories of data affected, and the measures taken to address the breach.
• Report the breach to relevant supervisory authorities and regulators as required by law.
• Provide recommendations for steps you can take to protect yourself.

16. Automated Decision-Making

We may use automated systems to make decisions that affect you, including:

• Fraud Detection: Automated analysis of transaction patterns to identify and block potentially fraudulent activity.
• Risk Scoring: Automated risk assessments that may affect settlement timing, reserve requirements, or account limits.
• Identity Verification: Automated document verification and facial recognition matching.

If an automated decision significantly affects you, you have the right to request human review. Contact us at support@keeal.com to request a review.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. When we make material changes, we will:

• Update the "Last updated" and "Effective date" at the top of this page.
• Notify you by email at least 30 days before material changes take effect.
• Display a prominent notice within the Service.

Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated Privacy Policy. We encourage you to review this page periodically.

18. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

For CCPA requests, you may also call us toll-free (number available on request). We will respond to all privacy inquiries within 30 days.