Legal

Who else touches your data

The full list of providers we use to run the service and what each one receives. Our data processing terms name these categories and point here for the current providers, so replacing one inside a category is a change to this page rather than to your contract.

12 SEPTEMBER 2026LAST CHANGED

Pubblicato solo in inglese

Il resto del sito è tradotto; questo documento no. Un contratto con quindici stesure solleva la domanda di quale faccia fede quando due non coincidono, quindi esiste una sola versione autentica ed è questa. Il testo inglese è quello che si applica al tuo accordo con noi.

Be told before anything changes

We give ten days’ notice before a new provider starts processing your data — by email to your account contact, and to anyone subscribed here. If you object on reasonable grounds within that time and we cannot agree on an alternative, you may end your subscription without penalty and we refund the unused part.

CategoryProviderPersonal data it receivesRegionWhose account

Application hostingFly.ioEverything passing through a request, in transit and in memory while it is handled; application logsStockholm, European UnionKeelvy

Database and sign-inSupabaseAll workspace records, user email addresses, sign-in credentials, sessions and one-time linksStockholm, European UnionKeelvy

File storageCloudflare R2Media originals, generated documents carrying customer names and amounts, imports, exports and prepared archivesEuropean UnionKeelvy

Restore pointsBackblaze B2A complete copy of every workspace, held under separate keys in storage nobody can delete before its retention endsBeing confirmedKeelvy

Transactional emailResendRecipient address, and message subject and body, which may quote order numbers, counterparty names and amountsBeing confirmedKeelvy

Background jobsInngestBusiness events with their contents, including user email addresses, contact and signatory names, and payroll figures by employeeBeing confirmedKeelvy

Error monitoringSentryStack traces and request URLs. Authorization headers, request bodies and cookies are stripped before sending; email and phone patterns are masked; session recording is not enabledBeing confirmedKeelvy

Subscription paymentsPaddleNo personal data is sent by us — only a payment reference, amount, currency and return address. Card details never reach our systemsBeing confirmedKeelvy

Media deliveryYour own accountWhatever media you publish through itSet by your providerYours

Notification deliveryYour own accountThe content of notifications you choose to route thereSet by your providerYours

Regions still being confirmedFive of the rows above are marked being confirmed: restore points, transactional email, background jobs, error monitoring and subscription payments. For those we are verifying the account region against each provider’s signed agreement rather than publishing a figure we have not checked. Ask us and we will tell you today what we know; this page is updated the moment each is confirmed.The application and the database that hold your working data are not among them — those run in Stockholm, in the European Union, and are stated above.

EXACT LEGAL ENTITY NAMES AND THE SIGNED DATA PROCESSING AGREEMENT FOR EACH ARE PROVIDED ON REQUEST

Categories with nobody in them

Listed so you can see what we have not quietly left out. Each is named in our data processing terms with no provider engaged today, which means the ten days’ notice above applies before one ever is.

Content delivery networkAI model providersProduct analyticsSession recordingWebsite analytics

What is not on this list, and why

Anything you connect yourself

Your shop, your marketplace, your accounting system, your storage, your own assistant. You add those with your own credentials and can remove them the same way. You decide what goes there, so you are the one controlling that transfer — and they are not on this list, because a list of everything the product can connect to would stop answering the question you came here with.

Front-end tracking, because there is none

No analytics script, no advertising pixel, no session recorder, no chat widget. Our fonts are served from our own servers rather than a font network, so loading a Keelvy page does not make your browser talk to anybody else at all. This one is checkable: open the network tab.

Our own task tracker

It reads our backlog so the public changelog can be built from it. It holds none of your data, and the connection has no write access at all.

Previous versions

Kept rather than replaced, so you can show what this page said on the date of your own audit. This is the first published version.