Privacy Policy
Who handles your information
Keystone Software Labs LLC, trading as Keystone Labs, is responsible for the personal information we use to run this website and deliver audits and redesigns. Our mailing address is 254 Chapman Road, Ste 208 #22215, Newark, DE 19702, USA. For privacy questions or requests, email audit@keystonelabs.io.
What we collect and where it comes from
When you contact us or buy a service, we collect your name, work email, company, billing details, selected package and any options you choose. Stripe processes the payment and provides the order information we need, including the amount, payment status and transaction reference.
We also use what you or your team share in the brief, such as your website, customer profiles, traffic figures, screenshots, project invitations and feedback. We may review your public website or project materials you authorize us to access. If a colleague adds you to a project, we may receive your name, work email and role from them.
When you visit the site, technical information can include your IP address, referring site, browser, device, pages visited and cookie choices. Our Cookie Policy explains how optional measurement and advertising tools work.
Why we use it
We use order, brief and project details to process payment, answer questions, deliver your files, make included revisions and handle refunds. If you buy directly, we need this information to perform our contract with you. If your company is the buyer, we rely on our legitimate interest in serving the company and communicating with its team.
We also have a legitimate interest in protecting client files, preventing misuse and resolving disputes. We keep invoices and transaction records where required by law. Where consent is required for marketing or advertising tools, we rely on your choice.
Your order email, completed brief and any required access let us deliver the work you purchased. Without the brief or access, the cancellation rules in our Refund Policy apply.
Email and optional WhatsApp updates
We use your order email for your brief, delivery and support. Stripe processes checkout payments. We use Loops to send order updates and promotional emails. If you choose WhatsApp updates, we use the number you provide to contact you about that order. You can ask us to switch back to email.
If you sign up for promotional emails, Loops sends them on our behalf. With your permission, a small image and individually tracked links tell us when a promotional email appears to have been opened and which links were clicked. We use this to measure interest in our campaigns. You can decline or withdraw tracking separately by emailing audit@keystonelabs.io, or unsubscribe from promotions using the link in any marketing email. Order and delivery emails still arrive; we do not track opens or clicks in those emails.
Who receives information
Your brief and project files are available to you, the people you authorize on your team, and Keystone. We may give a project partner access to the information they need to help deliver your order. We also use providers for hosting, Stripe for payments, Loops for email, Figma for designs and WhatsApp if you choose it.
Google Analytics and PostHog help us understand how visitors use our site. With your permission, PostHog also replays interactions on selected public pages so we can find confusing steps. Meta Pixel helps us measure advertising. Depending on your choices, these providers may receive identifiers, page views or conversion events. Our Cookie Policy explains your controls. We may also share records with advisers or authorities where necessary to meet a legal obligation or protect legal rights.
Information in client workspaces
If a client gives us access to analytics, project files or customer records to carry out an audit, we use that access for the client’s project. Where we process personal information on the client’s instructions, the client is responsible for deciding how it is used. If your information appears in a client’s workspace, you can contact that client or email us for help identifying the right contact.
For paid projects, our Terms allow Keystone to show the company name, logo, design work, findings and documented test results in our portfolio and case studies. We may show what changed on a page and how a test performed. Private briefs, account credentials, confidential source data and identifiable customer records stay out of these examples.
International access and storage
Keystone is established in the United States. Project work may be carried out from the United Arab Emirates, and our providers may process information in other countries. For transfers covered by EU or UK data protection law, we must use an applicable transfer mechanism, such as an adequacy decision or appropriate contractual safeguards. Contact us for details about the safeguards that apply to your data and how to obtain a copy.
How long we keep information
We keep your final deliverables, brief, screenshots, private uploads and working files for one year after final delivery so you can retrieve your work and we can answer questions about it. At the end of that year, we delete or anonymize the project files we hold, subject to the exceptions below.
You control Keystone’s access to your tools and can change or revoke it at any time. Finishing the project does not automatically change those permissions. We use access only for work you authorize. Where we process personal data on your company’s behalf, we return or delete it at the end of the service according to your instructions, unless the law requires retention.
We keep invoices and tax records as required by law. If a dispute or legal obligation requires us to preserve a project record longer, we keep only what is needed for that purpose. We may keep a record of your marketing opt-out so we can honor it. Email audit@keystonelabs.io to ask about retention or request deletion.
Your rights and how to exercise them
Depending on where you live, you may ask to access, correct, delete or receive a portable copy of your information, restrict its use, or object to processing based on legitimate interests. You can object to direct marketing or withdraw consent at any time. Withdrawal applies going forward.
Where US state law gives you the right to opt out of targeted advertising or the sale or sharing of personal information, you can submit a request to audit@keystonelabs.io. For optional browser tracking, you can also change your cookie choices.
To exercise a right or raise a concern, email audit@keystonelabs.io and describe your request. We may ask for information to verify your identity. You can also complain to your local data protection authority, including the UK Information Commissioner’s Office if you are in the UK.