Privacy policy

Adkeep runs this Adkeep service. In this policy, “we” and “us” mean Adkeep.

Adkeep provides customer management software to businesses. Each business has its own organization workspace, users and settings, and can connect its own WhatsApp Business account. Businesses use their workspaces for leads from ads and forms, customer conversations, sales and invoices, visits and staff attendance.

Each business chooses the data it adds, the users it authorizes and the features it uses. Contact that business for information about its own customer and staff data practices.

This policy covers two groups of people:

• Business customers: people who contact a business using Adkeep, complete its forms or buy from it, including people who have not bought anything yet.
• Workspace users: business owners, administrators, employees and agents who use the Adkeep web portal or mobile app.

If you have a question about this policy, write to hello@adkeep.io.

A business can store the following data in its workspace when you contact it, fill in its forms, message its WhatsApp number or deal with its staff. Staff can also enter records after a call, visit or sale.

• Contact details: your name, phone number, email address and WhatsApp profile name, your city, area and address, and a map location for your address or for a place where the business’s staff visited you.
• WhatsApp messages: the messages, photos, voice notes and documents you exchange with the business, and the status of each message (sent, delivered, read or failed).
• Lead forms: your answers to the business’s lead forms in Facebook and Instagram ads (Meta), Google ads and TikTok ads, and on its website. Website forms also record your IP address and browser type, and whether you ticked the consent box.
• Ad and campaign details: the campaign, ad set, ad or form that brought you to the business, the ad headline, click identifiers set by the ad platform, the UTM tags of the link you followed and the page where you filled in the form.
• Purchases and invoices: the items, amounts, dates and invoice numbers of your purchases, recorded by the business’s staff or sent from its point-of-sale system. If you sign an invoice on a staff member’s phone, we keep your name and signature.
• Notes, tasks and visits: notes the business’s staff write about you, calls they log and how they went, follow-up tasks, visits with their time, place, photos and outcome, and voice memos the business’s staff record about a conversation with you, with their transcripts and summaries.
• AI-inferred profile: details our AI tools infer from your messages, notes and form answers, such as the products you are interested in, your preferred brand, your budget range, when you plan to buy, how close you are to buying, how you prefer to pay and any objections, plus scores such as the chance that you buy in the next 30 days. Each value is stored with a confidence value between 0 and 1, where it came from and when. Values with low confidence are marked as unconfirmed, and the business’s staff can confirm or correct any value.
• Consent: whether you agreed to receive marketing messages on WhatsApp, how and when, any opt-out, and whether your number is on the business’s do-not-contact list.
• Other details: tags, the staff member who looks after you, and your stage with the business, for example new lead or repeat customer.

• Account: your name, email address, phone number, role, territory and language, and your password, which we store only in hashed form.
• Business workspace: the business name, country, time zone, currency and workspace status. Adkeep platform administrators can manage workspaces and view their administrator contact details and user and WhatsApp-number counts.
• Devices: the model and platform of each phone you sign in on, the app version, an installation ID, a push notification token and when the phone was last used.
• Attendance: when you check in or out, the app takes a live selfie and records the time, your GPS location and its accuracy, the street address of that location, the nearest work site and your distance from it, and whether a fake-location app seemed to be in use.
• Face match, if the business enables it: your check-in selfie is compared with an enrollment photo of you, and the match score is stored. A low score is flagged for a manager to review. It never blocks your check-in.
• On-duty location, if the business enables it: while you are checked in, the app shares your location every few minutes and when you move (by default every 5 minutes, or after 100 metres), with its accuracy, your speed and your phone’s battery level. It stops when you check out. On Android a notification shows while it runs; on iPhone the location indicator shows. Managers see these points on a live map and in route and travel reports.
• Voice memos: recordings you make in the app, their transcripts, and the summaries and facts our AI tools draw from them.
• Work records: the visits, notes, calls, tasks, sales and messages you record; travel distances and expense estimates calculated from your check-in, visit and location points; and an audit log of important actions, such as exports, merges, role changes and consent changes, with the IP address they came from.
• Cookies: the web portal uses cookies for sign-in, language, time zone and layout preferences. Connecting a WhatsApp account loads Meta’s JavaScript SDK and login flow; Meta controls the cookies and data processing on its services.

Adkeep processes workspace data to provide these features to the business using that workspace:

• To answer you and follow up: the business can assign enquiries to staff, receive reminders and keep its customer history in one place.
• To sell and deliver: the business can record sales, make invoices, and plan visits and routes.
• To message you on WhatsApp: the business can reply to you, follow up on your enquiry or purchase, and manage marketing messages and consent (see WhatsApp messages and consent).
• To understand what you need: AI tools read messages, notes, voice memo transcripts and form answers to fill in your profile, score and sort leads, spot spam and duplicate records, suggest next steps to the business’s staff and notice when someone asks the business to stop messaging them.
• To measure marketing: the business can see which ads, campaigns and messages lead to enquiries and sales.
• To manage a field team: attendance, visits, travel distances and expenses, and, where the business enables them, face match and on-duty location.
• To report to managers: dashboards, reports, and weekly summaries that AI writes from report figures.
• To keep the service secure and working: sign-in, access by role, audit logs, error alerts and backups.

We do not sell personal data.

Businesses connect their own WhatsApp Business Platform account through Meta’s authorization flow. Adkeep stores the granted account and phone-number identifiers and an encrypted access token to operate that connection. When you message a connected business number, Adkeep receives your phone number, WhatsApp profile name and message for that business’s workspace.

A workspace administrator can disconnect WhatsApp in the integration settings. This removes the stored connection token and pauses scheduled and running broadcasts. It does not erase customer records or conversation history already stored in the workspace.

Businesses can reply within WhatsApp’s 24-hour customer-service window. Outside that window, WhatsApp requires message templates approved by Meta.

Opting in

Adkeep records the opt-in and opt-out information used by the business for messaging. Consent records can come from:

• a consent checkbox on the business’s form;
• a WhatsApp chat started from the business’s ad;
• a “yes” button in a message; or
• consent recorded by the business’s staff or imported with its source.

Consent records include their source and time. A business can configure messaging frequency caps and quiet hours in its workspace. The business chooses its messages and is responsible for obtaining appropriate consent.

The workspace distinguishes marketing messages from messages about an enquiry or purchase, and records opt-outs for its messaging checks.

Opting out

Reply STOP at any time. We also understand words such as “unsubscribe” and “cancel”, and the Arabic and Kurdish words for stop, such as إيقاف and وەستان. The opt-out is recorded for that business and your number is added to its suppression list.

The service also checks for messages that clearly ask the business to stop, even if they do not use one of these words.

An opt-out is used to suppress template messages in that business’s workspace. If you write to the business again, its staff can still answer in that conversation. A later opt-in can be recorded with its source.

Opting out does not delete your data. To delete it, see Deleting your data.

Depending on the features and integrations in use, Adkeep uses these providers to run the service:

• Meta Platforms: the WhatsApp Business Platform (Cloud API) carries businesses’ WhatsApp messages and media and reports delivery and read status. Meta lead ads provide the answers people give in connected Facebook and Instagram lead forms, with the ad and campaign details.
• Railway: hosts our database, application servers, cache and file storage (photos, voice memos, signatures and documents) in the EU, in Amsterdam, the Netherlands, and keeps our database backups.
• OpenRouter and the AI model providers it passes requests to, such as Anthropic, Google and OpenAI: AI text models that read message texts, notes, voice memo transcripts and form answers to extract facts (such as products, prices and appointment times), summarize voice memos, explain suggested next steps to workspace users, make customer history searchable by meaning and write weekly summaries for managers. By default we ask OpenRouter to use only providers that do not keep the data or train on it.
• TypeSafe AI: its Jev decision model reads message, note and form texts, with some profile context, and answers fixed questions with a confidence score, for example which product you are asking about or whether you asked the business to stop. It does not write text.
• Runpod: runs our speech-to-text for voice memos and, when face match is on, compares check-in selfies with enrollment photos.
• Google Firebase Cloud Messaging: delivers push notifications to staff phones. A notification carries a short title and record IDs; the details load inside the app.
• OpenStreetMap: its Nominatim service turns GPS points into street addresses (for check-ins and visits) and addresses into map points (for customer addresses and work sites). Maps in the web portal load map images from OpenStreetMap’s servers.
• Google Maps Platform, if we turn it on: can handle some or all of these address lookups instead of OpenStreetMap.
• Zapier or Make, if we use them: pass answers from a business’s TikTok lead forms to its workspace.
• Slack or Discord, if we turn on alerts: receive technical alerts about errors in the service.

Meta, Google and TikTok also decide what they collect on their own platforms when you see a business’s ads or fill in its forms there; their own privacy policies explain it.

Some of these providers are based outside the EU, for example in the United States, and may process data there.

Workspace records remain until an authorized administrator deletes them or an applicable retention job removes them. The service has a nightly cleanup job with these default periods:

• Attendance selfies: after 90 days.
• Voice memo recordings: after 180 days. Their transcripts and summaries stay in the customer’s history.
• Photos and other media exchanged on WhatsApp or attached to customer notes: after 365 days.
• On-duty location points: after 30 days.
• Uploaded import files, such as customer lists: after 30 days.

These are defaults, not a fixed retention period for every business. Workspace administrators can change the periods for selfies, voice memos, media and location points.

You can request deletion separately from these retention settings (see Deleting your data).

Workspace administrators can deactivate staff accounts. Deactivating an account does not automatically erase its attendance, visit or sales records.

Deleted data can remain in our database backups until those backups expire on their regular schedule.

• Passwords are stored only as Argon2 hashes, never in readable form.
• Sign-in uses short-lived access tokens and refresh tokens that change every time they are used. We store only a hash of each refresh token, and reusing an old one signs that device out. In the web portal the refresh token is kept in a cookie that page scripts cannot read; the app keeps its tokens in the phone’s secure storage.
• Administrators and managers can sign a user out of all their devices remotely.
• Access is scoped to the user’s organization and role: sales reps see only their own customers and managers see their own territory. Phone numbers can be partly hidden from sales reps.
• Only administrators can export customer data. Exports are limited in size, marked with who exported them and logged.
• Files are stored privately and opened through links that expire after a short time. Photos are re-encoded when they are stored, which removes hidden metadata such as the GPS position and device details; selfies and visit photos that cannot be cleaned this way are refused.
• Webhooks from Meta are checked against Meta’s signature. Lead connections from Google and TikTok, and our point-of-sale connection, must present a key, and integration keys are stored only as hashes.
• Our servers keep technical logs, such as IP address, time and the address requested, for security and troubleshooting. Passwords, tokens, cookies, keys and signatures are left out of these logs.
• The web portal, the app and our servers communicate over encrypted HTTPS connections.
• Our database is backed up daily, weekly and monthly.
• Important actions, such as exports, merges, erasures, role changes and consent changes, are recorded in an audit log.

No system is perfectly secure, but we work to protect your data and to fix problems quickly.

For data held by a business in its workspace, you can contact that business or ask Adkeep support for help with these requests:

• Give you a copy of your data. An authorized workspace administrator can export a customer record as a machine-readable file (JSON), including: your profile, the AI-inferred values with their confidence, your consent history, leads, messages, notes, visits, tasks, purchases and a list of files.
• Correct it. Authorized workspace users can correct details and AI-inferred values.
• Delete it. See Deleting your data.
• Stop marketing messages. Reply STOP to the business on WhatsApp, or contact that business.

Workspace users can change their own name, language and password in the app or portal. For other workspace data, such as attendance or location history, contact the business’s administrator or Adkeep support.

Send requests to hello@adkeep.io. Include the business or workspace name so we can identify the relevant records. We may ask you to confirm your identity and coordinate the request with that business.

To request deletion of personal data in Adkeep:

1. Email hello@adkeep.io with the subject “Delete my data”, or send the request directly to the business that holds your data.
2. Include the business or workspace name, the phone number you used with that business and your email address if you provided one.
3. We may ask you to confirm the request, for example by replying from that phone number.

An authorized administrator can erase a customer record in the relevant workspace. Adkeep support can help identify the workspace and coordinate the request. The following describes what the customer-erasure function removes and retains.

What we delete

Your name, phone numbers, email address, address and map location; your profile, AI-inferred values and tags; your consent records; your WhatsApp conversations and messages; notes, form answers and visit details; and files such as photos, voice memos and signatures. We also clear the copies of your lead form and message data that we received from Meta, Google and other sources, the search entries made from your history, and the answers our AI tools gave about you.

What we keep

• An anonymous “Erased customer” record with no name, contact details or message content. It keeps only what the workspace’s sales reports need to stay correct: dates, statuses, which ad or campaign a lead came from, and what was sold and for how much.
• If the administrator selects continued suppression, your phone number remains on that business’s do-not-contact list. Include whether you want it removed in your request.
• A record in our audit log that the erasure took place, and when.

Deleted data can remain in our database backups until those backups expire on their regular schedule.

Workspace users can request deletion in the same way. Account deactivation and customer-record erasure are separate functions; requests about staff, attendance or other business records need review with the relevant business.

Adkeep is a business tool and is not meant for children. We do not knowingly collect data about children under 16. If you think we hold a child’s data, contact us and we will delete it.

We update this policy when the service or the law changes. The date at the top shows when it last changed. Workspace users can refer to this page for the current policy.

Adkeep runs this Adkeep service.

Email: hello@adkeep.io

To ask for your data to be deleted, follow the steps in Deleting your data.