Notice at Collection
This Notice at Collection is provided by Vermilion Inc (operating the Keel brand) ("Keel," "we," "us," or "our") pursuant to the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA").
It applies to California residents and describes the categories of personal information we collect, the purposes for which we collect it, and other information required by the CCPA. This Notice supplements our full Privacy Policy.
1. Categories of personal information we collect
We collect the following categories of personal information:
A. Identifiers
Examples: name, email address, unique user ID, IP address, device identifiers, account credentials.
B. Commercial information
Examples: subscription or purchase history, payment transaction details (processed by third-party payment processors; we do not store full payment card numbers), products or services purchased.
C. Internet or other electronic network activity information
Examples: browsing and app interaction history, pages or screens viewed, features used, session data, limit-setting and adherence/deviation events, crash and diagnostic logs, referring URLs.
D. Approximate geolocation data
Derived from IP address (city or region level only). We do not collect precise GPS location.
E. Inferences drawn from the above
Examples: derived measurements of whether activity fell inside or outside limits you set; aggregated product usage insights. These are presented to you as neutral data, never as clinical or moral judgments.
F. Other personal information you voluntarily provide
Examples: self-assessment responses, feedback, support communications, survey responses.
We do not collect:
- Protected classifications (race, religion, sexual orientation, etc.) as a matter of course.
- Biometric information.
- Precise geolocation.
- Contents of consumer communications beyond what you send to us.
- Data from health platforms (Apple HealthKit, Google Health Connect, etc.).
- Adult content itself (we neither host nor process it).
2. Purposes for collection and use
We collect and use the categories of personal information listed above for the following business and commercial purposes:
- Providing, maintaining, and improving the Services (account management, limit tracking, measurement displays, weekly reviews).
- Processing transactions and managing subscriptions.
- Communicating with you (transactional messages, support, product updates, and marketing where permitted).
- Detecting, preventing, and responding to fraud, security incidents, and abuse.
- Enforcing our Terms of Service and policies.
- Complying with legal obligations.
- Creating aggregated or de-identified data.
- Operating the self-assessment off-ramp that routes users indicating acute compulsive crisis to external resources (we intentionally forgo revenue in these cases).
- Analyzing usage in aggregate to improve the product.
We do not use personal information to diagnose conditions, generate shame or "relapse" judgments, enable partner surveillance, or target advertising based on sensitive behavioural categories.
3. Sources of personal information
We collect personal information from:
- You directly (account creation, limit setting, self-assessment, support communications, feedback).
- Your devices and browsers when you use the Services (automatic collection of usage, device, and log data).
- Third-party platforms through which you purchase or install the Services (Apple App Store, Google Play) for transaction and subscription data.
- Service providers acting on our behalf.
4. Disclosure of personal information
We disclose personal information to the following categories of recipients for the purposes described above:
- Service providers and contractors (cloud hosting, payment processors, analytics providers under our instructions, email delivery, customer support tools, fraud prevention). These parties are contractually restricted to using the data only for the services they perform for us.
- Professional advisors (legal, accounting, auditing) under confidentiality obligations.
- Government authorities or other parties when required by law or necessary to protect rights and safety.
- Parties to a corporate transaction (merger, acquisition, asset sale, etc.).
- Affiliates under common control.
We do not sell personal information.
We do not share personal information for cross-context behavioral advertising in a manner that constitutes a "sale" or "share" under the CCPA without providing opt-out rights.
We do not disclose limit-adherence or deviation data for partner monitoring or accountability purposes. Such features are permanently prohibited.
5. Retention
We retain personal information only as long as reasonably necessary to fulfill the purposes described in this Notice, to comply with legal obligations, resolve disputes, and enforce our agreements. When you request deletion of your account, we will delete or de-identify your personal information from primary systems within thirty (30) days of verifying the request (except where longer retention is required by law). Deleted data may remain in encrypted backups for up to ninety (90) days, after which those backups are overwritten or destroyed in the ordinary course of business.
6. Your california privacy rights
As a California resident you have the right to:
- Know / Access: Request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purposes for collection, and the categories of third parties to whom we disclose it.
- Delete: Request deletion of personal information we have collected from you (subject to certain exceptions).
- Correct: Request correction of inaccurate personal information.
- Opt-out of sale or sharing: We do not sell personal information. You may still opt out of any activities that could be characterized as "sharing" for cross-context behavioral advertising.
- Limit use and disclosure of sensitive personal information: Where applicable.
- Non-discrimination: We will not discriminate against you for exercising any of these rights.
To exercise these rights, email support@keelapp.co with the subject line "California Privacy Request." You may also use any in-app or website tools we provide. We will verify your identity before responding. You may designate an authorized agent; we may require proof of authorization and may still verify your identity directly.
If we deny your request, you may appeal by emailing support@keelapp.co. You may also contact the California Privacy Protection Agency or the California Attorney General.
7. Sensitive personal information
Certain data we process (particularly self-assessment responses and detailed limit-adherence records when linked to an identity) may be considered sensitive personal information under the CCPA to the extent it reveals information concerning a consumer's sexual or health-related status. We use such information only for the purposes of providing the Services you requested, operating the crisis off-ramp, security, and legal compliance. We do not use it for inferring characteristics beyond what is necessary to operate the product as designed.
8. Contact
For questions about this Notice or to exercise your rights:
Email: support@keelapp.co
Recommended subject lines: "California Privacy Request" or "CCPA Notice Question"
Postal:
Vermilion Inc
347 5th Ave Rm 1307
New York, NY 10016-5015
United States
This Notice at Collection is effective as of the date above. We may update it from time to time; the "Last updated" date will reflect changes. Our full Privacy Policy contains additional details about our practices.