KeyScale
Get a quote

Privacy Policy

Version: 2026-09-28

1. Who this notice covers

KeyScale (“we”, “us”, or “our”) is the brand used for our managed website, AI configuration, CRM and related agency services. Contact us at hello@keyscale.co.

We act as controller for enquiries to KeyScale, our business contacts, account administration and our own billing and security records. For messages, contacts and knowledge material processed on behalf of a client, that client normally determines the purposes of processing and we act as its processor. Its privacy notice explains that processing. Our Data Processing Terms and the agreed processing schedule govern our work for that client.

2. Information and sources

Our own support chat is available on the KeyScale marketing website and inside the CRM. We act as controller for enquiries and support messages sent to us through these chats. We store the messages and any contact details you provide to answer questions about KeyScale and help with the service. If AI replies are enabled, conversation content and relevant reference material may be processed by the selected AI services described below. Merely opening our support chat does not automatically attach your CRM records or the contents of the page.

  • Enquiries: name, email, business or website details, an optional Google Maps profile link and the description you submit.
  • Accounts: name, email, password hash, authentication and session records, and settings. Optional two-factor authentication involves authentication secrets and recovery-code records.
  • Business records: correspondence, orders, billing details and payment status received from you or the payment platform specified in your order. KeyScale does not collect payment-card numbers in its own forms.
  • Technical records: network requests may expose an IP address to hosting and network providers. The application records such information as user agent, hashed IP information for security, account activity, and error diagnostics. Optional push notifications involve a browser push endpoint and subscription keys.
  • Client workspaces: contact details, including phone numbers where supplied or used by a messaging channel; messages, notes, uploaded or crawled knowledge material, and AI processing records. These may come from the client, its staff, visitors or connected platforms.

Please do not submit health information, payment-card details, identity documents or other sensitive information through an enquiry or chat. These services are not intended for medical, child-directed or other specially regulated projects at launch. If such information is received unexpectedly, we assess restriction, deletion and any duties that apply; a prohibition does not make received data exempt from protection.

3. Purposes and lawful grounds

Where EU or UK GDPR applies, we use the following grounds as appropriate to the processing:

  • Responding to enquiries and delivering services: steps towards, or performance of, a contract with the individual concerned. When our customer is an organisation, handling its representatives' details normally relies on our legitimate interest in managing the business relationship, rather than a contract with that representative.
  • Account administration, security, fraud prevention, service diagnostics and establishing or defending legal claims: our legitimate interests, subject to the required balancing of rights and interests.
  • Accounting and statutory records: applicable legal obligations. A foreign legal requirement is not automatically a GDPR Article 6(1)(c) ground; where necessary we assess another applicable basis and safeguards.
  • Optional processing requiring consent: informed, purpose-specific consent obtained before that processing. Dismissing a storage notice is not such consent.

Providing some information is necessary to respond to your request or administer an account. Without it, we may not be able to provide that function. Client-workspace processing follows the client's documented instructions and lawful basis.

4. Recipients and AI processing

Depending on the engagement, recipients include hosting and backup providers, email delivery services, the selected AI and embedding providers, connected messaging services, browser push services, and the payment platform named in the order. Professional advisers and authorities may receive data where necessary and lawful. Some platforms act as independent controllers for their own purposes; they are not all KeyScale sub-processors.

For client data, the completed processing schedule identifies the actual providers, their roles and processing countries before processing starts. Available integrations are not evidence that a provider is active or has been authorised.

AI reply generation can send conversation content and relevant knowledge passages to the chosen model provider. Indexing and search can separately send knowledge material and questions to an embedding provider; document extraction may also use a model provider. Provider retention and training settings must be checked for the selected service. We do not use client content to train our own general-purpose models; we do use service records to investigate answers and improve a client's configuration on its instructions. We do not make a blanket guarantee about every configurable third-party endpoint.

We do not sell personal information or share it for cross-context behavioural advertising. Operational Telegram notifications contain fixed event categories, severity, time and counts; the notification formatter excludes free-form diagnostic text and user or request identifiers. Detailed diagnostics are kept in the restricted CRM log.

5. International processing

Operating access from Armenia, hosting locations and provider processing countries must all be included when assessing international transfers. Where a restricted transfer is involved, the relevant parties must put an applicable mechanism in place before the transfer, such as completed Standard Contractual Clauses and any required UK Addendum, with the relevant assessment and supplementary safeguards, or an applicable adequacy decision. A provider's certification covers only eligible transfers to that provider. This notice does not itself execute transfer clauses or certify that a transfer is lawful. Contact us for information about safeguards applicable to your data.

6. Security and retention

We use access controls, password hashing, workspace scoping and other measures appropriate to the processing. Deployment-specific controls must be verified before live processing. No service can promise complete security.

  • Workspace conversations, contacts and knowledge material are kept during the engagement. On termination, the customer may request return or earlier deletion within 30 days. We then arrange deletion from the active workspace, unless applicable law requires retention. Termination and deletion are an operator-managed process, not an automatic billing event.
  • AI diagnostic records are scheduled for deletion 90 days after creation, or 365 days after creation if rated by a user or if they record an unresolved handoff with no retrieved knowledge passages. These limits concern diagnostic records, not the underlying conversation history.
  • Operational errors are grouped by recurrence. The default cleanup removes unresolved groups 30 days after their last occurrence and resolved groups 7 days after their last occurrence. A recurrence restarts that clock and reopens the group. Any different deployment retention must be documented before processing begins.
  • Active-workspace deletion is not immediate deletion of every copy. Restricted security and operational records, delivery queues, provider-held records and backups may remain under their applicable retention schedules. Removing a user reference does not anonymise the remaining record. Retention of these copies must be limited to a documented purpose or legal requirement.
  • Encrypted backups rotate separately from the active database. The configured default keeps 14 daily, 8 weekly and 12 monthly snapshots; these are snapshot counts, not a guaranteed maximum age. The engagement's processing schedule must specify the actual backup retention and purge process. Backups are restricted to recovery; outstanding erasures must be reapplied before restored data returns to normal use.

Project enquiries are reviewed manually and retained while needed for the enquiry or a documented follow-up purpose. There is no automatic enquiry-deletion job. Accounting records are kept for the period required by the law applicable to the operator; we do not assume a universal six-year period. Our operational retention register must set the periods for enquiries, security logs, delivery records and provider copies before launch. You can ask us about the period applicable to your data.

Our own support-chat conversations are retained while needed to handle the enquiry, provide ongoing support or meet a documented legal or security need; they are not automatically deleted when the chat is closed. The operational retention register must specify the applicable review and deletion periods. The diagnostic and residual-copy limits above apply where those records are created. The engagement termination window for client workspaces is not a deletion deadline for a visitor's enquiry to KeyScale. Contact hello@keyscale.co to ask about or request deletion of your support conversation.

7. Your rights

Depending on the law and circumstances, you may have rights to access, correction, deletion, restriction, portability, objection, withdrawal of consent, or appeal of a request decision. Each right is subject to its legal conditions and exceptions, including protection of other people and necessary legal records. Withdrawal of consent does not affect earlier lawful processing. We do not use the services for solely automated decisions with legal or similarly significant effects; clients must not configure such uses without a separate assessment and agreement.

Email hello@keyscale.co. We may request proportionate verification or evidence of an agent's authority. We respond within the applicable statutory period, normally one month under GDPR or 45 days under applicable US state laws, with extensions or permitted fees only where the law allows and with required notice. We do not unlawfully discriminate for exercising rights, but removal of information needed for a service can prevent us from continuing that service.

If your data is held for a client, we normally forward the request to that client and assist it rather than independently deciding the request. You may complain to the competent authority without contacting us first. Depending on jurisdiction this may include the Armenian personal data protection authority, an EEA supervisory authority, the UK ICO, or a relevant US state authority. US state-specific rights and service-provider obligations apply where their legal conditions are met; this notice does not voluntarily extend every statutory regime to every user.

8. Browser storage and changes

Our Cookie Policy explains cookies and browser storage. We update this notice when practices change and provide additional notice where required. Changes do not retroactively authorise a new use of data.

Contact

Email: hello@keyscale.co
Brand: KeyScale