What Kept records, and what it refuses to.

01Who this covers

Three groups of people appear in Kept, and they have different relationships to it.

The hotel is our customer. It decides to use Kept, decides who gets an account, and decides what is done with the record. In data protection terms the hotel is the controller of its staff's information, and JQT is a processor acting on the hotel's instructions.

The staff are the people whose work Kept records. They did not sign the contract. Most of the information in Kept is about them, so most of this document is about them.

Guests are not users of Kept and Kept is not told who they are. They appear only in the sense that a room they are staying in has a status, and that a photograph of something broken in a room may be taken while they are checked into it. Section 3 is the specific commitment.

02What Kept holds

This is the whole list, written from the actual database rather than from a category. If something is not here, Kept does not store it.

Category	Exactly what is stored
Staff account	Display name (usually a first name), sign in name, role, whether the account is active, preferred language, and the date it was created.
Credentials	A PIN or password that has been put through scrypt with a salt unique to that person. The original is never stored and cannot be recovered from what is stored, including by us.
Work record	Room number, service type, housekeeping and occupancy status, who a room was assigned to, when work started, when it finished, which checklist zones were completed, and notes typed by staff or carried in from the morning report.
Photographs	Images taken inside rooms and attached to a maintenance fault, a lost item, or a step of a project. Stored with the room, the time, and who took them.
Maintenance	Fault category, the note describing it, attached photographs, who raised it, who resolved it, when, and the resolution note.
Lost and found	Description of the item, where it was found, who found it, where it is being held, and how it was closed out.
Supplies	Item, location, counts, and who reported something low or out.
Safety alerts	Who raised the alert, the room they were in, when it was raised, who acknowledged it, when it was stood down, and any note added at the end.
Audit log	Every action above, as an entry naming the person, the room, the time, and the type of event, chained by hash to the entry before it.
Sessions	A session token per surface, the account it belongs to, and its expiry. Held in a cookie on the device.
Fault reports	When Kept breaks in a browser: the error type and message, which screen, which path, the role of whoever hit it, and the version. One row per distinct fault with a count, not one row per person.

03What Kept does not hold

These are commitments, not an absence we happened to notice. Each one is a decision that shaped how the software was built.

• No guest names, reservations, or payment information. Kept reads the morning room status report the property already runs, and takes from it only the room number, the service type, and the status words. The uploaded report is parsed and not retained as a file.
• No location tracking. Kept never asks the phone where it is. When a safety alert names a room, it is the room the person opened, not a position from the device.
• No background activity. Kept does nothing when it is closed. No background refresh, no push tracking, no listening.
• No contacts, no microphone, no photo library access. See section 4.
• No biometrics. No face, no fingerprint, no voice.
• No advertising technology and no third party analytics. There is no tracking pixel, no advertising identifier, and no analytics service inside the product.
• No sale of data, ever, and no sharing for anyone else's marketing.
• No training of AI models on your property's data. Kept ships with its AI provider set to none, and if a property ever turns an assistive feature on, that is a decision the property makes explicitly and can reverse.

04What Kept can see on a personal phone

Kept runs in the phone's browser and can be added to the home screen. It is not an app store application and it does not ask for the permissions one would.

When a photograph is taken for a maintenance fault, the camera is opened by the browser and the image is uploaded to the property's record. It is not written to the phone's photo library. This matters because the alternative, which is common in this category, means asking someone to keep photographs of a stranger's bathroom in the same camera roll as pictures of their family.

When there is no signal, taps are held in the phone's own storage until the connection returns, then sent and cleared. The single exception is a safety alert, which is never held: if it cannot reach the server, the screen says so and tells the person to use the radio instead.

05Why each thing is recorded

Kept records four kinds of thing, for four reasons.

• To run the operation. Assignments, statuses, and times are what the board is made of. Without them there is no product.
• To prove the record. The audit log exists so that "who cleaned 214 and when" has an answer that does not depend on anyone's memory or honesty, including ours.
• For safety. Alerts are recorded so that raised, seen, and stood down are three separate facts. Nobody came and nobody was told are different failures and they need to be distinguishable afterwards.
• To fix Kept. Fault reports exist because the people most likely to hit a bug are the least likely to report one. They are grouped by fault, not by person.

06Who can see what

Access is granted per person, not baked into a job title.

• Floor staff see the rooms assigned to them, their own checklists, and what they have reported. They do not see other people's performance, the audit log, or the back office.
• The front desk sees room readiness and who is currently in a room. It does not see the audit log.
• Managers and owners see the whole property, including the audit log and its verification.
• JQT can reach the server that runs your property, because we operate it. We access property data to keep the service running, to investigate a fault, or when you ask us to. We do not read it otherwise, and every action taken inside the application lands on the same audit log that everything else does.

07The log, and what cannot be deleted

This is the part most privacy policies would leave vague, so it gets said plainly.

Kept's audit log is append only and hash chained. Each entry is built from the one before it, so removing or altering a single entry breaks every entry after it, visibly. Once a day the head of that chain is sent to public timestamp authorities, which sign a statement that this history existed at that minute.

That design is the product. It is also a real limit on deletion, and pretending otherwise would be dishonest.

If you are subject to a legal regime that requires erasure of an individual's data on request, tell us before you deploy Kept, not after. We will tell you honestly whether Kept can meet that obligation for you. For some customers the answer will be that it cannot.

08Where the data lives

One property, one database, on a server we operate in the United States. A property's data is not pooled with any other property's.

Backups run once a day and the most recent fourteen are kept. Transport is encrypted. Photographs are served only to a signed in user whose property matches the record, and the file path is rebuilt from the database row rather than taken from the address, so a photograph cannot be fetched by guessing a filename.

09Everyone outside JQT who touches it

The full list, with what each one actually receives.

Who	What they get
DigitalOcean	Hosts the server. They hold the disk the database sits on, in the ordinary way any host does.
DigiCert	One SHA-256 hash, once a day. No names, no rooms, no photographs, no content of any kind. A hash cannot be turned back into what it summarises.
FreeTSA	The same single hash, for the same reason. Two authorities rather than one, because an anchor that depends on a single free service stops working the day that service does.
Google Fonts	Applies to this public website only, not to the Kept application. Your browser fetches two typefaces from Google, which means Google sees your IP address when you read this page. We are moving to self hosted fonts to close this.

There is no one else. No analytics vendor, no advertising network, no data broker, no offshore support desk.

10How long it is kept

• The audit log: for as long as the property uses Kept, and then until the hotel instructs us to delete the database. It is the record, and it is not pruned.
• Photographs: the same, unless deleted individually.
• Backups: the most recent fourteen days.
• Sessions: until they expire or the person signs out, whichever is first. Changing someone's access ends their sessions immediately.
• Fault reports: kept while the fault is open, and cleared when it is resolved.

11Your rights, and how to use them

If you are staff at a property that uses Kept, your employer controls your record. Ask your manager first, because most of what you might want is something they can do from the back office in under a minute. If you would rather not go through your employer, write to us at the address below and we will tell you what we hold about you and pass your request to them.

You may ask for a copy of what Kept holds about you, ask for a display name or language to be corrected, ask for your account to be deactivated, and ask for a photograph to be removed. Section 7 sets out honestly what deletion can and cannot mean here.

We do not charge for any of this and we do not require a particular form of words.

12This website

jqtenterprises.com sets no cookies, runs no analytics, and has no tracking pixels. It loads two typefaces from Google Fonts, which is the one disclosure in section 9. If you email us, we hold the email. That is the whole of it.

13Changes, and contact

If we change this policy in a way that alters what Kept records or who receives it, we will tell the properties using it directly rather than relying on a new date at the top of a page. The version number above changes with it.

JQT Enterprises, LLC, 1314 E Las Olas Blvd, PMB 2880, Fort Lauderdale, Florida 33301. Write to [email protected] and a person will answer.