Your data, plainly.

What we collect

Account data: your email address and workspace name, used for sign-in (magic links), product notifications you can act on (a paused project, a question the PM needs answered), billing receipts, and periodic progress digests about your projects, which you can unsubscribe from.

Connected credentials: the GitHub App installation you authorize; the AI coding-engine credentials you connect for Claude Code, Codex, GLM, Kimi, Grok, or DeepSeek, including supported subscription logins and API keys; and credentials for optional integrations you choose to connect, such as Granola, Roblox Open Cloud, fal.ai, CircleCI, and Sentry. They are encrypted at rest under independent, rotatable keys and are deleted when you revoke them. The OpenRouter coding-engine route remains limited to Keelen's own test and benchmark projects and is not enabled for customer repositories.

Operational data: project configuration, iteration logs (automatically scrubbed of secrets), pull-request metadata, and timeline metrics such as run duration and token counts. This is the data that powers your dashboard.

Billing data: payments are processed by Stripe. We store your Stripe customer and subscription identifiers — never card numbers.

Your code

Your repository content lives in your GitHub account. During a run it is cloned into an isolated single-use virtual machine that is destroyed when the run ends — no persistent volume. We keep iteration logs and diffs' metadata so you can audit what the loop did; we do not keep a copy of your repository.

We do not train machine-learning models on your code. Your coding-engine usage flows directly to the provider whose credential you connected, under that provider's terms.

We can capture iteration trajectories: the prompts we send, the diffs the loop produced, and the tool calls it made during a run. We use them for one purpose, to improve the loop itself (its scheduling decisions and the quality of the rules it writes). Trajectory capture is off unless your workspace owner turns it on in Settings. Accepting our terms or this policy does not turn it on. You can turn it off at any time, and capture stops for every project in that workspace. Trajectories captured before October 10, 2026, when capture was on by default, are not used to improve the loop unless that workspace's owner turns capture on.

We never sell trajectory data, and we never share one customer's trajectories with another customer.

What we never do

We do not sell your data. We do not share it with advertisers. We do not read your repositories outside of the runs you configure. We do not use your credentials for anything except operating the loop you turned on.

Third parties we rely on

We rely on a small set of subprocessors for source hosting, AI model access, documentation lookup during runs, payments, compute, storage, email, and error monitoring. Each one receives only what its function requires. The hosted-chat processors are OpenRouter, which routes a request to an admitted inference provider, and DeepInfra, which runs the inference.

Hosted chat

Hosted chat is optional. When it is enabled and your workspace owner allows model processing, Keelen pays for chat inference through OpenRouter and DeepInfra. We send a bounded portion of the conversation and relevant project context. This may include integration material you include in the conversation. Hosted chat is separate from coding runs that use your connected engine credentials.

Your workspace owner can choose deterministic-only chat. In that mode, chat content is not sent to the hosted chat model, including for summaries or evaluation. Submitting coding work can still use your separately configured coding engine. Turning model processing off stops new calls and attempts to cancel calls already in progress; data already transmitted cannot be recalled.

Hosted chat inference is restricted to routes admitted under US inference-location and zero-data-retention requirements. It stays unavailable without that evidence, and we do not promise a specific route in advance.

Retention and deletion

We keep your iteration history while your workspace is active, and we delete it when you delete your workspace. Your plan sets how far back the dashboard shows that history. That is a display limit, not a deletion schedule.

Some records are swept on a fixed timer today: audit-log entries after 90 days, scheduler decision records after 45 days, QA evidence artifacts after 14 days, and design-review artifacts after 14 days.

Revoking a credential deletes it immediately. Deleting a project soft-deletes its records. Deleting your account removes your personal data from live systems within 30 days, with two carve-outs: we keep billing records for as long as tax and legal duties require, and we keep aggregate product analytics with the identifiers removed.

Chat history expires after 90 days. Deleting a conversation removes its chat text and derived copies. It does not cancel submitted work or delete the submitted Request and required domain records. Minimal action receipts may remain separately. Keelen does not provide a separate long-term chat memory store.

To exercise access, correction, or deletion rights, email privacy@keelen.ai from your account address.

Cookies, analytics, and error monitoring

We use a session cookie to keep you signed in and first-party product analytics (page views and feature events) to improve the product.

Your browser also stores three first-party identifiers, and they are set on your first visit, before you sign up: keelen_anon_id in localStorage (a persistent pseudonymous device id), keelen_acq in localStorage (the first UTM parameters and referrer we saw), and a session id in sessionStorage.

We use the Sentry browser SDK for error monitoring. It sends exception reports through a tunnel on our own origin, so it is first-party traffic. We configure it to send no personal data by default, to sample 10 percent of performance traces, and to record no session replay.

There are no third-party advertising trackers and no session replay anywhere on the site.

keelen.ai does not respond differently to browser Do Not Track signals. We do not let third parties collect information about your activity on keelen.ai to track you across other sites.

The booking calendar on /first-pr/ is provided by Cal.com, which receives what you enter to book.

Changes

If this policy changes in substance, we will notify account holders by email before the change takes effect.

Revision of 2026-11-11 (previous effective date 2026-10-03): we corrected who operates keelen.ai, made trajectory capture off unless a workspace owner turns it on, named DeepSeek and the optional integrations you can connect, described progress digests, documentation lookup and our Do Not Track practice, and added our mailing address.

Revision of 2026-10-03 (previous effective date 2026-09-11): we added the optional hosted-chat disclosure, the workspace owner's model-processing choice, and the chat retention and deletion terms. The coding-engine disclosures are otherwise unchanged.