Data policy.
Last Updated: October 2, 2026
This Data Policy describes the security practices Zero Processing Fees LLC, doing business as Keep The Fees ("KTF") applies to the information it holds through the Keep The Fees platform. It forms part of KTF's agreement with each Shop and each Individual User to the extent applicable to their respective use, alongside the Terms of Service and the Privacy Policy. It covers Shop records and User Account Data, including records about people who do not hold platform accounts. It describes KTF's current practices.
Capitalised terms have the meanings given in the Terms of Service.
1. Hosting
The Services are hosted with a major cloud infrastructure provider. That provider supplies the physical and network security of its data centres, and KTF configures and operates its own environment within them.
2. Encryption
KTF maintains encryption of data in transit and at rest using industry-standard methods: data moving between users and the Services is encrypted using TLS/HTTPS, and data stored in the databases that hold Shop Data, Client Data, Artist Data, and User Account Data is encrypted at rest.
3. Access control
Access to the Services and their underlying infrastructure is granted on a role basis. Users are assigned roles and permissions that correspond to their responsibilities, and access is limited to what those responsibilities require. Shops control access to their own business records. Individual Users have access only through active, authorised Shop relationships and within the permissions each Shop grants. Ending a Shop relationship ends access through that Shop; account and supporting records may remain as described in Section 8.
4. Administrative access logging
Administrative access to production systems and data is logged.
5. Monitoring and review
KTF monitors its security practices on an ongoing basis and reviews them as the Services, the threat environment, and applicable requirements change. KTF may modify its safeguards from time to time.
6. Service providers
KTF engages providers to process information on its behalf, including the Marketing Provider for embedded marketing delivery. KTF will require written confidentiality and data protection obligations no less protective than those applicable to the processing and take reasonable steps to assess, monitor, and address compliance. Those are KTF's own undertakings, not a guarantee of a provider's performance. For personal information processed on a Shop's behalf, the Data Processing Addendum governs provider contracts, oversight, and provider information. KTF retains any responsibility the law makes nondelegable. A provider independently engaged to process on a Shop's instructions operates under its own agreement for that processing; merely enabling a KTF feature does not change the role.
For parties bound by the Terms of Service, Section 39.8 excludes monetary liability for provider-related losses to the extent permitted by law, with the other damages exclusions, cap, and exceptions in Section 39 applying as provided there. This allocation does not reduce KTF's stated safeguards, contracting and oversight duties, or any nondelegable responsibility, and does not limit nonwaivable rights or regulatory powers.
7. Security incidents
If a security incident affects a Shop's data, KTF notifies the Shop as required by Section 501.171, Florida Statutes, or within such shorter period as applicable law requires. KTF provides the information reasonably available at the time of notification (the nature of the incident, the categories of data involved, and the steps taken) and supplements it as the investigation progresses. Notification is not an acknowledgment of fault.
For Client Data and Artist Data processed on a Shop's behalf, KTF notifies the Shop and provides information it needs to meet its own notification duties. KTF also provides any notice it is legally required to give directly to affected individuals or authorities, including for incidents involving User Account Data.
8. Retention and deletion
KTF retains Shop, Client, and Artist Data for as long as the Shop's account is active and as needed to provide the Services. After termination, the Shop may request an export within fourteen (14) days, and KTF uses commercially reasonable efforts to provide it within fifteen (15) business days of a valid request. After that period KTF has no obligation to retain the Shop's data, as described in Section 43 of the Terms of Service and the Privacy Policy. Aggregated Data, which identifies no Shop or individual and excludes all Health Information, may be retained indefinitely.
User Account Data and electronic agreements and supporting acceptance, consent, security, or audit information actually captured by the Services are retained for the duration of the relevant service relationship, as described in Section 10 of the Privacy Policy. A user's departure does not erase the Shop's records. After the relevant relationship ends, those records are subject to the applicable deletion process and limited exceptions for legal, tax, regulatory, claims, and opt-out purposes described there.
9. Account responsibilities
The Shop is responsible for the security of its own devices, networks, and credentials; for configuring user permissions appropriately; for the security of its designated endpoints; and for the independent processing of recipients it engages under Section 17.5 of the Terms. KTF's own express duties and nondelegable legal responsibilities remain as described in Section 6 above, subject to the monetary liability provisions stated there.
Each Individual User is responsible for protecting their own credentials and devices and for using only the access authorised by the relevant Shop.
10. Google API services
Where the Services connect to Google APIs, KTF's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
11. Questions
Questions about this Policy may be sent to [email protected].
12. Changes to this Policy
Changes to this Policy follow Section 47 of the Terms. Any notice or consent separately required by law remains required.