Privacy Policy

Keel is a service operated by Markj Research and Analytics Solutions Private Limited (CIN U62099MH2025PTC454968), registered office CD Barfiwala Road, Andheri West, Mumbai, Maharashtra 400058, India ("Keel", "we", "us"). This policy explains what personal data we collect when you use Keel, why we use it, who we share it with, how long we keep it, and how you can exercise your rights over it. You can read it on its own; you do not need any other document to understand it.

This policy covers three groups of people: users, meaning founders and team members who sign in to Keel; partner professionals — chartered accountants and company secretaries who sign in to Keel's partner portal to take on work; and people our users contact through Keel's outreach feature, covered separately under "People you contact through Keel" below.

What we collect

From you, when you use Keel:

• Account. Your name, email address and sign-in details, handled by our authentication provider, Clerk. We never see your password.
• Company profile. Your company's legal name, entity type, registration numbers such as CIN or LLPIN and GSTIN, state, sector, incorporation date, financial year, and the figures you enter, such as paid-up capital, turnover, revenue, borrowings and employee count, plus a company contact email if you add one.
• Documents. Files you upload, such as incorporation certificates or registrations, and documents you generate in Keel. Uploaded documents can contain identifiers such as PAN, GSTIN, CIN or DIN, and the names of directors or partners.
• Filing figures. The numbers you enter to prepare returns, and your approvals.
• Requests. Details you give us when you ask Keel's team, or an outside professional, for help, and any fee agreed for that work.
• Leads and outreach data. Companies you save as leads, including their website and your notes, any decision-maker name or role an AI search found on public web pages, any email address you choose to add for that lead, and the messages you send.
• Partner professionals. If you join Keel as a chartered accountant or company secretary: your name, firm, contact details, the registrations and skills you tell us about, the work you take on, and — so we can pay you — your UPI payment handle together with the account name your bank returns when we verify it.
• Billing. Your plan, trial dates, and invoices for paid plans. Premium is started from your billing settings in Keel, which sets up a recurring mandate with our payment provider, Razorpay; Pro is agreed with us and invoiced. Your card or bank details go to Razorpay directly from your browser and we never receive or store them, so we do not hold your payment credentials. If subscribing in the app is not switched on for your account, we set the plan up with you instead.

Automatically, when you use Keel:

• Service records. Audit events recording who did what and when, a log of reminder emails sent to you, and AI usage records showing the feature used, the date and the cost, not the content of what you asked.
• Product analytics (PostHog). A pseudonymous user ID and workspace ID, the paths of pages you open, never the query string, and a small, fixed set of product events. As with any web request, these carry your IP address and browser or device details.
• Error reports (Sentry, optional). Technical details of errors, tagged with your pseudonymous user ID, plus IP address and browser or device details. Email addresses, PAN, GSTIN, CIN and URL query strings are removed before a report leaves your browser or our server.

From public sources: company details from the Ministry of Corporate Affairs dataset published on data.gov.in, which can include a company's registered email and address, and public news results about your company.

Why we use it

We use your personal data only to:

• run your account and workspace, including sign-in, team access and the company profiles you create;
• build and maintain your compliance calendar, and send you deadline reminders and a weekly digest;
• prepare filings you ask for -- for the GST returns Keel supports in the app, computing returns from your figures -- and showing them to you for approval before anything happens on your behalf;
• read and draft documents with AI when you ask, including extracting details from an uploaded document, generating documents, explaining obligations, and drafting text;
• help you find leads and send the outreach you choose to send;
• handle requests you make to our team or to an outside professional;
• bill you and send account notices about your trial, plan and usage;
• keep Keel secure and working, including preventing abuse, investigating incidents, fixing errors, and understanding which features are used; and
• comply with the law and respond to lawful requests from authorities.

You give us this data so that we can provide Keel to you, and we process it for that purpose on the basis of your consent when you sign up and use each feature. You can withdraw consent at any time, as described under "Your rights" below. If you do, we will stop the processing that depends on it, though we may not be able to keep providing the service that depended on it.

We do not sell your personal data. We do not use it to train AI models, and our AI provider does not use it to train models either, under the commercial terms we have with them.

Where your data is stored and how we protect it

Our database, application servers and file storage run on servers we operate in India. Documents you upload and PDFs you generate are stored in our own storage on those servers, not with a third-party storage provider. Some of the providers we use to run Keel process data outside India, listed below.

What we do today:

• All traffic between your browser, our servers and our providers is encrypted in transit.
• Credentials you give us for third-party services, such as registry connector keys, are encrypted before we store them.
• Access to our production systems is limited to named Keel staff, and staff actions in our admin console are logged.
• Error reports are scrubbed of email addresses, PAN, GSTIN and CIN before they are sent.

What we do not yet do, and are working on:

• Our database and file storage are not yet encrypted at rest.
• We do not yet keep off-site backups. If our servers suffered a serious failure, data could be lost.

We will update this section as these change. No system is perfectly secure. If a breach affects your personal data, we will tell you, as described under "If something goes wrong" below.

Who we share it with

We share personal data only with the service providers below, which process it on our behalf under contract and only for the purposes described in this policy. Some are outside India.

• Razorpay Software Private Limited– payments and subscriptions. Receives your name, contact details, the order or plan and its amount, and — entered into Razorpay's own checkout on your device, never through Keel — your card, UPI or bank details. Keel never receives or stores those. Processed in India.
• Clerk, Inc.– sign-in and account security. Receives your name, email, and sign-in and session data. Processed in the United States and other countries.
• Resend– delivery of the emails we send you, and of the outreach emails you choose to send. Receives the recipient address and the content of each email. Processed in the United States.
• Anthropic– the AI features you use, such as reading a document you upload or drafting text you ask for. Receives the content you submit to that feature, never the email addresses of people you contact. Processed in the United States, deleted by Anthropic within 30 days, or longer only if flagged for misuse under its own policies.
• OpenAI– used only if you choose an OpenAI-powered option for AI logo generation, where offered. Receives the brief you submit for that feature. Processed in the United States.
• PostHog (EU Cloud)– product analytics. Receives pseudonymous IDs, page paths, product events, and your IP address and browser or device details. Processed in Germany. No session recording, and nothing is stored on your device.
• Sentry (EU region), optional– error monitoring. Receives scrubbed error reports tagged with your pseudonymous ID, plus IP address and browser or device details. Event data is processed in Germany; some account metadata may be processed in the United States.
• Google (News search)– used to show news about companies you research. Receives your company name, sector, and what you sell and to whom, as search terms.
• Domain registries (RDAP)– used for domain availability checks. Receives only the domain you check.
• data.gov.in (Government of India)– registry lookup, used only when your company is not already in our locally held copy of the public MCA dataset. Receives your company's CIN. Processed in India.

Keel staff can access your workspace data only to provide support you ask for, to handle a concierge or expert request you have made, to investigate abuse or a security incident, or where the law requires it. Their access is logged.

Outside professionals. If you ask for help from an outside professional through Keel, we share the details of your request with the professional who takes it on, and tell you who that is.

Authorities. We disclose personal data to a government authority only where the law requires it. If direct e-filing becomes available, a filing you approve will carry only what the relevant authority requires.

We do not sell personal data, and we do not share it for advertising.

People you contact through Keel

If you are a Keel user: lead discovery suggests companies to research, found by an AI web search and, for Indian companies, from the public company register. The search may also surface the name or role of a likely decision-maker at a company, taken from public web pages. That name, along with the company details, is sent to our AI provider when you ask Keel to research a lead or draft a message. Keel does not find, buy or scrape anyone's email address. If you add a contact's email address to a lead yourself, we store it and send only the emails you choose to send to it. That address is never sent to our AI provider. You decide who to contact, and you are responsible for having a lawful reason to contact them.

If you received an email sent through Keel: the email was sent by the business named in it, using Keel, and that business is responsible for sending it lawfully. Every such email carries an unsubscribe link. Using it stops that business from emailing you through Keel again; it does not affect other Keel users, and it does not stop that business contacting you through other means. We keep your address on a do-not-contact list for that business, even if they later delete their own copy of your details, so that the opt-out keeps working. To ask about your data, or to report an unwanted email, you can contact the sender directly or write to our Grievance Officer below, and we will pass your request on and help the sender respond.

We keep a lead, its contact details and the messages sent to it until you delete the lead or your account is permanently deleted. We keep do-not-contact records for as long as we operate the outreach feature, so that opt-outs keep working even after that.

Your rights and how to use them

You can ask us to:

• show you a summary of the personal data we hold about you, what we do with it, and who we have shared it with;
• correct, complete or update it; most of it you can also edit yourself in Keel;
• erase it;
• withdraw your consent, by writing to us or by deleting the relevant data or your account, just as easily as you gave it; and
• nominate someone to exercise these rights on your behalf if you die or become unable to act for yourself.

You can also ask for a copy of your company data in a common file format. We prepare this by hand on request today.

To make any of these requests, email [email protected] from the address on your Keel account, or tell us that address and your company's name so we can identify you. We acknowledge a request within 3 business days and respond within 30 days.

Deleting your data. You can delete a lead, a document or a company yourself. A deleted company disappears from your workspace immediately, and we keep it for at least 30 days afterwards so our support team can restore it if the deletion was a mistake. Permanent erasure is not automatic and does not happen at the end of that window: write to us and we will delete it by hand. To delete your whole account, email us and we will confirm and delete it within 30 days.

Some records we keep even after you ask us to delete the rest: access and audit logs are kept indefinitely today, billing records are kept for as long as tax law requires, and do-not-contact records are kept so that opt-outs keep working. Files you have uploaded or generated are not yet deleted automatically from our storage the moment you delete them in Keel; write to us and we will delete them by hand in the meantime.

Grievance Officer: Rahul Rajesh Gurujala, reachable at [email protected], CD Barfiwala Road, Andheri West, Mumbai, Maharashtra 400058, India. We aim to resolve a grievance within 30 days. You must raise a grievance with us first. If you are not satisfied with our response, you may complain to the Data Protection Board of India once its complaint process is operational.

Children

Keel is built for people running a business and is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact our Grievance Officer and we will delete it.

Retention

If something goes wrong

If we become aware of a personal data breach that affects you, we will tell you without delay, by email and in Keel. We will explain what happened, what it may mean for you, what we have done about it, what you can do to protect yourself, and who to contact. We will also report it to the relevant authorities as Indian law requires.

Cookies

We use only the cookies Keel needs to work:

• sign-in cookies set by our authentication provider, Clerk, which keep you signed in; and
• one preference cookie that remembers whether the sidebar is open.

We do not use advertising cookies. Our analytics provider, PostHog, keeps nothing on your device and does not record your sessions.

Changes, language and contact

If we change this policy in a way that matters, we will tell you by email or in Keel at least 15 days before the change takes effect, and we will update the date at the top of this page.

This policy is written in English. To read it in another language listed in the Eighth Schedule to the Constitution of India, email [email protected] and we will provide it.

Questions about this policy or your data: [email protected]. Grievance Officer: Rahul Rajesh Gurujala, [email protected], CD Barfiwala Road, Andheri West, Mumbai, Maharashtra 400058, India.