Privacy policy

1. Controller

NextLevelSolutions OÜ, Tornimäe tn 5, 10145 Tallinn, Estonia. Email: hello@keedo.page.

2. Visiting the website

When you open keedo.page, our hosting provider processes technically necessary data: IP address, date and time, requested address, browser and operating system. This is needed to deliver the site and protect it from attacks (Art. 6 (1)(f) GDPR).

Hosting: Vercel Inc., USA. The site is served from the Frankfurt data center (fra1). Fonts are served from our own server; no data is sent to Google Fonts.

3. Cookies and browser storage

We only use technically necessary cookies and browser storage (§ 25 (2) TDDDG), which need no consent.

Sign-in cookie: keeps you signed in as a host until you sign out or the session expires. Language cookie “keedo-lang”: remembers your language for one year. Browser storage also holds the page last selected in the admin area, the page address picked on the home page and, after email confirmation, access to “My bookings”.

4. Host accounts

For an account we process your name, email address and, when you sign in with Google, the profile picture of your Google account. We also store your page content, events, payment settings and the bank details for transfers that you enter yourself. The legal basis is our contract with you (Art. 6 (1)(b) GDPR).

Sign-in with Google: Google Ireland Limited, Ireland. Sign-in by email link: the link is sent via Resend (see section 7).

5. Storage

Database and application: Convex, Inc., USA, with data stored in a data center in Ireland (AWS eu-west-1).

Images and files: Cloudflare, Inc., USA (Cloudflare R2). Public images are served via cdn.keedo.page; download files are kept in private storage.

6. Payments

Online payments are processed by Stripe Payments Europe, Ltd., Ireland. Hosts have their own contract with Stripe (Stripe Connect). Participants enter card and other payment details directly with Stripe; Keedo never sees them and only receives the payment status and amount.

With cash and bank transfer, no money passes through Keedo. Keedo only stores whether the host has marked the payment as received.

7. Emails

Sign-in links, booking confirmations, event updates and invitations are sent via Resend, Inc., USA, through the eu-west-1 region (Ireland).

8. Bookings on hosts' pages

When you book on a page at keedo.page/<name>, your contract is with that host. The host is the controller of your data (name, email, optional phone number, booking and payment status). Keedo processes it on the host's behalf (Art. 28 GDPR). Please send questions about your data to the host; we help them answer.

You only receive invitations to new events if you agreed. You confirm your consent by email and can withdraw it at any time via the link in every invitation (Art. 6 (1)(a) GDPR).

Keedo never shows your data to other hosts and never sells it.

9. Transfers to the USA

Vercel, Convex, Cloudflare and Resend are based in the USA. Where data is transferred there, we rely on the adequacy decision for the EU-US Data Privacy Framework if the provider is certified, and otherwise on the EU Commission's standard contractual clauses (Art. 46 GDPR).

10. Retention

We keep account data as long as your account exists and delete it afterwards unless the law requires us to keep it. Bookings and payments are kept for the host as long as tax and commercial retention periods require. The hosting provider deletes server logs after a short time.

11. Your rights

You have the right to access, rectification, erasure, restriction of processing and data portability (Art. 15 to 20 GDPR). You can object to processing based on legitimate interests (Art. 21 GDPR) and withdraw consent at any time for the future.

Write to us at hello@keedo.page. You can also complain to a data protection authority, for example the Estonian Andmekaitse Inspektsioon (www.aki.ee) or the authority where you live.