Privacy, draft

What Keptly holds, why, and for how long.

Draft, pending legal review. Not yet reviewed by a lawyer.

Keptly does not assume the Privacy Act small-business exemption applies to a business handling client customer data for reward, so it works as if the Australian Privacy Principles apply. This page says what that means in practice. The data letter each club signs is the binding version.

Member data, on behalf of a club.

What Keptly handles: Five fields; Name, contact details (phone, email and the member’s state, which sets their local send hours and keeps members in Western Australia and South Australia out), amount, payment status and membership status. Replies a member sends to a Keptly message are kept with the log. Nothing else.
Health data: Never
Visit dates: Only under a re-signed letter; And only if the club later chooses the Prevent work, which is not offered today.
Where it comes from: The club; The club’s weekly payments export and member list, or read access to those reports, supplied under the data letter. Rows for members whose payments never failed are read and discarded, not kept.
What it is used for: The three jobs; Recovery, Saves and Return. No other purpose. Nothing is sold to a member and no data is used for marketing beyond the club’s own approved Return messages.
Who sees it: Keptly, and the services below; The data letter names each one. Some are overseas, listed below with where they are. Advice on overseas processing is a gate before the first client.
Deleted: On exit; When the engagement ends, the club’s member data is deleted. The log of touches and outcomes is the one exception: it is kept for three years, as the commercial agent rules in New South Wales require, and then deleted.
The log of touches and outcomes: Kept 3 years; Every touch. Every reply. Every suppression. Every outcome. Recorded and kept, as the commercial agent rules in New South Wales require.
A request to stop: Honoured the same day; In any words, on any channel. A written “do not contact” is honoured absolutely and permanently.
Members in Western Australia or South Australia: Not contacted; Until Keptly has legal advice or a licence in that state.

The services Keptly uses, and where they are.

Any of these can see personal information in the course of its job. Those marked “from client one” are not in use yet.

Vercel: United States; Hosts this website and runs the contact form.
Google Workspace: United States and other countries Google operates in; Keptly’s email. Contact form messages arrive here.
Anthropic (Claude): United States; Reads a member’s reply to a Keptly message and drafts an answer. A person approves every answer, apart from two factual ones the club approves in advance. From client one.
Supabase: Australia (Sydney); Holds Keptly’s records for each club: members, failed payments, messages and the log. From client one.
OpenAI: United States; Indexes the club’s own documents, such as its membership terms, so drafts can quote them. Never sees member data. From client one.
Stripe: United States; Invoices clubs. Holds the club’s billing details, never a member’s. From client one.

The audit file.

Where your export is read: Your browser; The audit page makes no network requests. No server, no fonts fetched, no analytics. You can run it with the internet switched off.
Uploaded: Nothing
Stored: Nothing; Close the tab and it is gone.

This website.

Analytics: Cookie-less page counts; Vercel Web Analytics, which sets no cookies and does not identify visitors. Not loaded on the audit page.
The contact form: Emailed, not kept here; What you type is sent to Keptly’s inbox as an email, and nothing is kept on this website. Your internet address is held briefly in memory to stop spam and never written down. A hidden field records which campaign brought you here, if any.
Cookies: None set by Keptly
Browser storage: One flag, this tab only; Your browser remembers, for this tab, that the opening screen has played, so it does not play again on the next page. It holds nothing about you and clears when you close the tab.

Questions, access or correction.

A member who wants to know what a club has shared with Keptly, or wants it corrected or deleted, can ask the club or Keptly directly. Keptly answers factual questions the same day and refers anything about hardship, a dispute or a cancellation to the club.

A complaint: Answered within 30 days; Email Keptly and say what went wrong. If the answer does not resolve it, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Keptly is a service of DYZR. dylan@keptly.com.au. ABN 48 825 788 140.