Privacy Policy

1. Data we collect

We collect only what we need to provide the service:

• Account data — your email address, hashed password, and business name when you register.
• Event data — event titles, dates, locations, notes, and status that you enter into the platform.
• OAuth tokens — access and refresh tokens for connected integrations (Google Calendar, Etsy, Shopify, Square, QuickBooks). All tokens are encrypted at rest using AES-256 before being stored.
• Form submissions — the name, email address, business name, and message you send through our contact, feature request, and access request forms, together with the submitting IP address. These are stored so we can track and respond to them.
• Log data — server-side logs including IP address, browser type, and pages accessed, retained for up to 30 days for security and debugging purposes.
• Assistant usage — if you use the in-app assistant, we record the token counts, model, and cost of each request against your account, to enforce your pack’s monthly allowance. We do not store the questions you ask or the answers you get.

2. How we use your data

• To authenticate you and maintain your session.
• To store and display the events and data you create.
• To communicate with connected integrations on your behalf.
• To detect and prevent abuse, fraud, and security incidents.
• To review and respond to contact messages, feature requests, and access requests.
• To send transactional and account emails — password resets, event and crew reminders, and a one-time reminder to finish setting up your account if you never did. We do not send marketing email without consent.

3. Data storage and security

Your data is stored on servers located in the European Union. We apply the following protections:

• All OAuth tokens encrypted with AES-256 before database storage.
• Passwords hashed with bcrypt (12 rounds) — we never store plaintext passwords.
• All data in transit protected by TLS 1.2+.
• Database access restricted to the application server; no public exposure.
• No third-party analytics or tracking scripts embedded in the application.

4. Third-party integrations

When you connect a third-party service (Google, Etsy, Shopify, Square, QuickBooks), we access only the scopes you explicitly authorize. Our Square access is read-only — we request no write scopes and never modify anything in your Square account. If you turn on Store Sync, FairKeep changes the stock quantities of the Shopify products you map, at the location you choose, to take Square sales off your Shopify stock; it changes nothing else in Shopify. We do not share your integration data with any other party, except as described for the assistant below. You can disconnect any integration at any time from your dashboard, which immediately deletes the stored tokens.

When you use the assistant built into FairKeep, your question and the account data needed to answer it are sent to Anthropic (Claude) to generate the answer. Anthropic processes this on FairKeep’s behalf and does not use it to train its models, under its commercial terms. Nothing is sent unless you use the assistant.

5. Address lookup and mapping

To suggest addresses as you type and to estimate driving distance for mileage deductions, we send the address text you enter — and no other account information — to OpenStreetMap-based mapping services (Photon for address suggestions, Nominatim for geocoding, and OSRM for route distance). These requests are made by our server, not your browser, so your IP address is not shared with them. No name, email, or other identifying data accompanies the lookup.

6. Data sharing

We do not sell, rent, or share your personal data with third parties except:

• When required by applicable law or a valid legal process.
• To protect the rights, property, or safety of VARO Industries, our users, or the public.
• In connection with a merger or acquisition, in which case users will be notified.
• With service providers that process data on our behalf, such as Anthropic for the in-app assistant (see Section 4).
• Stripe, to take payments. Stripe receives your billing name, email, address and card details; FairKeep never sees or stores your card number.

7. Data retention

Your account data is retained for as long as your account is active. If you delete your account, all associated data (events, integrations, tokens) is permanently deleted within 30 days. Log data is purged after 30 days on a rolling basis. If you sign up but never confirm your email address, the unconfirmed account and the email address and business name you entered are automatically deleted 14 days after sign-up.

8. Your rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your account and all associated data.
• Object to or restrict certain processing activities.
• Data portability (export of your event data in a standard format).

To exercise any of these rights, email [email protected].

9. Cookies

We use a single httpOnly, Secure, SameSite=Strict cookie to maintain your authenticated session (refresh token). We do not use advertising cookies, tracking pixels, or any analytics cookies.

10. Children

FairKeep is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a minor has created an account, contact us at [email protected] and we will delete it promptly.

11. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you by email or by displaying a notice in the application at least 14 days before the change takes effect. Continued use of the service after that date constitutes acceptance of the updated policy.

12. Contact

Questions or concerns about this policy? Contact us at: