Privacy notice

Last updated 13 October 2026

Keepstead tracks property maintenance. This notice covers the personal data it holds, why, who else sees it, and how to get a copy or have it deleted.

Who is responsible

Aero Projects (Malta) Limited is the data controller. Write to hello@keepstead.net about anything on this page, including a request about your data.

What we collect, why, and for how long

Account and sessions

Your name, email address and a hashed password. Each sign-in also stores a session record holding the IP address and browser user-agent it came from.

Why: to create your account and keep you signed in. Legal basis: performance of a contract. Expired sessions are deleted each day. When you change your sign-in address, the old one is kept for 7 days so it can undo the change, then deleted. Your data is kept until you delete your account, or until the account has gone two years without being used, whichever comes first. A paid plan keeps it while the plan runs, and the two years start when the plan ends. We email you 30 days, 14 days and 7 days before deleting an unused account, and signing in stops it. A full export is available in the app the whole time.

Profile picture and second factor

A profile picture, if you add one, is stored privately under your account and shown to the members of the portfolios you share. If you turn on a second factor, its secret and your backup codes are stored encrypted. If you ask to turn the second factor off without it, we keep when you asked, confirmed, and cancelled or finished the request.

Why: to show who did what in a shared portfolio, and to protect your sign-in. Legal basis: performance of a contract. Removing the picture deletes it. Turning the second factor off deletes it too, except that a copy taken when you change your sign-in address is kept for the 7 days that change can be undone, so undoing it puts your sign-in back as it was. Both go with your account.

If you sign in with Google

Google tells us your email address, your name, and an identifier for your Google account. We keep those three and the sign-in tokens that carry them; anything else Google returns is discarded as it arrives. We hold no Google password, contacts, calendar, Drive files, or any other Google data.

Why: to create your account, to recognise you when you come back, and to match you to an account you already had under the same address. Legal basis: performance of a contract. We do not use any of it for advertising, we do not sell or share it, and we transfer none of it to anyone beyond the companies listed below. Signing in with Google is optional: an email address and a password reach the same account. What we receive is deleted with the rest of your account, on the same schedule as everything above.

If your portfolio signs you in through its own provider

A portfolio's owner can connect the portfolio's own sign-in provider. We hold what the owner enters for it: the provider's address, its client identifier, its client secret, stored encrypted, and the domain it names, with whether the portfolio has proved it owns that domain. Signing in through it returns the same three facts Google does, which we keep the same way.

Why: to let the portfolio's members sign in with the accounts their organisation already gives them. This is the portfolio's choice of provider, not a company we send your data to. Legal basis: performance of a contract. The settings are deleted when the owner removes them or the portfolio is deleted.

Records you enter

Portfolio name and currency; properties and their addresses; units; assets, with make, model, serial number, warranty dates and purchase price; vendors, with the contact name, phone number, email and website you enter; maintenance plans and service records; repairs; expenses; and any notes you add.

Why: this is the service. Legal basis: performance of a contract, and our legitimate interest in holding the vendor contact details you enter about other people. Kept until two hours at most after you delete the record, or until the portfolio is deleted.

People you invite

The email address you invite to a portfolio, the role you offer, who sent the invitation and when it ends. We email that address the link to join, and the email names you, by your sign-in address, as the person who invited them.

Why: to ask that person in. Legal basis: the inviter's legitimate interest in asking them. Deleted when the invitation is accepted, and 30 days after it is withdrawn or expires.

Documents and photos you upload

The files themselves, and the name, type and size they were uploaded with. Stored privately and reachable only through an authenticated request.

Why: to keep paperwork with the property it belongs to. Legal basis: performance of a contract. Kept until two hours at most after you delete the document, or until the portfolio is deleted, then held for up to 30 days. A deleted file is held at its own key so a backup restored inside that time finds it, and goes sooner where a portfolio's held files pass what its plan allows.

Sign-ins and changes to who can get in

Each sign-in, and each refused one, counted by the hour. Each change to your second factor, password, sessions, sign-in address, role or membership. Each change to a portfolio's own sign-in provider, and each deletion. With each, when it happened, who made it, and the request's IP address and browser user-agent; a scheduled task's carries neither. A failed sign-in for an address with no account is not recorded.

Why: so you can see who signed in to your account and what changed, and so a portfolio's owners can see who joined, left or changed role. Legal basis: legitimate interests in keeping accounts secure. You see your own, with their addresses and devices. A portfolio's owners see its members' events, with no address or device. Kept 90 days. Deleting your account deletes your own and takes your name, address and device off every portfolio's, the last of a very long history within those 90 days.

Technical request data

Cloudflare processes your IP address, user agent and request details at the network edge in order to route and serve the request. Our own error logs record the route, a request id, and which account and portfolio made the request, not your IP address or browser. When a page fails in your browser, it sends us the kind of page it was on and the browser's error message, with no account, address or form value. Signing up with a password, asking for a password reset, asking for a new verification email and joining the waitlist each send your IP address to Cloudflare Turnstile to check the request is not automated; that is not stored.

Why: to serve requests, keep the service available and prevent abuse. Legal basis: legitimate interests. Retention follows Cloudflare's own log retention.

Emails we send you

When a reminder is due, your email address and your digest go to the email provider named below. The digest names the property, asset, plan, repair or document it concerns. The same provider sends the emails your account needs to work: confirming your address when you sign up, finishing a sign-up, telling you an account already exists for an address, resetting your password, confirming a new sign-in address, telling the old address it changed, and choosing a new password after a change is undone. It also sends an invitation to join a portfolio, a notice that you are now a portfolio's owner, a warning before an unused account is deleted, and a reminder before a trial ends.

If an email to your address bounces, or you mark one as spam, the provider tells us, and we stop emailing you the digest, recording the address, why and when. It stops for that address only: changing your address, or our support lifting the report, ends it. Account emails still go out.

When the app meets something a person has to look at, an alert goes to Keepstead's own address, not to you. It can name the account concerned, by identifier, and carry the error text a provider returned.

Why: to send the reminders the account exists to send, and the messages an account and a shared portfolio need. Legal basis: performance of a contract. Kept while the account exists.

Paying for a plan

A paid plan is sold by Link, LLC as the seller of record, through Stripe Managed Payments. You give your name, email address, billing address, country and payment details to Link on its own checkout page, and they do not reach Keepstead. Link tells us which portfolio was paid for, the plan and packs bought, its own customer and subscription identifiers, and when the paid period ends, is cancelled or is refunded.

Why: to give the portfolio the plan that was paid for. Legal basis: performance of a contract. Kept while the portfolio exists. Link keeps its own record of the sale, under its own privacy policy.

Notifications on your devices

If you turn on notifications on a device, we store the address your browser's push service gives us for it, and the keys that encrypt what is sent there.

Why: to deliver the notifications you asked for. Legal basis: performance of a contract. Deleted when you turn them off, when that device's session ends (signing out, the session expiring, a password reset, ending it from another device, or deleting your account), or when the push service says the address no longer works.

Waitlist address

The email address you enter on the home page, and when you entered it. Nothing else.

Why: to tell you once, when Keepstead opens. Legal basis: consent, which you can withdraw at any time. Deleted after that message is sent, or whenever you ask.

Who else receives it

Cloudflare, Inc. (United States): hosting, the database, file storage and bot checks.
Resend (United States): sending reminder, account and waitlist emails, and telling us when one bounces or is marked as spam.
Link, LLC (United States), through Stripe Managed Payments: selling a paid plan as the seller of record. It is the seller on your receipt, and its LINK.COM name is the one on your card statement. It receives what you give it at checkout and the portfolio's identifier, never what the portfolio holds, and decides itself how it uses them, as a seller does, rather than acting for us.
Google LLC (United States): signing you in, if you choose to. Mail sent to an @keepstead.net address may also be processed by Google.

All four are United States companies. Transfers of what you enter in Keepstead out of the EEA and the UK rely on the European Commission's standard contractual clauses, in Cloudflare's and Resend's data processing addenda, and we will send you a copy of those clauses on request. Push notifications you turn on are relayed by your browser's own push service, encrypted so that it cannot read them. A calendar link you turn on is fetched by the calendar service you give it, which then holds the titles, places and dates of your due work; anyone holding the link can read the same, until you replace it or turn it off. There is no advertising network, no data broker and no analytics.

Cookies and browser storage

There is no consent banner because there is nothing to ask consent for. Everything Keepstead keeps in your browser is either strictly necessary for something you asked for, or a choice you made with a visible control:

sign-in cookies, scoped to the app's own hostname: the session and a signed copy of it once you sign in, two that last only while a second factor is asked or a provider sign-in is under way, and one that signing up sets for an hour from the latest sign-up, holding an id for each of that browser's last five, so the emailed link works only there
keepstead-theme and keepstead-date-format in local storage, holding the colour scheme and the date order you choose in Settings
a keepstead-columns- value per list in local storage, holding the columns you chose to show
keepstead:getting-started-hidden in session and local storage, remembering that you hid the first-run steps
keepstead-sidebar in local storage, holding whether you folded the sidebar
keepstead-settings-last in local storage, holding the settings section Settings opens on
a keepstead-recent: value per portfolio in local storage, holding the names and links of the last records you opened, for search
keepstead-push-owner in local storage, naming the account notifications on this device are for
keepstead:signed-out in session storage, holding what you had typed into a form when your session ended in that tab, with which account, portfolio and page it was, until you sign back in
keepstead:stale-chunk-reload in session storage, so a page that failed to load after an update reloads once and no more
a service worker, /push-worker.js, registered when you open the app, which shows the notifications you turn on and keeps one page in keepstead-offline-v1, shown when the installed app is opened offline, and nothing of your portfolio

Nothing else is stored, because no visitor analytics runs on this site or in the app. No script counts your visit, here or there. Separately, Cloudflare may set its own cookies to tell visitors from bots; the checks above set none. Those cookies are strictly necessary for that purpose and Keepstead cannot read them.

Your rights

Get a copy, or move it elsewhere. In the app, open Settings and use the Export data button. It downloads your account, every record in your portfolio, and every file you uploaded, in a machine-readable format. That covers both access and data portability.
Delete your account. Delete it in the same place. That removes the account and every portfolio it is the last member of, with their records and files. A portfolio shared with someone else stays with them, and passes to another member if you were its only owner; the records you added there stay, without your name. Deleted files are kept for up to 30 days, then deleted.
Correct something. Records, your name and your sign-in address are all changed in the app. A new address is confirmed from its own inbox, and the old one is told and can undo the change for 7 days.
Come off the waitlist. Email us.
Object, restrict processing, or withdraw consent where those apply to the bases above. Email us.

Account details are required to use Keepstead: without them there is no account to hold your records. Everything else is yours to enter or not.

There is no automated decision-making or profiling. If you think your data is being handled wrongly, you can complain to your data protection authority.

Changes

If what Keepstead does with data changes, this page changes with it and the date above moves. A change that needs your consent will ask for it.