Privacy Policy

Last updated: 2026-05-19

This Privacy Policy explains how Keendai (“Keendai”, “we”, “us”), a service operated by H2Op, collects, uses, shares, and retains information when you visit our websites or use the Keendai application. Keendai is a business-to-business lead-generation platform: customers define an Ideal Customer Profile, and we mine public business data, enrich it with vendor APIs, score it with AI, and deliver ranked lead lists that the customer can review and export.

1. What this policy covers

This policy applies to your use of:

• keendai.com: our marketing site
• app.keendai.com: the authenticated Keendai application
• pam-api.keendai.com: our API surface

This policy does not cover third-party services we link to or that you choose to connect (for example a CRM you might integrate later). Those services have their own privacy policies.

2. Information we collect

2.1 Account information you provide

When you sign up for Keendai we collect your name, email address, and authentication identifiers. You can sign in with Google OAuth, Microsoft OAuth, or an email-and-password credential managed by Firebase Authentication. If you sign in with Google or Microsoft, we receive the basic profile fields the provider returns (name, email, profile photo URL) and an identity token. We do not request, store, or use any additional Google scopes beyond basic sign-in.

2.2 Workspace and Ideal Customer Profile data

Inside the application you create a workspace and one or more Ideal Customer Profiles (ICPs). An ICP describes the kind of business you want to reach: an offer pitch, verticals, geography, contact-channel requirement, and optional advanced settings. We store this configuration so we can run mining on your behalf and so you can edit it later.

2.3 Lead data we fetch on your behalf

When you start a mining run, our worker fetches publicly available business information from Google Maps Places and Instantly Lead Finder, then enriches resolved business contacts via Apollo (person resolution), Hunter (email discovery and verification), and Telnyx Lookup (phone line type metadata). The data we fetch is business contact information about decision-makers at the businesses your ICP targets: business name, address, phone, website, business email, the public name and title of a contact, and employee-count or industry bands where available. We do not knowingly mine consumer or personal-use contact data.

2.4 Billing data

Both subscription billing (monthly plans) and one-time Lead Pack purchases are handled by Stripe. When you check out, Stripe collects your payment-method information directly. We receive a Stripe customer ID, subscription status, one-time-purchase (Lead Pack) receipts, invoice metadata, the Stripe Price or product identifier of what you purchased, and the last four digits of your card via Stripe’s API. We never see, store, or have access to full payment-card numbers. For Lead Packs, we also store the pack size, purchase date, and 90-day expiry date alongside your workspace ledger so we can apply the leads you purchased and re-credit any duplicates, missing contacts, or undeliverable emails (see our Terms, Section 5).

2.5 Usage and security data

We automatically record IP address, browser and device type, request paths, request IDs, and timestamps in our application logs. We use these for security, abuse prevention, rate limiting, and debugging. Sensitive payload fields (raw email contents, prospect contact PII) are redacted from operational logs.

3. How we use information

• To authenticate you and protect your workspace from unauthorized access.
• To execute prospect mining runs against public business directories on your instructions, score and rank candidates against your ICP, and deliver lead lists in your workspace.
• To generate CSV, XLSX, or clipboard exports on demand and to retain a record of those exports.
• To bill your subscription via Stripe and produce receipts and invoices.
• To detect, prevent, and investigate fraud, abuse, account takeover, and violations of our Terms of Service.
• To improve the product through aggregate, de-identified usage analysis (for example, measuring how long mining runs take or which ICP shapes deliver more leads).
• To respond to your support and data-rights requests.
• To comply with legal obligations.

We do not sell personal information. We do not use your data, or data we obtain from Google APIs, to train general-purpose machine-learning models.

4. Sharing with third parties

We share information with the third-party service providers below, each of which is bound by a contract that requires confidentiality and appropriate security measures. Vendors marked “sub-processor” act on our behalf to deliver the Service.

We may also disclose information when required by law, valid legal process, or to protect the rights, property, or safety of Keendai, our customers, or others. In the event of a merger, acquisition, or sale of assets, your information may be transferred to the successor entity, subject to this policy.

5. Data retention

• Active workspace. We retain your account, ICPs, mining runs, delivered leads, and exports for the lifetime of the workspace.
• Cancelled workspace. When you cancel, your workspace becomes read-only at the end of the current billing period. We retain your data for a 90-day grace period during which you can resubscribe and recover everything. After 90 days, the workspace is soft-deleted: it is removed from product surfaces but retained in backups for the windows below.
• Hard delete. You can request immediate hard deletion at any time (see Section 6). We will purge your account, workspace, ICPs, runs, delivered leads, and exports within a commercially reasonable time and in any event within 30 days of a valid request.
• Operational and audit logs. Application logs are retained for up to 30 days. Audit-log entries (records of who did what in a workspace) are retained for up to 5 years for security and compliance, with personal-data fields replaced by a salted hash on hard delete.
• Billing records. Invoice records are retained for up to 7 years to meet financial-record retention requirements; on hard delete we redact personal-data fields and retain only the amount, period, and Stripe identifiers needed for accounting.
• Backups. Firestore Point-in-Time Recovery is enabled with a 7-day window. Weekly full Firestore exports are written to a dedicated Cloud Storage bucket and retained for up to 30 days under a lifecycle policy.

6. Your rights

You may request the following at any time, regardless of where you live, by emailing privacy@keendai.com:

• Access to the personal data we hold about you.
• Correction of inaccurate personal data.
• Export of your workspace data in a portable format (CSV or XLSX).
• Deletion of your account and workspace data (a “right to be forgotten” request).
• Withdrawal of any consent you have previously given for optional processing such as product-update emails.

We will respond to verifiable requests within 30 days. If you are a person whose business contact information has been included in a customer’s lead list (a “prospect”), you have the same rights with respect to that data; email privacy@keendai.com and we will remove your business contact record from our system.

7. Children’s privacy

Keendai is a business product. The Service is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child has provided us with personal information, please contact us at privacy@keendai.com and we will delete it.

8. International data transfers

Keendai is hosted in the United States. All workspace data, including data we fetch on your behalf from third-party data sources, is processed and stored in the Google Cloud us-central1 region. If you access the Service from outside the United States, you understand that your data will be transferred to and processed in the United States, where data-protection law may differ from the law of your country.

9. Cookies and tracking

We use a small number of strictly necessary cookies to keep you signed in and to protect your session (a Firebase Authentication session cookie and a CSRF token). We use Google reCAPTCHA on signup forms to deter automated abuse; reCAPTCHA may set its own cookies and process limited browser metadata under Google’s privacy policy.

On our marketing site (keendai.com) we load Microsoft Clarity, a session-analytics tool that records anonymized session data (clicks, scrolls, page navigation) to help us understand how visitors use the site. Clarity does not capture form input values or other personally identifying field content. You can read Microsoft’s Clarity privacy notice for details. We do not load third-party advertising trackers, and we do not sell or share data with advertising networks.

10. Security

• All traffic is served over TLS 1.2 or higher.
• All data at rest in Firestore and Cloud Storage is encrypted by Google Cloud’s managed encryption.
• Workspace isolation is enforced by Firestore security rules and re-enforced by per-request membership checks in our API.
• Vendor API keys are stored in Google Secret Manager, bound to runtime environments only, and rotated on a documented cadence.
• We log every state-changing action to an immutable audit log with actor, action, resource, request ID, and timestamp.
• We deploy a strict Content Security Policy, X-Frame-Options DENY, HSTS, and per-route rate limiting on customer surfaces.

No system is perfectly secure. If we discover a security incident affecting your data, we will notify you and any required authority as soon as reasonably possible and in any event within the timeframe required by applicable law.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top. For material changes that affect how we use personal information, we will notify the workspace owner by email and place a banner in the application before the changes take effect.

12. Contact

Keendai is operated by H2Op. If you have any questions about this policy or about how we handle your data, contact us at:

• Data requests and privacy questions: privacy@keendai.com
• Security incidents: security@keendai.com
• General and billing: contact@keendai.com
• Mailing address: H2Op, 2160 Barranca Parkway #1210, Irvine, CA 92606, USA