Privacy, explained in plain English.

What Keystone collects and why.

Keystone may collect the name, email address, phone number, organisation, website, preferred contact details and business context you provide through a form, email or conversation. That can include the work you want help with, your goals, constraints and records of later proposals or delivery discussions.

If you use an AI receptionist or lead-capture experience, Keystone may also receive the messages, answers, consent confirmation and handoff notes produced during that interaction. The website records cookie-free usage information such as pages visited, referral sources and calls to action used. Analytics events are designed not to contain names, email addresses, phone numbers, message text or raw lead IDs.

This information is used to respond, decide whether Keystone is a sensible fit, prepare or perform agreed work, keep proportionate business records, secure and improve the service, and understand which parts of the website are useful.

The lawful basis depends on the job.

Enquiry information is normally processed because it is necessary to take steps you request before a possible contract. Client information is processed to perform an agreed contract. Legitimate interests may apply to securing the service, keeping proportionate records, understanding website use and following up an existing business conversation. Legal obligations may apply to accounting, tax or dispute records. Where consent is the appropriate basis, it can be withdrawn at any time.

Where information goes.

Information may be stored or processed in the systems Keystone uses to operate enquiries and client work, including Supabase, email, CRM and workflow tools. AI-assisted features may use a model provider such as MiniMax and should be limited to approved business information with human handoff for sensitive, urgent or uncertain questions.

Keystone does not sell personal information. Providers should receive only what is reasonably necessary for their role. Where a provider processes information outside the UK, Keystone should use the applicable UK transfer mechanism and proportionate contractual and security safeguards.

Retention follows the reason for keeping it.

Retention depends on whether an enquiry remains active, whether you asked Keystone to follow up, whether work was agreed, and whether accounting, legal, security or dispute records must be kept. Information no longer needed for those purposes should be deleted or anonymised. AI receptionist transcripts use a default 90-day pilot retention period unless a client agreement sets a different route.

Your information, your choices.

Depending on the circumstances, you may ask for access, correction, deletion, restriction or transfer of your information, or object to processing based on legitimate interests. You may withdraw consent where consent is used.

Email privacy@keystonehq.xyz to make a request. Do not include passwords, payment details, health information or other highly sensitive material in the first message.

You can also complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint. Keystone would still appreciate the chance to address the concern directly first.