Privacy Policy

1. Scope and Roles

1.1 Covered Services. This Privacy Policy applies to all data collected through the KeyBolt website (keybolt.tech), the KeyBolt web application, transactional emails sent via the Service, SMS messages sent via the Service, voice calls placed or received through KeyBolt Pro, call recordings and transcripts, the customer portal, and any related APIs or integrations.

1.2 Data Controller vs. Data Processor. When a locksmith shop (“Subscriber”) uses KeyBolt to manage their customers, the Subscriber is the data controller and KeyBolt acts as the data processor on behalf of the Subscriber. When KeyBolt collects data directly from Subscribers for account management, billing, and support purposes, KeyBolt is the data controller. A Data Processing Addendum (DPA) is available upon request for GDPR compliance, as referenced in our Terms of Service.

1.3 End Customers. If you are a customer of a locksmith shop that uses KeyBolt (an “End Customer”), your data is primarily governed by the locksmith shop’s own privacy practices. KeyBolt processes your data on the shop’s behalf. For questions about how your data is used, please contact your locksmith directly. For questions about how KeyBolt processes data on behalf of locksmith shops, you may contact us at the address in Section 18.

2. Information We Collect

2.1 Information You Provide Directly. We collect information that you voluntarily provide when you register for an account, use the Service, or contact us:

• Account information: Name, email address, phone number, business name, business address, and password.
• Business data: Customer records (names, addresses, phone numbers, emails), job details, invoices, estimates, payment records, inventory items, team member information, job photos, and documents.
• Sensitive locksmith data: Key codes, bitting data, safe combinations, transponder chip information, key blank references, and vehicle access data entered into customer records.
• Identity verification data: For lockout jobs, photos of identification documents and proof of residence/ownership uploaded by techs.
• Payment information: Credit card and billing details for your KeyBolt subscription (processed by Stripe; we do not store full card numbers). Payment details your customers provide to pay invoices are processed entirely by Stripe.
• Communications: Any messages, feedback, or support requests you send to us.
• Voice and SMS data (Pro plan only): If your shop uses KeyBolt Pro, we process inbound and outbound call audio, call recordings, automatically generated call transcripts (English and Spanish), DTMF keypad presses (transfer codes), caller-ID numbers, call duration and routing metadata, two-way SMS message content sent and received through the platform, and auto-reply templates configured by your shop. Call recordings are stored by Telnyx (the underlying carrier) on its own infrastructure under its retention schedule; KeyBolt does not retain a copy of the call audio in its own storage unless your shop explicitly clicks “Save Permanently” on a specific call or enables automatic archiving (KeyBolt Pro). See Section 8a.6 for the full retention story. Transcripts and call metadata are stored on the call record on KeyBolt’s side.
• Online store and request-form data: When a Subscriber turns on their public online store, “request a service” form, or public shop page, people who buy a product or submit a request through those KeyBolt-hosted pages provide a name, email address, and phone number, plus a shipping address for shipped orders, together with the items ordered and the amount paid. Card details are handled entirely by Stripe; KeyBolt does not store card numbers. This buyer and requester information is stored on the order or lead record, is visible to the Subscriber who operates that store or form, and is permanently deleted when that Subscriber deletes their KeyBolt account.

2.2 Information Collected Automatically. When you access the Service, we automatically collect certain technical information:

• Device and browser data: IP address, browser type and version, operating system, device type, screen resolution, and language preferences.
• Usage data: Pages visited, features used, click patterns, time spent on pages, referring URLs, and navigation paths.
• Log data: Server logs including request timestamps, HTTP methods, response codes, and request durations.

2.3 Information from Third Parties. We may receive limited information from third-party services:

• Stripe: Subscription status, payment confirmation, and Connect account verification status.
• Google Places API: Address autocomplete suggestions when you type an address into the Service. Google receives the partial address text you type; we do not send any other customer data to Google.
• Google Ads API (Local Services Ads): For Subscribers who connect their Google Local Services Ads account, we receive lead metadata (lead identifier, type, status, category, service, creation timestamp, charge state) and the message content of any messages or call transcripts the lead and Subscriber exchange via Google’s Local Services platform. On our current access tier, Google does not return the lead’s name, phone number, or email address through its API; those become visible to the Subscriber only inside Google’s own Local Services dashboard. This data is used only to surface LSA leads in the Subscriber’s KeyBolt inbox and to deliver replies they compose back through the API. Use of this data adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• Cloudflare Turnstile: Bot detection signals during account signup, password recovery, contact form submission, and customer portal authentication (no personal data is shared; only a challenge token is verified).

3. How We Collect Information

3.1 Direct Collection. We collect information directly from you when you create an account, fill out forms, enter data into the Service, upload files, send us correspondence, or make a purchase.

3.2 Automated Collection. We use cookies and similar technologies to collect usage data automatically when you interact with the Service. See Section 7 for details on cookies and tracking technologies.

3.3 From Your Use of the Service. When Subscribers use KeyBolt to manage their locksmith business, the data they enter about their customers, jobs, and operations is stored and processed by us on their behalf.

4. How We Use Information

4.1 To Provide and Maintain the Service. We use your information to operate the platform, process transactions, send invoices, deliver SMS and email notifications, manage team accounts, track inventory, generate reports, and provide customer support.

4.2 To Process Payments. We use Stripe to process KeyBolt subscription payments and to process payments from End Customers on behalf of Subscribers via Stripe Connect and Stripe Invoicing. Payment data is shared with Stripe as necessary to complete transactions.

4.3 To Communicate with You. We use your contact information to send transactional emails (invoice confirmations, payment receipts, team invitations, password resets), service announcements, and responses to your inquiries.

4.4 To Improve the Service. We analyze aggregated, de-identified usage data to understand how the Service is used, identify bugs, improve features, and develop new functionality. Sensitive locksmith data (key codes, bitting, safe combinations) is never included in analytics.

4.5 To Ensure Security. We use technical information to detect fraud, prevent abuse, enforce rate limits, maintain audit logs, and protect the integrity of the Service and your data.

4.6 To Comply with Legal Obligations. We may process your information as required by applicable law, regulation, legal process, or governmental request.

4.7 AI Features. KeyBolt includes several AI features. First, an in-app AI helper answers questions about your own shop’s data; when you send a message, the text of your message and the related business records the helper needs to answer (such as jobs, customers, and invoices) are sent to our AI provider to generate a reply. Second, an AI email job-draft reads inbound customer emails received in your Colab inbox (the sender name and address, the subject, and the first portion of the message body) and suggests a pre-filled job for your review. Third, on KeyBolt Pro, your call transcripts are automatically processed by the same AI provider after a call to produce a short call summary and to suggest structured fields (such as a customer name or job type) from the call. These features run through the Vercel AI Gateway, currently to Google (Gemini models); separately, KeyBolt currently uses OpenAI embedding models through the same Gateway to index your records for search. We send only the data needed for each request. We never send the key-code, bitting, or safe-combination fields stored on customer records; note, however, that content you type or upload into the AI knowledge base is sent as-is, so do not paste those secrets there. We do not use your content to train AI models, and we direct our AI providers, through the Vercel AI Gateway, not to use your prompts or their outputs to train their models. A provider may retain this data briefly to operate the feature and to detect abuse under its standard API terms, after which it is deleted. These AI features are assistive only. A person at your shop reviews and confirms any suggestion before it is acted on, so no job, invoice, or other consequential action is created solely by automated means. KeyBolt stores your AI helper conversations and any suggested job draft inside your own account; the Data Retention section describes how long. If we change or add an AI provider, we will update the sub-processor list at keybolt.tech/subprocessors with at least 30 days’ advance notice, the same as for any other sub-processor change.

5. Sensitive Locksmith Data Handling

We recognize that key codes, bitting data, safe combinations, and related security information are extraordinarily sensitive. Unauthorized disclosure could compromise the physical security of homes, businesses, and vehicles. We apply the following enhanced protections to this data:

5.1 Encryption. All sensitive locksmith data is encrypted at rest in the database and encrypted in transit using TLS. Database backups containing this data are also encrypted.

5.2 Access Isolation. Sensitive locksmith data is protected by row-level security (RLS) policies in the database. Only authenticated users belonging to the same organization can access their organization’s data. No other Subscriber can view your data. KeyBolt employees cannot view key codes, bitting data, or safe combinations.

5.3 Exclusion from Logging and Analytics. Sensitive locksmith data is never written to application logs, error reports, analytics systems, or debugging tools. Log redaction rules are enforced at the application layer.

5.4 No Third-Party Transmission. The key-code, bitting, and safe-combination fields stored on a customer record are never transmitted to any third-party service. They are stored exclusively in our Supabase (PostgreSQL) database and are never sent to Stripe, Telnyx, Resend, Vercel, Google, our AI provider, or any other external provider, and the AI features described in Section 4.7 exclude those fields from what they send. One exception: content you type or upload into the AI knowledge base is sent to the AI provider as you wrote it, so you should not paste key codes, bitting, or safe combinations into the knowledge base.

6. How We Share Information

6.1 Service Providers. We share data with the following third-party service providers, strictly as needed to operate the Service. A current list with country of processing is maintained at keybolt.tech/subprocessors; we will provide at least 30 days’ advance notice on that page before adding any new sub-processor.

• Supabase (database, authentication, and file storage hosting) — stores all application data including account information, business data, and encrypted sensitive locksmith data. Supabase provides the PostgreSQL database and authentication infrastructure.
• Stripe (payment processing) — receives customer names, email addresses, invoice line items, and payment amounts to process KeyBolt subscription payments and End Customer invoice payments via Stripe Invoicing and Stripe Connect. Stripe’s privacy policy governs their handling of payment card data.
• Telnyx (telecommunications carrier and recording / transcription processor): on the KeyBolt Pro tier, Telnyx receives End Customer phone numbers, full call audio, SMS content, and DTMF keypad input. Telnyx generates and stores the call recording on its own infrastructure under its retention schedule (typically 30 days on the Telnyx CDN after which the recording is removed by Telnyx); KeyBolt persists only the call metadata and the multilingual transcript (English and Spanish) on the call record. On KeyBolt Pro, that transcript is also processed by our AI provider to generate a short call summary and suggested fields (see Section 4.7). KeyBolt does not retain a copy of the call audio in its own object storage unless a Subscriber explicitly clicks “Save Permanently” on a specific call or enables automatic archiving (KeyBolt Pro). See Section 8a.6 for the full retention story. Telnyx is also used to send transactional SMS (appointment reminders, “On My Way” notifications, invoice links). Each shop runs through its own Telnyx subaccount; voice + SMS usage is billed by Telnyx at carrier rates without markup. Telnyx’s privacy policy governs their handling of call audio: telnyx.com/privacy-policy.
• Resend (email delivery) — receives recipient email addresses and email content for transactional email delivery (invoices, payment receipts, team invitations, overdue reminders, estimate notifications, low stock alerts).
• Vercel (application hosting and analytics) — processes HTTP requests and serves the web application. Vercel receives standard HTTP request data (IP address, headers, request path). Vercel Analytics collects anonymous page view metrics (page URL, referrer, country) without using cookies or collecting personally identifiable information.
• Google Places API (address autocomplete) — receives partial address text typed by users to provide address suggestions. No customer names, phone numbers, or other personal data is sent to Google.
• Google Ads API / Local Services Ads (lead synchronization for Subscribers who connect a Google Local Services Ads account) — when a Subscriber explicitly authorizes the connection via OAuth, KeyBolt receives lead metadata from the Google Ads API on their behalf, including the lead identifier, lead type, status, category, service, creation timestamp, and the message content of any conversation rows the lead and Subscriber exchange via Google’s Local Services platform. On our current Google API access tier, the End Customer’s name, phone number, and email address are not returned to KeyBolt — those fields remain visible only inside Google’s own Local Services dashboard. We use the data we do receive only to display LSA leads in the Subscriber’s KeyBolt inbox and to send replies the Subscriber composes back to the lead through the same API. We do not share Google LSA lead data with any third party, use it for advertising, or sell it. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Subscribers can disconnect the integration at any time from Settings, which immediately revokes our OAuth tokens and stops all further data sync.
• Google Merchant Center / Content API (online storefront product listings) — for Subscribers who connect a Merchant Center account, receives the shop’s product catalog (item names, descriptions, prices, and images) to list those products on Google. No End Customer personal information is sent to Merchant Center. Subscribers can disconnect at any time from Settings, which revokes our access.
• Sentry (error tracking, performance monitoring, and session replay) — receives error traces (without personally identifiable information), browser metadata, performance data, and session replay recordings (sampled at 10% of all sessions and 100% of sessions where an error occurs, with all text, form inputs, and media masked to prevent capture of readable content) for debugging and application reliability. Sentry may use cookies for session tracking during error reports and replay sessions. Full privacy policy: sentry.io/privacy.
• Cloudflare (bot detection via Turnstile) — receives IP addresses, browser fingerprint data, and challenge tokens during CAPTCHA verification on signup, login, and password reset forms. Cloudflare uses this data to distinguish human users from automated bots. Full privacy policy: cloudflare.com/privacypolicy.
• OpenStreetMap Foundation (Nominatim) (address geocoding) — receives job and customer addresses to convert them into latitude / longitude coordinates for the route-planning map. The lat/lng result is cached locally for 30 days, keyed on a SHA-256 hash of the address — KeyBolt never re-stores the address itself in the cache. Located in the United Kingdom. Operations policy: operations.osmfoundation.org/policies/nominatim.
• Project OSRM (multi-stop route optimization) — receives only stop coordinates (lat/lng pairs) when a tech requests an optimized route across multiple jobs. No customer names, addresses, phone numbers, or other personal data is sent. Located in Germany. More information: project-osrm.org.
• OpenFreeMap (map tile rendering) — the user’s browser fetches vector map tiles directly from the OpenFreeMap CDN for the in-app jobs map. The CDN receives the user’s IP and the map area being viewed; OpenFreeMap is donation-funded and does not log requests or run analytics. More information: openfreemap.org.
• AI model providers (in-app AI helper, AI email drafting, and AI call-transcript summaries): when you use the in-app AI helper, your message text and the related business records the helper needs to answer (jobs, customers, invoices, and similar operational data) are routed through the Vercel AI Gateway, currently to Google (Gemini models), to generate a reply. When an inbound customer email arrives in your Colab inbox, the email’s sender, subject, and body text are sent the same way to draft a suggested job, and on KeyBolt Pro your call transcripts are sent the same way to generate a short summary and suggested fields. We also currently use OpenAI (text-embedding models, via the Vercel AI Gateway) to index your records for search. We never send the key-code, bitting, or safe-combination fields stored on customer records (though content you type into the AI knowledge base is sent as-is). We direct these providers, through the Vercel AI Gateway, not to use this data to train their models; a provider may retain it briefly to operate the feature and detect abuse under its API terms, then deletes it. These providers are U.S.-based; processing is routed through the Vercel AI Gateway and may occur in the United States or another region the Gateway selects. See Section 4.7 for details.
• Cloudflare (Email Routing and Workers) (inbound email handling): customer emails sent to your shop’s KeyBolt inbox address (for example, your-shop@inbox.keybolt.tech) pass through Cloudflare Email Routing and a Cloudflare Worker, which receives the message and any attachments and files them into KeyBolt for routing to your Colab inbox. More information: cloudflare.com/privacypolicy.

6.2 No Sale of Data. We do not sell, rent, or trade your personal information or your customers’ personal information to any third party for monetary or other valuable consideration. We do not share data with advertising networks, data brokers, or marketing platforms.

6.3 Legal Requirements. We may disclose your information if required to do so by law, court order, subpoena, or other legal process, or if we believe in good faith that such disclosure is necessary to: (a) comply with a legal obligation; (b) protect and defend our rights or property; (c) prevent fraud or other illegal activity; (d) protect the personal safety of users or the public; or (e) protect against legal liability.

6.4 Business Transfers. If KeyBolt is involved in a merger, acquisition, asset sale, bankruptcy, or reorganization, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on the Service before your information is transferred and becomes subject to a different privacy policy.

7. Cookies and Tracking Technologies

7.1 Cookies We Use. KeyBolt uses cookies for authentication, session management, and error monitoring. These cookies are required for the Service to function and cannot be disabled. They include:

• Authentication cookies: Supabase session tokens that keep you logged in and identify your account.
• CSRF tokens: Security tokens that protect against cross-site request forgery attacks.
• Application interface cookie (keybolt-user): Contains your display name, role, and organization name to render the application interface without additional server requests. This cookie does not contain sensitive data and is used only for the logged-in application experience.
• Cloudflare Turnstile: Our bot detection service may set functional cookies (such as cf_clearance) during challenge verification. These are strictly necessary for security and cannot be disabled.
• Sentry session tracking: Sentry may set cookies to correlate error reports and session replay recordings for debugging purposes. These cookies do not track you across other websites.

7.2 No Tracking or Advertising Cookies. We do not use tracking cookies, third-party advertising cookies, social media pixels, retargeting tags, or any other non-essential tracking technologies. We use Vercel Analytics for anonymous page view metrics. We do not use Google Analytics, Facebook Pixel, or advertising platforms.

7.3 Cookie Consent. In addition to strictly necessary cookies, Sentry may set cookies for session tracking during error reports and session replay. Vercel Analytics does not use cookies. For visitors located in the European Economic Area, the United Kingdom, or other regions requiring prior consent for non-essential cookies, we display an in-page consent banner before any session-replay recording is initialized. Visitors who decline are not session-replay recorded; only error events (with PII scrubbed at the SDK before transmission) are sent to Sentry. Strictly necessary cookies (authentication, CSRF, session) remain regardless of consent status because the platform cannot function without them.

8. SMS Messaging

8.1 Purpose. KeyBolt enables Subscribers (locksmith shops) to send transactional SMS messages to their End Customers. These messages are strictly service-related and include:

• “On My Way” notifications when a tech is en route to a job
• Appointment reminders for scheduled jobs
• Invoice payment links after job completion
• On the KeyBolt Pro tier, two-way conversational SMS replies between shop staff and End Customers from the shared inbox

No marketing, promotional, or advertising messages are sent through the Service.

8.2 Consent. Subscribers are responsible for obtaining appropriate consent from their End Customers before sending SMS messages. KeyBolt provides tools to record consent status in each customer record. Subscribers must obtain verbal or written consent before initiating SMS communication through the platform. Subscribers on the KeyBolt Pro tier register their brand and campaign through A2P 10DLC (handled in-app) before US carriers will deliver outbound SMS.

8.3 Opt-Out. End Customers can opt out of SMS messages at any time by replying STOP to any message received through the Service. The system will immediately cease all SMS communication to that phone number. End Customers may re-subscribe by contacting the locksmith shop directly.

8.4 Message Frequency and Content. For transactional sends, message frequency is limited to 1–3 messages per service visit. The Service enforces two layered rate limits to prevent abuse: 10 SMS messages per user per rolling hour, and 50 SMS messages per organization per rolling hour. These limits apply to outbound SMS only; inbound replies from End Customers do not count toward the cap. Message content is limited to job status updates, appointment information, invoice links, and (on KeyBolt Pro) two-way conversation with End Customers initiated by the customer. No sensitive locksmith data (key codes, bitting, safe combinations) is ever included in SMS messages.

8.5 Carrier Disclaimer. SMS messages are delivered via Telnyx. Message and data rates may apply depending on the End Customer’s mobile carrier and plan. Carriers are not liable for delayed or undelivered messages. Delivery success may vary by carrier and geography.

8a. Voice Calls and Call Recording (KeyBolt Pro)

8a.1 Scope. This section applies only to Subscribers on the KeyBolt Pro tier and the End Customers who call or are called by those Subscribers’ shop phone numbers. Subscribers on the Basic tier do not place or receive calls through KeyBolt and this section does not apply to them.

8a.2 Recording & Transcription. Every inbound call to a KeyBolt Pro shop number is recorded and automatically transcribed. Recording starts immediately after the call connects, and an audible disclosure (“This call will be recorded for quality and training”) plays at the start of each inbound call before any tech is rung; this disclosure is built into the platform and cannot be disabled. Outbound calls placed from the shop number are not recorded by the platform. Transcripts are generated by Telnyx in English and Spanish and stored on the call record alongside the recording URL.

8a.3 Two-Party Consent. Several US states (California, Florida, Pennsylvania, Illinois, Maryland, Massachusetts, Montana, Nevada, New Hampshire, and Washington) require all parties to a call to consent to recording. The platform-played disclosure is intended to satisfy the audible-notice requirement in those jurisdictions. Subscribers are responsible for confirming that their use of call recording complies with applicable law in every jurisdiction where their End Customers are located.

8a.4 Caller-ID Match. When a known End Customer calls a KeyBolt Pro number, KeyBolt looks up that number against the Subscriber’s customer database and surfaces the matching customer name and most recent job to the shop staff before the call is answered. End Customers may opt out of this matching by removing their phone number from the Subscriber’s records.

8a.5 DTMF (Keypad) Input. Keypad presses during a call — including IVR menu selections (e.g., “press 1”) and internal transfer codes (e.g., **11) — are processed by Telnyx and KeyBolt to route the call. Individual keypad events are recorded only in the telephony webhook diagnostic log used for routing; that log is retained for thirty (30) days and then deleted (see 8a.6 below). Keypad input is not retained on the call record itself, is not transcribed, and is not used to train any model.

8a.6 Retention. Call audio, call metadata, and transcripts each follow a different retention path:

• Call audio (recordings): stored by Telnyx on its own infrastructure under its retention schedule — typically 30 days on the Telnyx CDN, after which Telnyx removes the file. KeyBolt does not retain a copy by default. The Subscriber may, on a per-call basis, click “Save Permanently” on the call detail page; doing so triggers KeyBolt to download the audio from Telnyx and archive it in our object storage indefinitely until the Subscriber deletes the call or the parent customer record. On KeyBolt Pro, a Subscriber may instead enable automatic archiving (Section 8a.6), a best-effort daily job that copies call recordings into our storage shortly before Telnyx deletes them. Archived recordings (saved-permanently or auto-archived) are deleted within 30 days of an account deletion request (see Section 10).
• Transcripts and call metadata (caller number, duration, timestamps, recording URL) are persisted on the KeyBolt call record and retained as part of the customer’s record per Section 10. Once the underlying Telnyx audio is removed by Telnyx, the recording URL on our call record becomes a stale pointer; the transcript and metadata remain readable.
• Telephony webhook diagnostic events from Telnyx (call-progress events used for routing) are retained for 30 days, then deleted.

Subscribers who want to retain audio beyond Telnyx’s default window have two options: use the “Save Permanently” control on an individual call, or, on KeyBolt Pro, enable automatic call-recording archiving in Settings → Phone & SMS. When automatic archiving is enabled, a daily job copies your call recordings into KeyBolt’s own object storage shortly before Telnyx deletes them (around day 25 of Telnyx’s roughly 30-day window), so recordings are less likely to be lost when Telnyx removes them. This automated archiving is best-effort and subject to limits such as your account’s overall storage cap. Automatic archiving is off by default and can be turned on only by an owner or manager, for the whole organization. Archived recordings are retained until the Subscriber deletes them (per call or per customer record) or closes the account, after which they are removed from KeyBolt’s storage within 30 days.

8a.7 Access. Call recordings and transcripts are visible only to authenticated users belonging to the Subscriber’s organization, protected by the same row-level security policies as the rest of the customer record. KeyBolt employees cannot access call audio or transcripts.

9. Email Messaging

9.1 Transactional Emails. KeyBolt sends transactional emails on behalf of Subscribers to their End Customers. These include invoices, payment receipts, estimate notifications, appointment confirmations, and overdue payment reminders. KeyBolt also sends transactional emails directly to Subscribers, including team invitations, password resets, subscription confirmations, low stock alerts, and job completion notifications. All transactional emails are delivered via Resend. The Service enforces a rate limit of 50 emails per hour per organization and a monthly quota of 750 emails per organization.

9.2 No Marketing Emails to End Customers. KeyBolt does not send marketing or promotional emails to End Customers. All emails sent through the Service are transactional in nature and directly related to a service interaction. Subscribers may receive occasional product updates or service announcements from KeyBolt, from which they can unsubscribe at any time.

10. Data Retention

10.1 Active Accounts. Your data is retained for as long as your KeyBolt account is active and your subscription is in good standing. You may access, export, or delete your data at any time while your account is active.

10.2 After Account Deletion. When you delete your account, data is handled in three categories:

• Immediately deleted: Non-financial data including job photos, identity verification documents, uploaded documents, communication logs, inventory items, and job templates are permanently deleted at the time of account deletion. All files in cloud storage buckets are removed. Auth credentials are deleted immediately.
• Soft-deleted and retained: Financial records (invoices, payments, and credit memos) and customer records are soft-deleted and retained for up to 7 years to comply with tax and legal record-keeping requirements. Estimates are retained for 90 days after deletion.
• Audit logs. Live audit logs are retained for 1 year and remain visible in the in-app activity view during that window. After 1 year, entries are moved to a long-term archive that is not exposed in the dashboard but is preserved for legal compliance and account-recovery purposes. Archive entries lose linkage to individual users as related user records expire under their own retention periods.

10.3 Soft-Deleted Records and Retention Periods. When you delete a customer record within the Service, the record is soft-deleted and retained while linked financial records exist. Soft-deleted financial records (invoices, payments, and credit memos) are permanently removed after 7 years per tax compliance requirements. Customer records are retained while linked financial records exist. Estimates are retained for 90 days after deletion. Notifications are retained for 15 days. Communication logs (email and SMS records) are retained for 90 days, then deleted. Inbound customer emails received in your shop’s Colab inbox are kept as part of the associated customer record (sender, subject, message text, and attachments) and follow the customer-record retention rules above; the exact original message file (a raw email copy kept only for forensic and deliverability purposes, never shown in the app) is retained for 24 months and then deleted. Telephony webhook diagnostic events from carriers (call-progress events used for debugging routing) are retained for 30 days, then deleted; the durable summary of each call (caller, duration, recording, transcript, status) lives on the call record itself and follows the customer-record retention rules above. Identity verification photos are retained for the same period as the associated job record. AI helper conversations and any AI-suggested job drafts are stored as part of your account; they are retained while your account is active and are permanently deleted when you delete your account. Expired estimate approval tokens and processed webhook events are cleaned up weekly.

11. Data Security Measures

We implement industry-standard technical and organizational security measures to protect your data, including but not limited to:

• Encryption: All data is encrypted at rest (AES-256) and in transit (TLS 1.2+). Database connections use TLS. Backups are encrypted.
• Row-level security: Every database table is protected by PostgreSQL row-level security policies that restrict data access to the owning organization.
• Authentication security: Support for multi-factor authentication (TOTP), configurable account lockout after failed login attempts, configurable session timeouts, and Turnstile CAPTCHA on signup.
• Rate limiting: Sensitive endpoints (SMS, email, authentication) are rate-limited to prevent abuse.
• Audit logging: All significant actions are recorded in an append-only, immutable audit log. Database triggers prevent modification or deletion of audit records.
• Webhook security: Stripe webhook signatures are verified on every request. Processed events are deduplicated via a persistent tracking table to prevent replay attacks.
• Input validation: All user inputs are validated server-side using Zod schemas to prevent injection attacks and data corruption.
• Least privilege: Service role keys are never exposed to client code. Browser clients use only anon keys with RLS enforcement.

No method of electronic storage or transmission is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

12. Data Breach Notification

In the event of a data breach that compromises the security, confidentiality, or integrity of your personal information, we will notify affected Subscribers via email without unreasonable delay and no later than 72 hours after becoming aware of the breach. The notification will include: (a) the nature of the breach; (b) the categories of data affected; (c) the approximate number of records affected; (d) the likely consequences of the breach; and (e) the measures taken or proposed to address the breach. We will also notify applicable regulatory authorities as required by law.

13. Children’s Privacy and Account-Holder Age Requirements

13.1 Children under 13 (COPPA). The Service is not directed to children under 13. Consistent with the Children’s Online Privacy Protection Act (COPPA), we do not knowingly collect, use, or disclose personal information from children under 13. If you are a parent or guardian and believe a child under 13 has provided us with personal information, please contact us at the address in Section 18. If we become aware that we have collected personal information from a child under 13 without verifiable parental consent, we will delete that information promptly.

13.2 Account holders must be 18 or older (capacity to contract). The Service is a paid B2B platform offered to professional locksmith businesses. To create or hold an Organization Account or to act as an Authorized User of one, you must be at least 18 years of age (or the age of majority in your jurisdiction) and have the legal capacity to enter into a binding contract. Users between 13 and 17 are not permitted to register an account, and the Service is not designed for personal consumer use.

13.3 End Customer data. KeyBolt does not require End Customers (the people the locksmith serves) to be 18, since End Customers do not register a KeyBolt account — their data is provided by the Subscriber as part of the Subscriber’s own customer record. Subscribers are responsible for their own legal obligations when collecting personal information about minors, including any parental-consent requirements under applicable law.

14. International Data Transfers

KeyBolt Inc. is a New York corporation based in the United States. Our service providers (Supabase, Stripe, Telnyx, Resend, Vercel, our AI provider, and our map and geocoding providers, some of which are operated in the EU and UK, including OpenStreetMap Nominatim, OSRM, and OpenFreeMap) may process and store data in the United States and other countries. If you access the Service from outside the United States, your information may be transferred to, stored in, and processed in the United States or other jurisdictions where our service providers maintain facilities. These jurisdictions may have data protection laws that differ from those in your country. By using the Service, you consent to the transfer of your information to the United States and other jurisdictions as described in this policy.

15. Your Rights and Choices

15.1 General Rights. Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Right of access: Request a copy of all personal data we hold about you.
• Right of correction: Request that we correct inaccurate or incomplete personal data.
• Right of deletion: Request that we permanently delete your personal data, subject to legal retention requirements.
• Right of portability: Request your data in a structured, commonly used, machine-readable format (CSV).
• Right to restrict processing: Request that we limit how we process your data in certain circumstances.
• Right to object: Object to the processing of your personal data for certain purposes.

15.2 Exercising Your Rights. To exercise any of these rights, email us at privacy@keybolt.tech with the subject line “Privacy Rights Request.” We will verify your identity before processing your request and respond within 30 days. If we need additional time, we will inform you of the extension and the reasons within the initial 30-day period.

15.3 Account Controls. You can manage much of your data directly through the Service:

• Update your profile and business information in Settings.
• Export your data (customers, jobs, invoices, inventory) via CSV export in the QuickBooks integration page.
• Delete your account from Settings, which initiates the data deletion process described in Section 10.2.
• Manage notification preferences (email toggles) in Settings.
• Enable or disable multi-factor authentication in Security settings.

16. CCPA/CPRA Notice and California Rights

This section applies to California residents and supplements the information in the rest of this Privacy Policy, as required by the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (collectively, “CCPA”).

16.1 Categories of Personal Information Collected. In the preceding 12 months, we have collected the following categories of personal information:

1. Identifiers: Name, email address, phone number, IP address, account ID.
2. Commercial information: Subscription records, payment history, invoice records, transaction details.
3. Internet or electronic network activity: Browser type, pages visited, features used, device type.
4. Professional or employment-related information: Business name, business address, team member roles.
5. Geolocation data: Approximate location derived from IP address; job site addresses entered by Subscribers.
6. Audio, electronic, and visual information: For KeyBolt Pro shops, inbound call recordings, call transcripts, and two-way SMS content; job photos and uploaded documents.
7. Sensitive personal information: Identity-verification and proof-of-residence document photos a Subscriber may upload for a job. We use this only to provide the Service and do not use or disclose it to infer characteristics about any individual (see Section 16.7).

16.2 Sources of Personal Information. Personal information is collected from: (a) directly from you when you create an account or use the Service; (b) automatically through cookies and server logs; and (c) from third-party services (Stripe, Google Places API, Cloudflare Turnstile, Google Local Services Ads lead metadata and conversation content, and inbound customer emails routed through Cloudflare into your Colab inbox) as described in Section 2.3.

16.3 Business or Commercial Purpose for Collection. We collect personal information for the purposes described in Section 4, including providing the Service, processing payments, communicating with you, improving the Service, ensuring security, and complying with legal obligations.

16.4 Categories of Third Parties. We share personal information with the service providers listed in Section 6.1 and at keybolt.tech/subprocessors (Supabase, Stripe, Telnyx, Resend, Cloudflare Turnstile, Cloudflare Email Routing, Sentry, Vercel, Google (including Maps, Places, Local Services Ads, and Merchant Center), our AI model provider, and our map and geocoding providers (Nominatim, OSRM, and OpenFreeMap)) for the business purposes described in this policy.

16.5 Service-provider relationships. Each of the third parties listed in Section 16.4 is engaged as a “service provider” as defined in Cal. Civ. Code §1798.140(ag) and processes personal information solely on KeyBolt’s behalf under a written contract that (a) prohibits the service provider from selling or sharing the personal information, (b) prohibits use of the personal information outside the direct business relationship and the specific purposes stated in the contract, (c) requires the service provider to comply with applicable obligations under the CCPA, and (d) grants KeyBolt the right to take reasonable and appropriate steps to ensure the service provider uses the personal information consistently with KeyBolt’s obligations under the CCPA. Disclosures to service providers under this Section are not considered “sales” or “sharing” under the CCPA.

16.6 No Sale or Sharing of Personal Information. We do not sell personal information. We do not “share” personal information for cross-context behavioral advertising as defined by the CCPA. We have not sold or shared personal information in the preceding 12 months.

16.7 California Consumer Rights. As a California resident, you have the following rights under the CCPA:

• Right to know: You may request the categories and specific pieces of personal information we have collected about you, the sources of collection, the business purposes for collection, and the categories of third parties with whom we share it.
• Right to delete: You may request that we delete your personal information, subject to certain exceptions provided by law.
• Right to correct: You may request that we correct inaccurate personal information.
• Right to opt-out of sale/sharing: Because we do not sell or share personal information, this right is not applicable but is acknowledged.
• Right to limit use of sensitive personal information: We only use sensitive personal information as necessary to provide the Service. You may request that we limit its use to what is necessary.
• Right to non-discrimination: We will not discriminate against you for exercising any of your CCPA rights. We will not deny you services, charge different prices, provide a different quality of service, or retaliate in any way.

16.8 Exercising CCPA Rights. To exercise your California rights, email us at privacy@keybolt.tech with the subject line “CCPA Request.” We will verify your identity by matching information you provide against information we have on file. You may also designate an authorized agent to submit a request on your behalf by providing written authorization. We will respond to verifiable requests within 45 days. If we need additional time (up to 45 more days), we will inform you in writing.

16.9 Retention of Personal Information. We retain personal information for as long as described in Section 10. We do not retain personal information for longer than is reasonably necessary for the disclosed purposes.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other operational reasons. If we make material changes, we will notify you by email at least 30 days before the changes take effect and will update the “Last updated” date at the top of this page. Non-material changes (such as formatting or clarification) may be made without advance notice. Continued use of the Service after the effective date of any changes constitutes your acceptance of the revised Privacy Policy.

18. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your privacy rights, or have concerns about how your data is handled, please contact us:

• Email: privacy@keybolt.tech
• Support email: support@keybolt.tech
• Website: keybolt.tech

We aim to respond to all privacy-related inquiries within 30 days.