Privacy Notice

1. Who is responsible for your information

Keystone Strategic Ltd is the controller of personal information collected through this website and the Keystone services. We are registered in England and Wales under company number 17047166. Our registered office is 8 Snowdrop Gardens, Whittlesey, Peterborough, England, PE7 2GX and our trading address is 4 Benwick Road, Whittlesey, PE7 2HD.

Privacy questions and requests can be sent to [email protected].

2. Information we collect

Depending on how you use Keystone, we collect:

• your name, work email, telephone number and communications with us;
• company, workspace, selected product, package and expected team size;
• account identifiers, permissions and authentication events;
• subscription status, billing dates, Square customer and subscription references, card brand and last four digits;
• business records and other content authorised users enter into a Keystone workspace; and
• technical and security information such as IP address, browser, device, request and error logs.

Passwords are handled by Supabase authentication and are not readable by Keystone. Full card numbers and security codes are entered into Square's secure payment form and are not stored in Keystone's database.

3. Why we use it and our lawful bases

• Contract: to create accounts, provide trials, operate workspaces, take authorised payments and support subscriptions.
• Legitimate interests: to answer business enquiries, secure and improve the service, prevent misuse and manage customer relationships.
• Legal obligation: to keep appropriate company, tax, accounting and compliance records and respond to lawful requests.
• Consent: where we specifically ask for it, for example for optional direct marketing. Trial and service emails are not marketing.

We do not use personal information for solely automated decisions with legal or similarly significant effects.

4. Who receives information

We share only what is needed with service providers that help us operate Keystone, including Supabase for database and authentication services, Square for card and subscription processing, Resend for transactional email, and OpenAI and Cloudflare for website hosting, delivery and security. Professional advisers and authorities may receive information where reasonably necessary or legally required.

Some providers may process information outside the UK. Where required, we rely on an applicable adequacy decision or contractual safeguards approved for UK data protection law. Contact us if you would like more information about those safeguards.

5. How long we keep it

We keep account and workspace information while the service is active and for a reasonable period afterwards to provide support, resolve disputes and protect the service. Contract, invoice and payment records may be retained for up to six years. Uncompleted trial and enquiry records are reviewed and normally deleted when no longer needed. Security and provider logs are retained for the periods needed to investigate incidents and operate the service.

We may retain information for longer where law, a dispute, fraud prevention or a legitimate legal claim requires it. We delete or anonymise information when it is no longer needed.

6. Your rights

Depending on the circumstances, you may ask for access to your personal information, correction, deletion, restriction, portability or an objection to processing. Where processing relies on consent, you can withdraw that consent at any time. These rights can be limited where an exemption or another person's rights apply.

Email [email protected] to exercise a right. We may need to verify your identity. You can also complain to the Information Commissioner's Office, the UK data protection regulator.

7. Cookies and local storage

Keystone uses essential technical storage needed for security, account flows and payment setup. The trial pages may remember the selected product on your device so the next step opens correctly. We do not currently use advertising cookies. If we add non-essential analytics or marketing technology, we will update this notice and seek consent where required.

8. Security, children and changes

We use access controls, encryption in transit, hosted authentication and restricted administration to protect information. No online service can guarantee absolute security. Keystone is a business service and is not intended for children.

We will update this notice when our processing changes and publish the new effective date here. Material changes will be brought to customers' attention where appropriate.