Privacy policy

1. Who we are

Keystonas is a service for tracking interior fit-out progress on construction projects, operated by [Company name], [Registered address], commercial registration [Commercial registration number], VAT number [VAT registration number] (“we”, “us”).

2. Our role and our customers' role

Our customers are organizations (for example consultants, contractors and developers) that use Keystonas for their projects. For the project information they and their people put into the service (rooms, progress, photos, drawings and documents), the customer organization decides what is collected and why, and we process it on their behalf and on their instructions.

For account details, this website, the contact form and running the service itself, we decide how the data is used and are responsible for it.

3. What we collect

Account information

• Your name, email address and a salted hash of your password (never the password itself).
• Your organizations and projects, your role in each, and when you were last active.
• Your notification choices and, if you allow notifications on a device, that device's push address.

Project content

• Room lists and finishes schedules, drawings, statuses and progress entries, with who made each change and when.
• Site photos, which may show people or vehicles on site. Location data is removed from photos on your device before upload.
• Documents such as WIRs, NCRs, SORs and RFIs, which may contain names and signatures of people working on the project.

Technical information

• Records of requests to the service (time, page, device type, IP address) kept in server logs for security and troubleshooting.
• A record of every change made in a project (the audit log).

When you contact us

• The name, email address, company and message you send through the contact form.

4. How we use it

• To provide the service: sign you in, show you the projects you belong to, save your work and send the notifications you asked for.
• To keep the service secure: check permissions, prevent abuse, investigate problems and keep the audit log.
• To answer your messages and requests.
• To meet legal obligations.

We do not sell personal data, and we do not use project content for advertising.

5. AI document reading

On our Global region, an organization's admin can turn on reading of site documents with Claude, an AI model made by Anthropic. When a person clicks Read with AI, that document's text (or, for a scanned document, images of its first pages) and the project's room numbers and trade names are sent to Anthropic to produce suggested updates. Nothing is changed until a person reviews and saves the result. This feature is off by default and is not available on our Saudi Arabia region.

6. Where data is stored

Each organization's data is stored in the region it chose when it was created: Google Cloud in Dammam, Saudi Arabia, or Google Cloud in Belgium. The database, files, backups and logs stay in that region. Data leaves the region only where this policy says so (for example AI document reading on the Global region, or email delivery).

7. Who we share it with

Project content is visible to the members of that project, according to their role. Beyond that, we use these service providers:

• Google Cloud: hosting, database, file storage and backups, in the organization's region.
• Anthropic: AI document reading, only on the Global region and only when enabled and used.
• [Email provider]: sending invitations, sign-in links and notification emails. On the Saudi Arabia region, an email provider in the Kingdom.

We may also disclose information when the law requires it, or to protect the rights and safety of our users or the service.

8. How long we keep it

• Account information: while your account is active, and for [12 months] after it is closed.
• Project content: for as long as the customer organization keeps the project, then deleted within [90 days] of the end of its subscription, unless it asks us to delete it sooner.
• Deleted items stay recoverable for 30 days. Database backups are kept for 30 days.
• Server logs: [90 days]. Contact form messages: [24 months].

9. Security

We protect data with encryption in transit and at rest, invitation-only accounts, role-based permissions enforced by the database, private file storage, daily backups and a full audit log. See Security & data residency for details.

10. Your rights

Depending on where you are, including under Saudi Arabia's Personal Data Protection Law, you may have the right to be informed about, access, correct, delete or obtain a copy of your personal data, and to withdraw consent where we rely on it. For project content, please contact the organization that runs the project first; we will help them respond. To make a request, use the contact form and choose “Privacy request”, or email privacy@keystonas.com. To delete your own account, see Deleting your account. You may also complain to your data protection authority.

11. Cookies

We use only the cookies needed to keep you signed in and to protect your session. We don't use advertising or third-party tracking cookies. The app also stores some data on your device so it can work offline; you can clear it in your browser settings.

12. Children

Keystonas is a business service and is not intended for anyone under 18.

13. Changes to this policy

We will post any changes on this page and update the date at the top. If a change is significant, we will tell customers in advance.

14. Contact

Questions about this policy: email privacy@keystonas.com, use the contact form, or write to [Company name], [Registered address].