Privacy Policy | Keystone

Introduction

Keystone ("we," "us," or "our") respects your privacy and is committed to protecting your personal information. This Privacy Policy describes how we collect, use, disclose, and safeguard information when you visit our website, use our services, visit our location(s), or otherwise interact with us. It applies to information collected through this website, in person, by phone, or through third-party platforms we use to run our business (e.g., booking or payment processors). By using our website or services, you consent to the practices described in this policy.

1. Information We Collect

We may collect the following categories of information:

Information you provide

Contact and account information – Name, email address, phone number, mailing address, and similar details when you fill out forms, make a purchase, make a reservation or appointment, sign up for our newsletter or other communications, or contact us.
Transaction information – Details of purchases, orders, reservations, or appointments; payment information (e.g., card type and last four digits; full payment details are typically processed by our payment providers and not stored by us beyond what is necessary for the transaction).
Preferences and feedback – Service preferences, dietary or accessibility needs (e.g., for restaurants or events), feedback, reviews, and other information you choose to provide.

Information collected automatically

Usage and device information – IP address, browser type, device type, operating system, pages visited, referring URL, and similar technical data when you use our website.
Cookies and similar technologies – We use cookies and similar technologies as described in the Cookies section below.

Information from other sources

We may receive information from third-party services we use (e.g., reservation or payment platforms, analytics providers) in accordance with their policies and applicable law.

2. How We Use Your Information

We use the information we collect to:

Provide, operate, and improve our products and services.
Process and fulfill orders, reservations, and appointments.
Communicate with you about your orders, reservations, appointments, inquiries, and customer service.
Send you marketing or promotional communications where you have opted in or where permitted by law; you may opt out at any time.
Improve our website, user experience, and business operations.
Comply with legal obligations, protect our rights, and prevent fraud or abuse.
Maintain records of your preferences and consent (e.g., for marketing or text messaging).

3. Information Sharing and Disclosure

We do not sell your personal information. We may share information in the following circumstances:

Service providers – We may share information with third parties who perform services on our behalf (e.g., payment processing, reservation or booking systems, email delivery, website hosting, analytics). These providers are contractually required to protect your information and use it only for the purposes we specify.

Legal and safety – We may disclose information when required by law, court order, or legal process, or when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others, to investigate fraud, or to respond to government requests.

Business transfers – In the event of a merger, acquisition, sale of assets, or similar transaction, your information may be transferred; we will require the recipient to honor this Privacy Policy with respect to your information.

With your consent – We may share information for other purposes with your consent.

3A. Connected Social and Advertising Accounts (Meta Platforms)

This section applies when a Facebook Page, Instagram account, or Meta (Facebook/Instagram) advertising account is connected to power features offered through the Site or our services — for example, publishing posts, scheduling content, running or managing ads, or collecting leads. These features are provided using Keystone, our technology platform; where they are used, Keystone processes the information described below on our behalf as our service provider.

Who this applies to. "You" in this section means the business owner or authorized representative who connects a Facebook, Instagram, or Meta advertising account. People who interact with your connected accounts or submit one of your lead forms (your "End Users") are covered to the extent we receive their information through the connection.

What we receive from Meta. Depending on the permissions you grant, we receive:

Facebook Pages (pages_show_list, pages_read_engagement, pages_manage_posts) — the list of Pages you manage, Page and post metadata, and engagement metrics (likes, comments, shares); and we publish, edit, or delete posts you create through the Site on your behalf.
Instagram (instagram_basic, instagram_content_publish, instagram_business_basic, instagram_business_content_publish) — your connected Instagram professional account's basic profile and media metadata; and we publish content (media and captions) you create through the Site to that account, whether it is connected through Facebook or directly through Instagram.
Meta Ads and Business assets (ads_management, business_management) — the ad accounts and Business Manager assets you grant (Page, Instagram, and ad-account identifiers and role assignments); the ad campaigns, creatives, and audience definitions you create through the Site; and advertising performance and spend data.
Lead Ads (leads_retrieval) — responses submitted to your Meta Lead Ad forms, which may include an individual's name, email address, phone number, and other answers they provide.

How we use it. Solely to provide the features you request: to display your connected accounts and assets; to publish, schedule, edit, or remove content on your behalf; to create, manage, and report on your ad campaigns; and to deliver lead-form responses to you so you can follow up. We do not sell this information, and we do not use it for advertising other than your own.

Who we share it with. We share this information only with service providers (sub-processors) that host and operate the platform on our behalf — including Google Cloud Platform (hosting and database) and Cloudflare (content delivery and security) — each bound by confidentiality and data-protection obligations, and as otherwise described in "Information Sharing and Disclosure" above.

Retention. Content you publish and its related metadata are retained for the duration of the connection and for up to 30 days after you disconnect the account. Advertising performance and spend data are retained for up to 13 months. Lead-form responses are retained until delivered to you and for up to 90 days thereafter, unless you ask us to delete them sooner. Operational logs are retained for up to 90 days.

Our role. For information about your own business and accounts, we act as a controller. For lead-form responses and other End-User information we receive through your connected accounts, you are the controller and we (and Keystone, as our processor) handle that information only on your instructions.

How to delete this information. You may disconnect any Facebook, Instagram, or Meta advertising account at any time from your account settings; on disconnection we stop accessing it and delete the associated information within the retention windows above. To request deletion sooner, or deletion of a specific End User's information, contact us at help@keystone.app. Disconnecting in Keystone and revoking access in your Facebook or Instagram settings each revoke our access.

4. Cookies and Similar Technologies

We may use cookies and similar technologies to operate and improve our website and to understand how visitors interact with our Site. You can usually set your browser to refuse cookies or to alert you when cookies are being sent. If you disable cookies, some features of the Site may not function properly.

5. Data Retention

We retain personal information only as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

6. Your Choices

Depending on your location and applicable law, you may have certain rights regarding your personal information, such as requesting access, correction, deletion, or opting out of certain uses. To make a request, contact us at help@keystone.app.

7. Children's Privacy

Our services are not directed to children under 13 (or other age as required by law), and we do not knowingly collect personal information from children.