This Privacy Policy explains how Keel Labs (“Keel Labs,” “we,” “us”) collects, uses, stores, shares, and protects information in connection with Bella, our growth-intelligence platform for direct-to-consumer (DTC) ecommerce brands (the “Service”). It also describes the choices and rights you have regarding your information.
Bella connects to the data sources a brand already uses — such as Google Search Console, Google Analytics 4, Google Ads, and Shopify — and turns them into a single ranked queue of recommended actions. To do this, Bella reads data from those sources on the brand’s behalf, with the brand’s explicit authorization.
Contents
01Who we are
Keel Labs, Inc. operates Bella. Our data-protection contact is privacy@keellabs.io. For any request described in this policy, that address reaches the team responsible for handling it.
Our roles. We are the controller for website visitors, access-request applicants, account administrators, and billing contacts (see Section 2). We act as a processor / service provider for the merchant-connected data and merchant end-customer information we process on a brand’s instructions; that processing is governed by our Data Processing Addendum. The platforms a brand chooses to connect (Google, Shopify, Klaviyo, Gorgias, Aircall) are independent source platforms, not our sub-processors.
02Information we collect
Website visitors & access requests
When you submit our access-request form, we collect the company/brand name, your name, work email, role, store URL, annual revenue range, and any growth goals you enter. We use this to evaluate and respond to your request (our legal basis is our legitimate interest in responding to prospective customers, and taking steps at your request prior to a contract). We store these submissions in our database (Supabase) and notify our team via Slack; we retain them for the period needed to evaluate and follow up on the request. Our website also uses Vercel Web Analytics, which processes limited technical data (page URL, timestamp, referrer, approximate region, and browser/device type) without cookies or cross-site identifiers. You are not required to provide the form fields; without them we cannot evaluate an access request.
Account information
When you or your organization create a Bella account, we collect your name, work email, company name, and role. If you subscribe to a paid plan, our payment processor (Stripe) collects billing details; we do not store full card numbers.
Connected-platform data (read access you authorize)
When you connect a data source, you authorize Bella to read data from it. Depending on which sources you connect, this may include:
- Google Search Console — organic search performance: queries, pages, impressions, clicks, and average position (no personal data).
- Google Analytics 4 — aggregated traffic and conversion metrics: sessions, landing pages, channels, and ecommerce totals (no individual user identities).
- Google Ads — campaign, keyword, and search-term performance and spend.
- Shopify — orders, products, and store content. Order records may contain customer information (see Section 4).
- Other sources you choose to connect — such as Klaviyo (email performance), Okendo (product reviews), Gorgias (support ticket subjects), and Aircall (call data). We collect only what each integration requires to produce recommendations, and we minimize identifiers: Gorgias is limited to ticket subject lines, and call data is largely reduced to summaries. Some call records may still include a caller phone number, an agent name or email, or a recording link; we are consolidating these to summary-only and honor verified deletion requests in the meantime.
Usage information
We collect standard product-usage and diagnostic information (pages viewed, actions taken, timestamps, and error logs) to operate and improve the Service. We aim to minimize and avoid personal data in application logs and are implementing centralized log-redaction controls.
03Google user data & Limited Use
Bella’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Data obtained through Google APIs (Search Console, Analytics, and Ads) is used only to provide and improve the user-facing features of Bella — namely, to generate, prioritize, and measure the recommendations you see in the product.
We do not transfer or sell this data to third parties for advertising, resale, or any purpose unrelated to the Service. We do not use it for personalized advertising. We do not use Google user data to train, develop, or improve generalized or standalone artificial-intelligence or machine-learning models. Humans do not read this data except where you have given consent, where required for security or to comply with law, or where the data has been aggregated and anonymized.
You can revoke Bella’s access to your Google account at any time from your Google account permissions page, or by disconnecting the source inside Bella.
04Shopify data
When you connect Shopify, Bella reads orders, products, and store content to measure revenue outcomes and ground recommendations. Order records constitute protected customer data under Shopify’s API terms. We handle it accordingly:
- We access only the scopes required (
read_orders,read_products,read_content) and only for the connected store. - We use order data to compute aggregate commercial signals (revenue, average order value, conversion). We do not build customer marketing profiles and do not sell customer data.
- We honor Shopify’s mandatory data-protection webhooks. On a customer data request we provide the data we hold; on a customer redaction or shop redaction request we delete the associated data from our systems.
05How we use information
- To operate the Service: detect opportunities, generate and rank recommendations, verify changes went live, and measure outcomes over time.
- To maintain security, prevent abuse, and debug problems.
- To communicate with you about your account, billing, and material changes to the Service.
- To improve Bella in aggregate. Any cross-brand learning uses anonymized, aggregated outcome patterns only — never one brand’s identifiable data exposed to another, and never Google user data (see Section 3).
06AI processing
Bella uses large language models (provided by Anthropic) to draft and prioritize recommendations. Data sent for this purpose is processed to produce your results and is not used by the model provider to train its models, per our processing agreement. Consistent with Section 3, Google user data is never used to train AI models.
07Sharing & sub-processors
We do not sell personal information. We share data only with service providers who process it on our behalf under contract, and only as needed to run the Service:
| Sub-processor | Purpose |
|---|---|
| Supabase | Managed Postgres database & authentication (data storage) |
| Railway | Application hosting & compute |
| Vercel | Marketing-site hosting & privacy-friendly web analytics |
| Anthropic | AI model processing for recommendations (does not train on our inputs/outputs; limited retention, generally up to 30 days, for trust & safety) |
| Stripe | Subscription billing & payment processing |
| Slack | Internal notifications, including access-request alerts |
Source platforms you connect (Google, Shopify, Klaviyo, Okendo, Gorgias, Aircall, and similar) are not Keel Labs sub-processors — they are independent services you authorize Bella to read from via their official APIs, under each platform’s own terms and your control.
We may also disclose information if required by law, to enforce our terms, or to protect the rights, safety, and security of users and the public.
08Storage & security
- Encryption: data is encrypted at rest by our managed database provider, and third-party API credentials carry an additional layer of application-level encryption at rest. Data in transit is protected with TLS.
- Tenant isolation: we maintain controls designed to logically isolate each brand’s data, including tenant-scoped application access controls and automated testing of multi-tenant data paths.
- Access control: access to production data is limited to authorized personnel and used only to operate and support the Service.
No system is perfectly secure, but we work to protect your information using industry-standard safeguards.
09Retention & deletion
We retain connected-source and derived data for as long as your account is active, to provide historical baselines and outcome measurement. Disconnecting a source revokes Bella’s future access to it; data already imported or derived is retained until account closure or a verified deletion request, except where retention is required by law. We are rolling out automated per-source purge on disconnect; until then, email us to have a specific source’s data removed. We act on Shopify’s customer-redaction and shop-redaction webhooks within the timeframe Shopify requires: today this deletes the store’s order records we hold and deactivates the connection, and we are extending it to cover derived records so redaction is comprehensive.
To request deletion, email privacy@keellabs.io.
10Your rights
Depending on your location (including under GDPR and CCPA/CPRA), you may have the right to access, correct, delete, or port your personal information, to object to or restrict certain processing, and to opt out of the “sale” or “sharing” of personal information. Bella does not sell personal information. To exercise any right, contact privacy@keellabs.io; we will respond as required by applicable law. Where we act as a processor on a merchant’s behalf (for example, for a store’s customer data), we will route your request to the relevant merchant.
11International transfers
We operate in the United States and may process information there and in other countries where our sub-processors operate. Where required, we use appropriate safeguards for international transfers.
12Changes to this policy
We may update this policy from time to time. Material changes will be reflected by updating the “Last updated” date above and, where appropriate, by additional notice.
13Contact
Keel Labs, Inc. — privacy@keellabs.io. Postal address available on request pending publication.