Privacy

Tilak Kumar G, sole proprietor trading as TurtleByte (“we”, “us”, “our”) operates Sitekeep, a maintenance and work order management platform (the “Service”). This policy explains what personal information we collect, why, and what choices you have.

1. Our Two Roles

As a controller. For information about account holders, billing contacts, website visitors, and prospects, we decide how and why data is processed. This policy governs that processing.

As a processor. For data your organization uploads into the Service — work orders, asset records, technician assignments, requester details, photos, comments — your organization is the controller and we process on its instructions under our Terms of Service and, where applicable, a Data Processing Agreement. If you are an end user at a customer organization, direct privacy requests to that organization first.

2. Information We Collect

You give us directly

Account data: name, work email, phone, job title, organization name.
Billing data: billing contact, address, and tax identifiers. Card details go directly to Paddle, which sells you the subscription; we never see or store full card numbers.
Support and communications: messages you send us, and their contents.
Agreement records: which version of these documents your organization accepted, who accepted them, when, and the IP address the acceptance was made from. We keep these as evidence of what was agreed, which is why they are kept for the life of the organization rather than with the logs in Section 9.

Your organization’s users put into the Service

Work orders, requests, comments, asset and location records, schedules, labor and parts entries.
Uploaded files, including photographs and video of facilities and equipment, and audio notes recorded by technicians. Section 5 explains what happens to audio.

Collected automatically

Usage data: pages and features used, timestamps, actions taken, referring URLs.
Device and log data: IP address, browser and OS version, device identifiers, crash and error reports.
Push notification tokens, where you use the mobile application and allow notifications. A token identifies a device to the notification service; it is deleted when you sign out or turn notifications off.
Cookies and similar technologies (see Section 10).

We do not collect the physical location of your device. We do not intentionally collect special categories of personal data (health, biometric, religious belief, etc.). Please do not enter such data into free-text fields, and note that an audio note is a recording of someone’s voice — record only what the job requires.

3. People Who Submit Requests Without an Account

Our customers can publish a public request portal so that anyone — a teacher, a caretaker, a member of a congregation, a member of the public — can report a maintenance problem without signing in.

No account is created and no password is issued. The portal cannot read any data back; it only accepts a submission.
The page is protected against automated abuse. Before a submission is accepted, Cloudflare Turnstile checks that it comes from a person rather than a script. Cloudflare receives your IP address and basic signals about your browser for that check, and nothing else — not your name, your message, or your photo. It is used to decide whether the submission is genuine and for no other purpose. The organization whose portal it is can turn this check off.
What is collected is whatever that organization’s form asks for: typically your name, a way to contact you, a description of the problem, its location, and any photo you choose to attach.
The organization whose portal it is, is the controller of that submission. We process it on their behalf. Send access, correction, or deletion requests to that organization; if you send one to us, we will pass it on and tell you we have.
We do not market to you on the strength of a submission and do not build a profile from it.
The portal is not an emergency channel. It is not monitored continuously. Report emergencies by the means your local emergency services provide.

4. Why We Use It

Purpose	Legal basis (GDPR)
Provide, host, and maintain the Service	Contract
Authenticate users and secure accounts	Contract / Legitimate interests
Operate a customer’s public request portal on its behalf	Processor, on the customer’s instructions
Process payments and prevent fraud	Contract / Legal obligation
Provide support and respond to requests	Contract
Improve reliability, performance, and features	Legitimate interests
Send service, security, and billing notices	Contract / Legal obligation
Record which version of these documents you accepted	Contract / Legal obligation
Comply with law and enforce our Terms	Legal obligation / Legitimate interests

We do not send marketing email. The only messages we send are about your account: service and security notices, billing, invitations, and the work order notifications you have chosen to receive. There is no mailing list to be added to and none to unsubscribe from.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

5. AI Features and How Your Content Is Handled

The Service offers AI-assisted search and summarization over your historical work orders, and transcribes audio notes so that they can be searched. Three different providers are involved, and they receive different things:

Transcription. Audio notes recorded on a work order are sent to OpenAI, which returns a text transcript. The transcript is stored with the work order and indexed for search.
Search index. Work order text — including those transcripts — is converted into vector embeddings by Voyage AI and stored in our own database. The embeddings are what make semantic search possible.
Answers. When someone runs a natural-language search, the query and the passages retrieved for it are sent to Anthropic, which generates the answer.

In every case:

We contractually require these providers not to use your content to train their models, and to retain it only transiently for abuse monitoring where their terms require.
We do not use your Customer Data to train our own models.
When a work order is deleted, the transcripts and embeddings derived from it are removed from the search index within 7 days.

6. Offline Access and Data on Devices

The mobile application is built to work without a network connection, which means it holds a copy of data on the device itself.

What is held: the work orders, locations, assets, and comments that user is entitled to see, plus attachments they have opened.
How it is protected: by the operating system’s own storage encryption and the device’s lock screen. Signing out of the application, or removing it, deletes the local copy.
When changes arrive: a device only learns of a change when it next connects. A record deleted in the Service therefore remains on a device that has been offline until it syncs. The deletion timelines in Section 9 describe our systems, not a phone in a basement.
What the customer controls: device policy, screen locks, and revoking access from lost or departed devices are the customer organization’s responsibility.

The Service runs on a server we rent from Hetzner Online GmbH in Helsinki, Finland. That is where your Customer Data — work orders, attachments, and the search index — is stored. An encrypted copy of the database is backed up daily to Cloudflare R2 storage in the European Union; the disk and the backups are encrypted with keys we hold, so neither company can read what it stores.

We share personal information only with service providers who help us run the Service, under contracts limiting their use of it:

Category	Provider	Purpose	Location
Hosting	Hetzner Online GmbH	Running the Service, on an encrypted disk it cannot read	Finland
Backup storage	Cloudflare	Storing encrypted database backups it cannot read	European Union
Bot protection	Cloudflare	Checking that a public request portal submission comes from a person: receives the submitter’s IP address and browser signals	United States
AI — transcription	OpenAI	Transcribing audio notes to text	United States
AI — embeddings	Voyage AI	Building the semantic search index	United States
AI — answers	Anthropic	Generating natural-language search answers	United States
Transactional email	Resend	Service, billing, and invitation email	United States
Push notifications	Expo	Delivering notifications to mobile devices	United States

Website analytics, error diagnostics, and performance telemetry are collected by software we host and operate ourselves on the infrastructure above — Umami, GlitchTip, and SigNoz respectively. No third party receives any of it, so none of them is a subprocessor.

Payments are not on that table, and deliberately. Paddle.com Market Ltd is the merchant of record: it sells you the subscription, takes your payment, and issues your invoice. It receives your billing contact, address, tax identifiers, and payment details, and it handles them as an independent controller under its own privacy policy — not on our behalf and not under our instructions, which is what every provider in the table above does. Your card details go to Paddle and never to us. No Customer Data reaches it.

A current list is maintained at https://getsitekeep.com/subprocessors. We will give at least 30 days’ notice before adding a subprocessor that processes Customer Data. If you object on reasonable data-protection grounds within that period and we cannot resolve your objection, you may terminate the affected subscription and receive a prorated refund of prepaid, unused fees.

We may also disclose information when required by law or valid legal process, to protect our rights or the safety of others, or in connection with a merger, acquisition, or sale of assets (with notice to you).

8. International Transfers

We are established in India and operate the Service from there, and our customers may be located anywhere. Customer Data is stored in Finland and its encrypted backups in the European Union. Some processing also happens in the United States, where the AI, email, and notification providers listed in Section 7 operate.

India is not the subject of a European Commission adequacy decision, and storing Customer Data in the EEA does not change that, because we access it from India. Where personal data of people in the EEA, UK, or Switzerland reaches us, we therefore rely on Standard Contractual Clauses — with the UK International Data Transfer Addendum where the UK’s rules apply — or another lawful transfer mechanism. A copy is available on request.

9. Retention and Deletion

Category of personal information	How long we keep it
Identifiers — name, work email, phone, job title	Life of the account, plus 12 months after closure
Commercial information — subscription, invoices, tax identifiers	8 years, as tax and accounting law require
Customer Data — work orders, requests, comments, asset and location records	For as long as your organization exists. Cancelling a paid plan moves you to the free plan and does not delete anything. Deleted within 7 days of the hold below, when an owner asks us to delete the organization
Audio, visual and electronic information — photographs, video, audio notes and their transcripts	With the Customer Data they are attached to, as above
Internet and network activity — usage, device and log data, error reports	90 days
Agreement records — which version of these documents was accepted, by whom, when, and the IP address it came from	Life of the organization. Deleted with it
Push notification tokens	Until you sign out or turn notifications off
Approximate location inferred from IP address	Not retained separately; present only in the logs and the agreement records above
Sensitive personal information	We do not collect it. See Section 2

Encrypted backups are purged on a rolling 30-day cycle, so a record deleted from active systems may persist in a backup until that cycle completes.

Asking us to delete sooner. You do not have to wait out the export window. An organization owner can ask us to delete everything at any time, from the organization settings or by writing to [email protected].

Because deletion cannot be undone, we do not run it the moment it is asked for. We confirm the request, hold it for 7 days so that it can be cancelled if it was a mistake or was not authorised, and then delete. After the hold, your data is gone from active systems within a further 7 days and out of backups by the end of the 30-day cycle above. Export anything you need before the hold expires — the export files are removed along with everything else.

Everyone in the organization is told a deletion has been requested, not only the owner who asked, because one person’s request ends everybody’s access. Any owner can cancel it while it is held. Until the hold expires nothing changes: the Service works normally, which is what makes taking an export possible.

Asking us to delete is the only thing that starts a deletion. Cancelling a paid plan does not, and neither does letting one lapse — you move to the free plan and keep your data.

What survives a deletion, and why. Some information is deliberately kept when a record or a person is removed:

Audit records. The Service keeps a record of who did what and when, so that a maintenance history can be trusted. For that reason, user accounts are deactivated rather than deleted — a deleted account would leave historical entries attributed to nobody. Audit records are kept for the life of the account plus 12 months.
Deletion markers. Deleting a record leaves behind a marker recording that it was deleted and when, so that devices which were offline at the time learn of the deletion when they reconnect. A marker holds the record’s identifier and timestamp, not its contents.
Derived search data. Transcripts and embeddings built from a deleted record are removed within 7 days, as described in Section 5.
Backups and legal holds. Data may persist in encrypted backups until the cycle above completes, and longer where we are legally required to preserve it.

What survives the deletion of a whole organization. When an owner asks us to delete an organization, we remove its work orders, requests, assets, parts, bookings, comments, attachments, transcripts, embeddings, audit trail, agreement records and the sign-in accounts of everyone in it. That removal is permanent and we cannot reverse it. Three things deliberately remain:

Your billing records, for the 8 years tax and accounting law require, as the table above says.
A minimal record that the organization existed — its internal identifier and the dates it was created, asked to be deleted, and deleted, with its name removed. We keep it because the billing records above have to refer to something, and we keep nothing in it that identifies a person.
Your organization’s public request address. We do not reissue it to anyone else. Printed QR codes outlive accounts, and a reused address would send someone’s maintenance request to a different organization.

10. Cookies

We use strictly necessary cookies for authentication and session management. Blocking them will prevent you from signing in.

We use no advertising, tracking, or analytics cookies. Our website analytics is Umami, which we host ourselves and which sets no cookies and collects no personally identifiable information — it counts page views, referrers, browsers, operating systems, device types, and country. There is accordingly nothing here for you to consent to or switch off, which is why this policy offers no cookie banner.

11. Security

We maintain administrative, technical, and physical safeguards including encryption in transit (TLS) and at rest, role-based access control, tenant isolation, least-privilege internal access, audit logging, and regular dependency patching.

Because the Service is designed to work offline, personal data is also stored on the mobile devices of your users, protected by the operating system’s storage encryption and the device’s lock screen. Managing those devices is the customer organization’s responsibility, as described in Section 6.

No system is perfectly secure. If a breach affects your personal information we will tell you without delay, and any regulator within the time the law allows. Where we process data on a customer organization’s behalf, we tell that organization within 24 hours of becoming aware, so that it can meet its own obligations to you and to regulators. In India, the Digital Personal Data Protection Rules, 2025 (in force for these purposes from 13 May 2027) require affected people to be told without delay and the Data Protection Board of India to receive a report within 72 hours; we work to those timelines now.

12. Your Rights

Depending on where you live, you may have the right to access, correct, delete, port, or restrict processing of your personal information; to object to processing; and to withdraw consent. California residents may request disclosure of categories collected and disclosed, request deletion or correction, may use an authorized agent to make a request on their behalf, and are entitled to non-discrimination for exercising these rights.

To exercise a right, contact [email protected]. We will verify your identity and respond within the period required by law (generally 30–45 days). Where we act as a processor, we will refer your request to the relevant customer organization.

Limits. Section 9 describes what we keep even after a deletion request — chiefly audit records attributing past actions to a person, and the markers that carry a deletion out to offline devices. We will tell you when a request is limited on that basis and why.

Appeals. If we deny your request, you may appeal by writing to [email protected] with “Appeal” in the subject line. We will respond within 45 days with our decision and the reasons for it. If we deny your appeal, you may complain to your state Attorney General.

India. We are established in India and process personal data under the Digital Personal Data Protection Act, 2023. You may ask us to correct, complete, update, or erase your personal data, and you may raise a grievance with the officer named at the foot of this policy. If that grievance is not resolved, you may escalate it to the Data Protection Board of India.

EEA and UK residents may lodge a complaint with their local supervisory authority.

13. Children and Student Records

The Service is a workplace tool not directed to children. We do not knowingly collect personal information from anyone under 16.

Schools. The Service is not designed to hold student education records, and we do not act as a “school official” with a legitimate educational interest under FERPA unless we have signed a written agreement saying so. Do not enter student names or education records into work orders, requests, or attachments. If a student submits a request through a school’s public request portal, that submission belongs to the school to manage as described in Section 3, and the school is responsible for any notice or consent its own obligations require.

Contact [email protected] if you believe a child’s information has been submitted, and we will delete it.

14. Regulated Data

The Service is not configured for protected health information under HIPAA, cardholder data under PCI DSS, student education records under FERPA, or classified government information. Do not submit such data unless we have executed a separate written agreement with you (including a Business Associate Agreement where applicable).

15. Changes

We will post updates here and revise the date above. For material changes, we will notify you by email or in-product notice at least 30 days before they take effect.

Contact Tilak Kumar G, sole proprietor trading as TurtleByte 2nd Floor, No. 17, 7th Main Road, Bengaluru, Bengaluru Urban, Karnataka 560038, India Privacy: [email protected] · Security: [email protected] Grievance Officer (India, DPDP Act 2023): Tilak Kumar G · [email protected]