Privacy Policy

KeenDraft is operated by KeenDraft Technologies Inc., a Canadian company. References to "we", "us", and "our" mean KeenDraft Technologies Inc.

Our Privacy Officer is responsible for the protection of personal information, including access and correction requests, complaints, confidentiality-incident handling, and privacy impact assessments. You can reach the role at privacy@keendraft.com (addressed to "Privacy Officer, KeenDraft Technologies Inc.").

When you create a sender account we collect your email address, name (optional), organization name, and the IP address you signed up from. We also collect the metadata of every envelope you send: the original PDF, recipient email and name, field positions, your custom message, and any password hash.

When you sign as a recipient we collect your name, your email address as supplied by the sender, your signature (typed, drawn, or uploaded image), your IP, your user agent, and the timestamp of every event we record. We do not collect any biometric or device identifiers beyond the user agent string.

We use first-party product analytics (PostHog), which only runs after you accept analytics cookies in our banner — see our Cookie Policy. We also record a small set of PII-free operational events server-side (e.g. a link was published, an envelope was sent) keyed to your account or organization id, never your name or email. We do not run third-party advertising or tracking pixels.

We use the personal information you provide to: deliver the signing service, authenticate magic links, send transactional email (invitations, completions, reminders, expiry notices), generate the tamper-evident audit trail that lives inside the signed PDF, and operate billing through Stripe.

We do not sell your data. We do not use signed documents to train AI models. We do not share envelope contents with third parties except as required to provide the service (see "Sub-processors" below).

We rely on the following providers to operate KeenDraft:

• Supabase — Postgres database, authentication, and object storage for PDFs. Data is stored in the region we configured at signup.
• Vercel — application hosting and CDN.
• Brevo — transactional email delivery (invites, completions, reminders, expiry notices).
• Stripe — payments, billing, and invoices. Your card details never touch our servers.
• Upstash QStash — scheduled reminder + expiry sweeps. Passes envelope and recipient IDs only — no document contents.
• Sentry — application error monitoring.
• PostHog — consented product analytics (only fires after you accept analytics cookies).

The canonical, regularly-updated list — including each provider's purpose, the data shared, region, and DPA link — lives at /legal/subprocessors. We post new sub-processors there at least 30 days before activation.

We retain signed envelopes and their audit trails for the lifetime of your account. If you close your account we keep the completed signed PDFs and audit trails for the period required by applicable law (typically seven years for contracts) and then delete them. Draft envelopes and unfilled fields are deleted within 30 days of account closure.

When a retention period ends, or when we no longer need the information for the purpose it was collected, we securely and permanently delete it (or de-identify it). An internal retention-and-destruction schedule governs how long each category of personal information is kept and how it is destroyed.

You can request export or deletion of your personal data by emailing privacy@keendraft.com. We respond within 30 days.

Depending on where you live you may have the right to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to lodge a complaint with a regulator. Specific rights vary by jurisdiction (e.g. PIPEDA in Canada, Quebec Law 25, GDPR in the EU). To exercise these rights contact us at the email above. We respond to access, correction, and portability requests within 30 days.

If you have a privacy concern or complaint, email our Privacy Officer at privacy@keendraft.com and we'll acknowledge and respond within 30 days. If you live in Quebec and are not satisfied with our response, you may file a complaint with the Commission d'accès à l'information du Québec (CAI). Residents of other regions may contact their applicable privacy regulator.

KeenDraft is not directed to children under 13 and we do not knowingly collect their personal information.

We'll update the "Last updated" date when we change this policy and email account owners about material changes.

Privacy questions: privacy@keendraft.com.