ENPT-BR
Create account

Privacy

Privacy Policy

Ravenkeep processes two kinds of personal data: the data of the people who use the console (operators) and the data your product sends about its own customers (contacts). This page explains both.

Draft pending legal review. It describes how Ravenkeep processes data today and will be replaced by the reviewed version.

Who is responsible

Ravenkeep is operated by BLACK TRENCH STUDIO LTDA, Porto Alegre, Brazil. For operator accounts we decide how data is processed. For contact data your organization decides what to send and why, and we process it on your behalf to provide the service.

Operator data

When you sign in to the console we process:

  • Your identity from DeepKey, our sign-in provider: email address, name and the identifiers DeepKey issues.
  • Your organizations, memberships, roles and invitations.
  • What you do in the console: replies, notes, triage changes, feature request edits, flows and templates.
  • Notification preferences and, for the Android app, the push token of your device.
  • When your organization subscribes to a paid plan: its plan and subscription history, its invoices (number, amount, currency, status and dates), the usage counts its invoices are computed from, and the brand, last four digits, expiry and issuing country of the card on file as Stripe reports them (the country sets the currency the card pays in). Card numbers are typed into Stripe’s payment form and never reach Ravenkeep.

Contact data your product sends

Through the SDKs your product may send, for each of its customers:

  • A user id, and the email, name, traits and account you choose to include.
  • First-touch attribution: UTM parameters, ad click ids, referrer and landing page.
  • Product events, revenue amounts and the timestamps of activity.
  • Exceptions with stack traces, page URLs, user agents, tags and breadcrumbs.
  • Support conversations and attachments, feature request votes and suggestions.
  • Email delivery, open and click records, and unsubscribe requests.

Your organization must have a legal basis to send this data and must tell its customers about it. Do not send passwords, payment card numbers or special categories of personal data.

How we use it

We use the data only to provide Ravenkeep: to authenticate operators, store and display what your product sends, compute metrics and impact, deliver chat messages and notifications, hand the emails your flows send to the email provider account you connect, keep the service secure and answer support requests. We do not sell personal data and do not use contact data for our own marketing.

Cookies on this site

This website does not use analytics or advertising cookies. It stores your language choice in a cookie. The browser SDK, when your product installs it, stores a first-party cookie and a localStorage entry with the first-touch attribution of each visitor, on your product's domain.

Service providers

We rely on providers for hosting, sign-in (DeepKey) and push notifications. They process data only to perform their service for us. Payments for paid plans are processed by Stripe, which receives the card details and the organization’s name and owner’s email address to charge the subscription, and processes them under its own terms and privacy policy. The emails your flows send leave through the email provider account connected to the project that sends them (today Resend), under your own contract with that provider and on your instructions. Our own email provider only sends the test emails an operator asks for, to that operator. Some of our providers may process data outside Brazil, under contractual safeguards.

Retention

Raw product events are kept for a limited period: up to a year (366 days), or for the plan’s history once plan limits apply (30 days on Free, a year on paid plans; when a paid plan ends, its year is kept 30 more days). Their daily totals are kept longer. Crash samples beyond the latest 100 per group are deleted after 30 days. Signup attribution is kept for the life of the contact. When an organization deletes a project, its data is deleted. Billing records (subscription history, invoices and the usage counts behind them) are kept while the organization exists; Stripe keeps its own payment records under its policy and the law.

Your rights

Under the LGPD and similar laws you may ask to access, correct, export or delete your personal data. Operators can write to us directly. If you are a customer of a product that uses Ravenkeep, contact that product first: it controls your data, and we will help it answer.

Contact

Questions about privacy go to hello@ravenkeep.io.

We answer requests within the time the law requires.