Privacy
What Kaypo does with your data.
Last updated 11 September 2026.
The short version
Kaypo reads the systems you connect, derives signals from them, and shows you scores built from those signals. It keeps the signal rather than the source material. It does not sell your data, share it with other customers, or use it to train models.
Who is responsible for what
Sapwood LLC operates Kaypo and is based in Arvada, Colorado, United States.
For the data you connect, such as your CRM records and the people in them, you are the controller and Kaypo is the processor. You decide what is connected and why. We process it to run the service for you and for nothing else.
For your own account, such as the name and email of the person who signed up and billing details, we are the controller.
What Kaypo processes
From a connected CRM: deals, companies, people, owners, stages, values, close dates, the activity recorded against them, and whichever custom fields you choose to track.
From connected conversation or intent sources: derived facts only. Whether a meeting happened, how many people attended, whether a topic came up, whether a commitment was made. Kaypo does not store calls, recordings, or transcripts.
From the website tag, if you install it on your own site: the pages a visitor viewed and the company those visits appear to come from. The tag uses a first-party cookie on your domain. Kaypo does not build identity graphs, fingerprint devices, or attempt to name individual visitors who have not identified themselves.
From your use of Kaypo: sign-in records, an audit log of changes made in the workspace, and basic diagnostics needed to keep the service running.
Why we process it
To provide the service you asked for, to bill you, to keep the service secure, and to meet legal obligations. Where the law requires a legal basis, ours is the performance of our contract with you and our legitimate interest in operating and securing the service.
Scoring and automated decisions
Kaypo produces a score for each open deal. That score is a reading of recorded activity and is presented alongside every input that produced it. It is advisory. Kaypo does not make decisions about people, does not evaluate individuals, and does not produce legal or similarly significant effects about anyone.
Who else sees it
Our infrastructure providers, who host the application and the database, and payment processing for subscriptions. Each processes data on our instructions and nothing more.
Where you connect a source that needs enrichment from a third party, that provider receives only what is needed to answer the question asked of it. We do not sell data and we do not share it with other customers.
Data is stored in the United States.
Cookies
Three, and all of them are necessary for the product to work. There is no advertising cookie, no cross-site tracking and no third-party marketing tag anywhere on Kaypo.
kaypo_trial keeps you signed in during a trial. It is signed, readable only by the server, and lasts fourteen days. A trial has no password, so this cookie is how your browser stays connected to your workspace. Clearing it signs you out, and the link in your welcome email is how you get back.
kaypo_slack_state exists for a few minutes while you connect Slack. It carries a single random value that proves the request coming back is the one you started, and it is deleted as soon as the connection completes.
Vercel Analytics counts page views without a cookie and without an identifier that follows you between sites. It records the page, the country and the referrer. If you would rather not be counted at all, we honour Do Not Track.
How long we keep it
For as long as your workspace is active. You can set a shorter retention period in workspace settings. On cancellation, your data remains available for thirty days and is then deleted. Deleting your workspace deletes the data synced into it.
Audit records are kept longer where needed to meet legal or security obligations.
Security
Each workspace is isolated at the database level rather than by application logic, so a query for one customer cannot reach another's records. Credentials for connected services are encrypted at rest. Access is limited to what is needed to operate the service.
Kaypo does not currently hold a SOC 2 report. If that matters to your organization, say so and we will tell you plainly where we are.
Your rights
Depending on where you are, you may have the right to access, correct, delete, or receive a copy of your personal data, to object to processing, and to complain to a regulator. We do not sell personal information or share it for cross-context behavioral advertising.
If you are a person whose details are in a customer's Kaypo workspace rather than a Kaypo customer yourself, that organization is the controller and your request should go to them. Contact us and we will help route it.
Contact
Sapwood LLC, Arvada, Colorado, United States. daniel@sapwood.io