Privacy Policy
Effective date: 24 August 2026
Applies to all Keystone Operating Systems app versions, modules and workspaces.
This policy is intended for use in the Keystone Operating Systems app. Keystone Strategic Ltd is a private limited company registered in England and Wales under company number 17047166. Our trading address is 4 Benwick Road, Whittlesey, PE7 2HD.
1. Who We Are
Keystone Operating Systems is provided by Keystone Strategic Ltd ("Keystone Strategic", "we", "us" or "our"), a company registered in England and Wales under company number 17047166. Keystone Operating Systems includes all versions of the OS app and related modules, including CoreOS, RooferOS, TechOS, TransportOS, and any future industry-specific operating system products or modules we release under the Keystone Operating Systems brand.
For account, billing, app administration, support, security and product improvement data, Keystone Strategic is the data controller. For business information entered into a client workspace, such as client records, staff records, project information, documents, stock records, attendance records and compliance files, the subscribing customer is normally the data controller and Keystone Strategic acts as the data processor on that customer's behalf.
This policy explains what personal data we collect, why we use it, how long we keep it, who we share it with, and the rights available under UK data protection law, including the UK GDPR and Data Protection Act 2018.
2. Data We Collect
Account and user data
- Name, email address, username, password authentication status, company name, workspace/client code, role, permissions and account settings.
- Support messages, feedback, issue reports and correspondence with Keystone Strategic.
- Billing, subscription and payment administration data where relevant.
Workspace and business data
- Client, contractor and supplier details, including names, business addresses, contact details, notes and activity records.
- Project, job, site and location information, including addresses, schedules, files, folders, forms, photos, signatures and completion evidence.
- Quotes, invoices, cost information, templates, reports and related commercial records.
- Stock, assets, vehicles, equipment, deliveries, collections, movement logs and audit records.
- Staff, visitor, attendance, sign-in/sign-out, induction, declaration, inspection, compliance, health and safety, accreditation and training records entered into a workspace.
Technical and usage data
- IP address, browser and device information, operating system, approximate location derived from technical data, access times, pages or modules used, error logs and security events.
- App actions such as creating, editing, uploading, downloading, exporting, deleting or approving records.
- Cookies, session tokens and local storage needed to keep users signed in, remember preferences and maintain workspace security.
Optional integration data
- Microsoft Outlook or Microsoft 365 data only where a user connects that integration, such as email draft details, recipient fields, attachments selected by the user and Microsoft authentication tokens required to perform the requested action.
- Address or mapping search terms sent to Google Maps or Google Places when users use address autocomplete, map lookup or embedded map features.
3. How We Receive Data
We receive personal data directly from users when they create accounts, sign in, enter workspace records, upload documents, use forms, contact support or connect integrations. We may also receive personal data from subscribing customers who invite staff, contractors, clients or visitors into a workspace, or who enter information about their own business contacts, staff, projects and sites.
4. Why We Use Data and Our Lawful Bases
| Purpose | Examples | Lawful basis |
|---|---|---|
| Provide the service | Create accounts, authenticate users, load workspace data, sync records, operate modules and provide support. | Contract performance and legitimate interests. |
| Administer customer workspaces | Manage users, roles, permissions, client workspaces, backups, audit logs and service communications. | Contract performance and legitimate interests. |
| Process customer-entered business data | Store and process project, staff, client, attendance, stock, compliance, document and commercial records entered by customers. | Processed on customer instructions where we act as processor. The customer decides the lawful basis as controller. |
| Security and fraud prevention | Protect accounts, detect abuse, investigate incidents, maintain tenant isolation and enforce access controls. | Legitimate interests and legal obligation. |
| Legal, tax and accounting compliance | Maintain invoices, transaction records, service logs and records needed for legal claims or regulatory compliance. | Legal obligation and legitimate interests. |
| Improve the app | Fix bugs, analyse feature usage, improve reliability, monitor performance and plan product development. | Legitimate interests. |
| Marketing | Send product updates, offers or newsletters where permitted. | Consent or legitimate interests, depending on the communication and applicable law. |
| Connected integrations | Create Outlook drafts, preview documents, search addresses, display maps or generate QR-code images when requested by a user. | Contract performance, legitimate interests and, where required, consent. |
5. Special Category and Sensitive Data
Keystone Operating Systems is not designed to collect special category personal data unless a customer chooses to enter it into their workspace. Some health and safety, incident, attendance, compliance or employment-related records may contain sensitive information. Customers are responsible for ensuring they have a lawful basis and any required Article 9 condition before entering special category data. Where Keystone Strategic processes this data for a customer, we do so as processor and only for providing, securing and supporting the service.
6. Sub-Processors and Third Parties
We do not sell personal data. We use trusted service providers to operate Keystone Operating Systems. These providers process data under contractual terms and appropriate security or data transfer safeguards where required.
- Supabase: database, authentication, storage, row-level security and realtime workspace sync.
- Hosting and content delivery providers, such as Vercel, Netlify or Cloudflare Pages, depending on the deployment used for the relevant app version.
- Resend and/or Amazon SES: outbound service email delivery where enabled.
- Microsoft: optional Outlook, Microsoft 365, Microsoft Graph authentication, document preview and email draft features where configured or selected by a user.
- Google: Google Fonts, Google Maps and Google Places address, location and map display features where used.
- jsDelivr: delivery of app libraries used by the browser version of the service.
- QR code image providers, such as api.qrserver.com, when the app generates QR-code images.
- Professional advisers, insurers, auditors, regulators, courts, law enforcement or public authorities where required by law or needed to protect legal rights.
7. International Transfers
We aim to use UK, EEA or adequacy-approved hosting regions where reasonably possible. Some providers may process or access data from outside the UK or EEA. Where this happens, we rely on appropriate safeguards such as UK-approved international data transfer agreements, Standard Contractual Clauses, adequacy regulations, or equivalent lawful transfer mechanisms.
8. Data Retention
We keep personal data only for as long as needed for the purpose it was collected, including to provide the service, comply with legal obligations, resolve disputes, maintain security and enforce agreements.
- Account data is normally retained while the account or subscription is active and for up to 2 years after closure, unless a longer period is required by law or for legitimate business records.
- Customer workspace data is retained for the lifetime of the customer workspace unless the customer deletes it, requests deletion, exports and closes the workspace, or a different period is agreed in writing.
- Commercial, invoice, accounting and tax records may be retained for 7 years to support UK tax, accounting and dispute requirements.
- Security logs, audit logs and email delivery records may be retained for up to 7 years where needed for security, legal, tax or dispute purposes.
- Temporary troubleshooting data, message previews, diagnostic exports or support files are deleted or anonymised when no longer required.
Where a customer is the controller of workspace data, deletion and retention requests should usually be made to that customer first. We will assist customers with deletion or export requests where required by our agreement with them.
9. Cookies and Similar Technologies
Keystone Operating Systems uses cookies, browser storage and similar technologies where needed to operate the app. These include authentication sessions, security tokens, workspace selection, layout preferences and local app settings. These are treated as strictly necessary for the service.
We do not use advertising cookies. If analytics or non-essential cookies are introduced in future, we will explain them and request consent where required by law.
10. Security and Tenant Isolation
We use technical and organisational measures designed to protect personal data, including HTTPS/TLS encryption in transit, managed database and storage security, authentication controls, role and module permissions, audit logs and workspace separation.
Keystone Operating Systems is a multi-tenant service. Workspace records are tagged with a workspace identifier, and access is controlled so users should only be able to access the workspace and modules assigned to them. In the Supabase-backed version, database access is further protected using PostgreSQL Row-Level Security policies and controlled save/load functions.
No system can be guaranteed to be completely secure. Users and customers must keep login details confidential, use suitable device security and tell us promptly if they suspect unauthorised access.
11. Automated Decision-Making
We do not use Keystone Operating Systems to make solely automated decisions that produce legal or similarly significant effects on individuals. The app may calculate operational outputs, alerts, stock levels, overdue inspections, reports or form statuses based on data entered by users, but these are decision-support tools for customer review.
12. Children's Data
Keystone Operating Systems is intended for business use and is not directed at children. Customers should not create user accounts for children or enter children's personal data unless they have a lawful basis and the data is necessary for their own business, legal or safeguarding obligations.
13. Your Rights
Depending on the circumstances and lawful basis, individuals may have rights to:
- Access personal data held about them.
- Ask for inaccurate data to be corrected.
- Ask for data to be deleted.
- Ask us or the relevant customer to restrict processing.
- Object to processing, including processing based on legitimate interests.
- Receive certain data in a portable, machine-readable format.
- Withdraw consent where processing is based on consent.
- Complain to the Information Commissioner's Office.
Where Keystone Strategic is the controller, contact us using the details below. Where a customer is the controller of workspace data, we may need to refer the request to that customer or act on their instructions.
14. Contact Us
For privacy questions or rights requests, contact Keystone Strategic at:
- Email: privacy@keystoneoperationsystems.com
- Support: support@keystoneoperationsystems.com
- Trading address: 4 Benwick Road, Whittlesey, PE7 2HD.
- Company number: 17047166.
We aim to respond to data protection rights requests within one month, unless UK data protection law allows or requires a different response period.
15. Complaints
If you are concerned about how we handle personal data, please contact us first so we can try to resolve the issue. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk.
16. Changes to This Policy
We may update this policy from time to time to reflect changes to Keystone Operating Systems, our suppliers, legal requirements or how we process data. We will take reasonable steps to notify customers of material changes, such as by email, in-app notice or updated policy publication.