KEEP Privacy Policy

Last updated: 16 October 2026

KEEP is a customer-memory app for small businesses. It is operated by Sustained by Grace (Pty) Ltd, a company registered in South Africa ("KEEP", "we", "us" or "our").

This policy explains what personal information KEEP processes, why, who helps us process it, how long we keep it and what your rights are. We process personal information in line with the Protection of Personal Information Act 4 of 2013 ("POPIA").

It applies to the KEEP apps for Android and iPhone, the KEEP web app at my.keepapp.co.za and our website at keepapp.co.za.

1. Two kinds of information, two roles

Account information is information about you, the person who signs up and uses KEEP for your business. For this information, KEEP is the responsible party under POPIA.

Customer information is information you enter about your own customers: their names, numbers, notes, visits, bookings and photos. For this information, your business is the responsible party and decides why and how it is collected. KEEP is your operator: we store and process it on your behalf, only to provide KEEP to you, and under the confidentiality and security duties set out in section 4 of our Terms of Use.

If you are a customer of a business that uses KEEP and want to know what that business has stored about you, please contact the business first. If you cannot reach them, contact us and we will help where we can.

2. What we collect about you

• Account details: your name, email address and, if you sign in with Google, your Google account's name and email address. We never see your Google password.
• Business details: business name, business type, your mobile number, business email, currency, time zone and follow-up preferences.
• Plan and usage: your plan, and a count of how many customers, AI actions and photos you have used, so we can apply plan limits.
• Sign-in records: one-time sign-in codes (stored hashed and deleted after use), active sessions, and the IP address and device type of each session, to keep your account secure.
• Error reports: when something breaks, the app sends us a short technical report (the error message and the screen or page). We remove email addresses, phone numbers and similar details before we store it, and we never record what you typed.

3. What you store about your customers

• Customer records: name, mobile number, email address, birthday and notes.
• Visits and history: what was done, amounts spent, dates, and follow-up and reminder dates.
• Bookings: appointment dates, times and descriptions.
• Photos you attach to a visit, for reference.
• Voice notes you record about a visit (see section 5).

You choose what to enter. Please only store information that you are allowed to keep and that you need for your business. Do not store special personal information (such as health, religious or biometric details) or information about children unless you have a lawful reason and have met POPIA's conditions for it.

4. Permissions the apps ask for

The phone apps ask for these only when you use the feature, and you can say no:

• Microphone: to record a voice note when you tap Speak.
• Camera and photos: to take or choose a reference photo for a visit.
• Contacts: to add the contact you pick as a customer. KEEP reads only the contact you choose. It does not upload your address book.

The apps do not track your location and do not use advertising identifiers.

5. Voice notes and AI features

KEEP uses artificial intelligence to turn a spoken or typed note into a tidy visit record, to suggest follow-up dates, to understand requests such as "book Thandi for Friday" and to draft WhatsApp messages for you to review.

• When you record a voice note, the audio is sent to OpenAI to be transcribed into text. KEEP does not keep the audio after it has been transcribed.
• The transcribed or typed note, and the details needed to understand it (for example the customer's name and recent visits), are sent to Anthropic, whose Claude models extract the visit details or draft the message.
• Both providers process this information only to return a result to KEEP. Under their API terms they do not use it to train their models.
• AI can make mistakes. Check the details and messages before you rely on them or send them.

6. How we use personal information

We use personal information to:

• create and secure your account and sign you in;
• store your customer records and show them back to you;
• remind you of follow-ups and bookings;
• provide the voice, AI and WhatsApp-draft features;
• apply plan limits and, when paid plans start, manage your subscription;
• reply to support requests and tell you about important changes to KEEP;
• find and fix faults and keep KEEP secure;
• meet our legal obligations.

We do not sell personal information. We do not use customer information for advertising, and we do not contact your customers.

7. Who we share it with

We share personal information only with service providers who help us run KEEP, and only what each one needs:

• CloudAfrica (South Africa): the servers that run KEEP and store its database and photos.
• Microsoft Azure, South Africa North region: encrypted offsite backups.
• OpenAI (United States): transcription of voice notes.
• Anthropic (United States): AI extraction, booking assistance and message drafting.
• Resend (European Union): delivery of sign-in codes and account emails.
• Google (United States): only if you choose Sign in with Google.
• Expo (United States): delivers app updates to your phone. It does not receive your KEEP data.
• Apple and Google: distribute the apps through their stores under their own privacy policies.

We may also disclose information if the law requires it, to protect people's safety or our rights, or as part of a sale or restructuring of our business, in which case this policy will continue to apply.

When you tap to send a drafted message, KEEP opens WhatsApp with the text filled in. Nothing is sent until you send it in WhatsApp, and WhatsApp's own terms and privacy policy then apply.

8. Information processed outside South Africa

KEEP's servers, database, photos and backups are in South Africa. The AI, transcription, email and Google sign-in providers listed above process some information in other countries, mainly the United States and the European Union.

We send them only what each feature needs, and we use providers that are bound by contract to protect it and to use it only to provide their service to us, as section 72 of POPIA requires.

9. How we keep it safe

• All connections to KEEP are encrypted (HTTPS).
• Each business can only reach its own records. Photos are private and are only served to the business they belong to.
• Sign-in codes are stored hashed, sign-in attempts are rate-limited, and the phone apps keep your session in the device's secure storage.
• Backups are encrypted before they leave the server.
• Only authorised people at KEEP can reach the servers, and only to run and support the service.

No system is perfectly secure. Please protect your phone with a lock screen. If we become aware of a security compromise that affects your personal information, we will notify you and the Information Regulator as POPIA requires.

10. How long we keep it

• We keep your account and customer information while your account is open.
• You can delete individual customers, visits and photos at any time. Deleting them removes them from KEEP straight away.
• When you delete your account, your login, business profile, customers, visits, bookings, follow-ups and photos are permanently deleted from KEEP at once.
• Deleted information can remain in our encrypted backups for up to 12 months, until those backups expire. We only use backups to recover from a failure, and we do not restore deleted accounts from them.
• Error reports are deleted after at most 180 days.
• We keep records we are required to keep by law, such as invoices once paid plans start, for as long as the law requires.

See keepapp.co.za/delete-account for step-by-step instructions.

11. Cookies and similar technologies

The KEEP web app uses one essential cookie to keep you signed in. The phone apps store the same session in secure storage on your device, and keep a copy of recent records on the device so KEEP works with poor signal.

Our website, keepapp.co.za, does not set cookies and does not use analytics or advertising trackers. It loads fonts from Google Fonts, which means your browser connects to Google's servers.

12. Your rights

Under POPIA you have the right to:

• ask whether we hold personal information about you, and for a copy of it;
• ask us to correct or delete information that is inaccurate, out of date, excessive or unlawfully obtained;
• object to processing of your personal information on reasonable grounds;
• refuse direct marketing (we do not send marketing without your consent);
• complain to the Information Regulator.

You can see and correct most of your information yourself in the app, and you can delete your account in Settings. For anything else, email privacy@keepapp.co.za. We may need to confirm your identity first. We will respond within 30 days.

If you are not happy with our response, you can contact the Information Regulator (South Africa) at POPIAComplaints@inforegulator.org.za or through inforegulator.org.za.

13. Children

KEEP is a business app for adults. It is not meant for anyone under 18, and we do not knowingly collect information from children.

14. Changes to this policy

We will update this policy when KEEP or the law changes. The date at the top shows the latest version. If a change materially affects how we use your personal information, we will tell you in the app or by email before it takes effect.

15. Contact us

Our Information Officer handles privacy questions and requests.

Sustained by Grace (Pty) Ltd, trading as KEEP
South Africa
Email: privacy@keepapp.co.za