Privacy Policy

Last updated: 2026-07-21

This Privacy Policy explains how Keendai (“Keendai”, “we”, “us”), a service operated by H2Op, collects, uses, shares, and retains information when you visit our websites or use the Keendai application. Keendai is a business-to-business lead-generation platform: customers define an Ideal Customer Profile, and we mine public business data, enrich it with vendor APIs, score it with AI, and deliver ranked lead lists that the customer can review and export.

1. What this policy covers

This policy applies to your use of:

• keendai.com: our marketing site
• app.keendai.com: the authenticated Keendai application
• pam-api.keendai.com: our API surface

This policy does not cover third-party services you choose to connect to your workspace to receive your leads, such as a CRM, a spreadsheet, or an outreach tool. When you connect one of these and export or sync leads to it, that service receives the data you send and handles it under its own privacy policy and your agreement with it.

2. Information we collect

2.1 Account information you provide

When you sign up for Keendai we collect your name, email address, and authentication identifiers. You can sign in with Google OAuth, Microsoft OAuth, or an email-and-password credential managed by Firebase Authentication. If you sign in with Google or Microsoft, we receive the basic profile fields the provider returns (name, email, profile photo URL) and an identity token. We do not request, store, or use any additional Google scopes beyond basic sign-in.

2.2 Workspace and Ideal Customer Profile data

Inside the application you create a workspace and one or more Ideal Customer Profiles (ICPs). An ICP describes the kind of business you want to reach: an offer pitch, verticals, geography, contact-channel requirement, and optional advanced settings. We store this configuration so we can run mining on your behalf and so you can edit it later.

2.3 Lead data we fetch on your behalf

When you start a mining run, our worker fetches publicly available business information from Google Maps Places and Instantly Lead Finder, then enriches resolved business contacts via Apollo (person resolution), Hunter (email discovery and verification), and Telnyx Lookup (phone line type metadata). The data we fetch is business contact information about decision-makers at the businesses your ICP targets: business name, address, phone, website, business email, the public name and title of a contact, and employee-count or industry bands where available. We do not knowingly mine consumer or personal-use contact data.

To add context to a delivered lead, we also make a single automated request to the lead business’s own publicly available website and read its page text. We pass a short excerpt of that public text (up to a few thousand characters) to an AI model to extract a few factual highlights about the business — for example services offered, locations, or languages stated on the site. This “Intel” is drawn only from the business’s own public website, is delivered to you as plain facts, and is not used to train general-purpose AI models. If a business has no website or nothing distinctive to extract, no Intel is produced.

2.4 Billing data

Both subscription billing (monthly plans) and one-time Lead Pack purchases are handled by Stripe. When you check out, Stripe collects your payment-method information directly. We receive a Stripe customer ID, subscription status, one-time-purchase (Lead Pack) receipts, invoice metadata, the Stripe Price or product identifier of what you purchased, and the last four digits of your card via Stripe’s API. We never see, store, or have access to full payment-card numbers. For Lead Packs, we also store the pack size, purchase date, and 90-day expiry date alongside your workspace ledger so we can apply the leads you purchased and re-credit any duplicates, missing contacts, or undeliverable emails (see our Terms, Section 5).

2.5 Usage and security data

We automatically record IP address, browser and device type, request paths, request IDs, and timestamps in our application logs. We use these for security, abuse prevention, rate limiting, and debugging. Sensitive payload fields (raw email contents, prospect contact PII) are redacted from operational logs.

2.6 Guest (pre-signup) data

You can try a limited lead search before creating an account. When you do, we create a temporary, anonymous guest identity and a temporary guest workspace so the search can run, and we record the search inputs and the same usage and security data described in Section 2.5. If you ask to see your full results, we collect the email address you provide at that step. A guest search runs the same public-business mining described in Section 2.3. If you create an account, your guest workspace and its results are adopted into your new account; if you do not, the guest workspace and its results are automatically deleted after 7 days (see Section 5). An email address you submit to receive a preview is used to send you that preview and a sign-up link through our email provider, and is retained in that email system; email privacy@keendai.com to have it removed.

3. How we use information

• To authenticate you and protect your workspace from unauthorized access.
• To execute prospect mining runs against public business directories on your instructions, score and rank candidates against your ICP, and deliver lead lists in your workspace.
• To read the public website of a delivered lead business and use an AI model to extract factual highlights about it, as described in Section 2.3.
• To generate CSV, XLSX, or clipboard exports on demand and to retain a record of those exports.
• To bill your subscription via Stripe and produce receipts and invoices.
• To detect, prevent, and investigate fraud, abuse, account takeover, and violations of our Terms of Service.
• To improve the product through aggregate, de-identified usage analysis (for example, measuring how long mining runs take or which ICP shapes deliver more leads).
• To respond to your support and data-rights requests.
• To comply with legal obligations.

We do not sell personal information for money. We do not use your data, or data we obtain from Google APIs, to train general-purpose machine-learning models.

Legal basis.The business contact information in a lead list concerns people in their professional capacity at the businesses your ICP targets. Where data protection law requires a legal basis, we rely on our and our customers’ legitimate interest in business-to-business outreach, balanced against the rights of the individuals concerned, and we honor the removal right described in Section 6. Note that our use of advertising-measurement cookies (Section 9) may be considered a “share” of personal information under some U.S. state privacy laws; you can limit this using the controls in Section 9.

4. Sharing with third parties

We share information with the third-party service providers below. Vendors marked “sub-processor” act on our behalf to deliver the Service under a contract that requires confidentiality and appropriate security measures. Vendors marked “advertising” or “analytics” receive the events described and process them under their own privacy policies and terms as independent controllers.

We may add, remove, or change these providers as the Service evolves. When we make a material change to the sub-processors that handle personal data on our behalf, we will update this list and give notice as described in Section 11. If you are a business customer who needs a data processing agreement, ours is available at keendai.com/dpa.

We may also disclose information when required by law, valid legal process, or to protect the rights, property, or safety of Keendai, our customers, or others. In the event of a merger, acquisition, or sale of assets, your information may be transferred to the successor entity, subject to this policy.

5. Data retention

• Active workspace. We retain your account, ICPs, mining runs, delivered leads, and exports for the lifetime of the workspace.
• Cancelled workspace. When you cancel, your workspace becomes read-only at the end of the current billing period. We retain your data for a 90-day grace period during which you can resubscribe and recover everything. After 90 days, the workspace is soft-deleted: it is removed from product surfaces but retained in backups for the windows below.
• Guest (pre-signup) data. A temporary guest workspace and its results, created when you try a search before signing up (Section 2.6), are automatically deleted 7 days after creation if you do not create an account and adopt them. If you do create an account, the workspace is adopted and then retained like any active workspace.
• Hard delete. You can request immediate hard deletion at any time (see Section 6). We will purge your account, workspace, ICPs, runs, delivered leads, and exports within a commercially reasonable time and in any event within 30 days of a valid request.
• Operational and audit logs. Application logs are retained for up to 30 days. Audit-log entries (records of who did what in a workspace) are retained for up to 5 years for security and compliance, with personal-data fields replaced by a salted hash on hard delete.
• Billing records. Invoice records are retained for up to 7 years to meet financial-record retention requirements; on hard delete we redact personal-data fields and retain only the amount, period, and Stripe identifiers needed for accounting.
• Backups. Firestore Point-in-Time Recovery is enabled with a 7-day window. Weekly full Firestore exports are written to a dedicated Cloud Storage bucket and retained for up to 30 days under a lifecycle policy.

6. Your rights

You may request the following at any time, regardless of where you live, by emailing privacy@keendai.com:

• Access to the personal data we hold about you.
• Correction of inaccurate personal data.
• Export of your workspace data in a portable format (CSV or XLSX).
• Deletion of your account and workspace data (a “right to be forgotten” request).
• Withdrawal of any consent you have previously given for optional processing such as product-update emails.

We will respond to verifiable requests within 30 days. If you are a person whose business contact information has been included in a customer’s lead list (a “prospect”), you have the same rights with respect to that data; email privacy@keendai.com and we will remove your business contact record from our system.

7. Children’s privacy

Keendai is a business product. The Service is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child has provided us with personal information, please contact us at privacy@keendai.com and we will delete it.

8. International data transfers

Keendai is hosted in the United States. All workspace data, including data we fetch on your behalf from third-party data sources, is processed and stored in the Google Cloud us-central1 region. If you access the Service from outside the United States, you understand that your data will be transferred to and processed in the United States, where data-protection law may differ from the law of your country.

9. Cookies and tracking

We use a small number of strictly necessary cookies to keep you signed in and to protect your session (a Firebase Authentication session cookie and a CSRF token). We use Google reCAPTCHA on signup forms to deter automated abuse; reCAPTCHA may set its own cookies and process limited browser metadata under Google’s privacy policy.

On our marketing site (keendai.com) we load analytics and advertising-measurement tags through a tag manager. These include session and traffic analytics (Microsoft Clarity, which records anonymized clicks, scrolls, and page navigation and does not capture form input values; and Google Analytics) and advertising-measurement pixels (Google Ads, the Meta Pixel, and Microsoft Advertising). These tags set cookies or read advertising identifiers and send page-view, click, and conversion events to the providers named in Section 4 so we can understand site usage and measure whether our ads work. Because our marketing site and the application are served from the same web app, these analytics and advertising-measurement tags may also load while you are signed in; we do not display advertising inside the application. The choices below let you limit these tags.

Your privacy choices

You can limit or opt out of the analytics and advertising cookies described above:

• Use your browser’s cookie controls to block or delete cookies, or browse in a private window.
• Opt out of ad personalization directly with the networks, for example through Google Ads Settings, your Meta ad preferences, and the industry opt-out pages at optout.aboutads.info.
• If you would prefer we not load advertising-measurement tags for your visits, use the browser and network controls above, or email privacy@keendai.com and we will help. We do not sell personal information for money.

10. Security

• All traffic is served over TLS 1.2 or higher.
• All data at rest in Firestore and Cloud Storage is encrypted by Google Cloud’s managed encryption.
• Workspace isolation is enforced by Firestore security rules and re-enforced by per-request membership checks in our API.
• Vendor API keys are stored in Google Secret Manager, bound to runtime environments only, and rotated on a documented cadence.
• We log every state-changing action to an immutable audit log with actor, action, resource, request ID, and timestamp.
• We deploy a strict Content Security Policy, X-Frame-Options DENY, HSTS, and per-route rate limiting on customer surfaces.

No system is perfectly secure. If we discover a security incident affecting your data, we will notify you and any required authority as soon as reasonably possible and in any event within the timeframe required by applicable law.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top. For material changes that affect how we use personal information, we will notify the workspace owner by email and place a banner in the application before the changes take effect.

12. Contact

Keendai is operated by H2Op. If you have any questions about this policy or about how we handle your data, contact us at:

• Data requests and privacy questions: privacy@keendai.com
• Security incidents: security@keendai.com
• General and billing: contact@keendai.com
• Mailing address: H2Op, 2160 Barranca Parkway #1210, Irvine, CA 92606, USA