Privacy Policy

1. About this policy

DrukKeep is a software service under development and operated from Thimphu, Bhutan. It helps users record document information, monitor expiry dates, organize records in workspaces, and receive reminders.

This Privacy Policy explains what information DrukKeep collects, why it is collected, how it is used, and the choices available to users.

DrukKeep's legal operator information will be updated before commercial launch and after the relevant business registration is completed.

2. Information we collect

Depending on how you use DrukKeep, we may collect the following information:

• Account information, including your email address, username, password credentials maintained through the authentication system, and account status.
• Workspace information, including workspace names, workspace types, membership, and assigned roles.
• Document-record information that you enter, such as document titles, categories, reference details, issue dates, expiry dates, notes, and reminder settings.
• Document files you choose to upload, including images and PDF copies, together with file names, types, sizes, and upload dates.
• Information about invitations, workspace sharing, and other actions performed through your account.
• Technical and security information, such as IP addresses, request information, security events, error logs, and other diagnostic data needed to operate and protect the service.
• Communications you send to DrukKeep, including support, privacy, security, and account-related requests.

DrukKeep currently focuses on document records and expiry reminders. Users should not upload or enter information that is unnecessary for these purposes.

3. How we use information

We may use information to:

• Create, authenticate, and secure user accounts.
• Provide document tracking, workspace, and reminder features.
• Send account confirmation, password recovery, security, invitation, and document-reminder emails.
• Respond to support, privacy, and account requests.
• Detect misuse, investigate security events, and protect DrukKeep and its users.
• Diagnose errors and improve the reliability, security, and usability of the service.
• Meet applicable legal and regulatory obligations.

DrukKeep does not sell users' personal information.

4. Workspaces and shared information

DrukKeep may allow users to create workspaces and invite other people to participate. Information placed in a shared workspace may be accessible to other authorized members of that workspace according to their assigned roles.

Before adding information about another person, you should have the necessary authority or permission to do so. You are responsible for choosing appropriate workspace members and reviewing their access.

Do not share passwords or allow another person to use your account.

5. Email communications

DrukKeep may send emails required to operate the service, including email-confirmation messages, password-reset links, workspace invitations, security notices, and expiry reminders.

Delivery of an email reminder cannot be guaranteed. Messages may be delayed, rejected, filtered as spam, or affected by circumstances outside DrukKeep's control. Users remain responsible for monitoring their documents and completing renewals on time.

6. Cookies and authentication

DrukKeep uses cookies and related technologies required for account authentication, session management, security, and essential site functionality.

Disabling essential cookies may prevent account login or other parts of the service from working correctly.

7. Service providers

DrukKeep may use trusted service providers for infrastructure, hosting, databases, email delivery, security, monitoring, and other functions necessary to operate the service.

These providers may process limited information on DrukKeep's behalf. They are given access only as reasonably necessary to provide their services, subject to their applicable agreements and privacy practices.

The specific providers used by DrukKeep may change as the service develops. This policy will be updated when material changes affect how users' information is handled.

8. Data storage and international processing

DrukKeep's infrastructure or service providers may store or process information outside Bhutan. Where external providers are used, DrukKeep will select them with consideration for security, reliability, and appropriate handling of information.

Users should understand that privacy and data-protection requirements may differ between jurisdictions.

9. Data retention

Information is retained for as long as reasonably necessary to provide the service, maintain security, resolve disputes, meet legal obligations, and protect legitimate business interests.

Some information may remain temporarily in backups, security records, or system logs after it is removed from the active service.

10. Account deletion

Users may request or initiate account deletion through the available account-management features or by contacting DrukKeep.

Account deletion may be restricted until shared workspaces, memberships, or records involving other users are properly transferred, removed, or otherwise resolved. This helps prevent accidental loss of information belonging to other workspace members.

DrukKeep may need to retain limited information where required for security, fraud prevention, dispute resolution, recordkeeping, or applicable legal obligations.

11. Security

DrukKeep uses reasonable technical and organizational safeguards intended to protect user information, including account authentication, access controls, and security monitoring.

No internet service or storage system can guarantee absolute security. Users should choose a strong, unique password, protect access to their email account, and notify DrukKeep if they suspect unauthorized access.

12. Children's privacy

DrukKeep is not intended for independent use by children under 18. A parent, guardian, or other authorized adult should manage information relating to a child.

If you believe that a child has created an account or supplied information without appropriate authorization, please contact DrukKeep.

13. Your choices and requests

Subject to applicable requirements and technical limitations, users may request help to:

• Access or review their account information.
• Correct inaccurate information.
• Delete their account or personal information.
• Report unauthorized access or misuse.
• Ask how their information is being handled.

DrukKeep may need to verify the requester's identity before completing a privacy or account-related request.

14. Changes to this policy

This Privacy Policy may be updated as DrukKeep develops, introduces new features, changes service providers, or responds to legal or operational requirements.

The updated version will be published on this page with a revised effective or last-updated date. Material changes may also be communicated through the service or by email where appropriate.