Keyway Privacy Policy
Effective date: [[EFFECTIVE DATE]] Who we are: Seibs Management Co LLC, a Florida limited liability company, of [[REGISTERED ADDRESS]]. Privacy contact: [[PRIVACY EMAIL]].
1. The short version
Keyway is desktop software you run on your own computer. In the way most customers use it, your recordings, your transcripts and your business records never leave your machine.
We do not say "nothing leaves the machine", because something does, and being exact about it is the point:
- a licence renewal, which carries your organisation identifier, the tools you hold, your seat count and your expiry date;
- an update check, which carries version numbers;
- usage counts, which carry a meter name, a whole number and a period;
- nothing else, unless you switch it on.
There is no telemetry, no analytics and no tracking in the desktop application.
2. Who this policy is about
| You are | What we hold |
|---|---|
A visitor to keywaysuite.com | What section 3 describes |
| A customer with an account and a subscription | Account and billing details, section 4 |
| A person using the software at a customer's business | Almost nothing. The software runs on their machine and we do not receive what it holds. Section 5 |
| A person recorded by a customer | Nothing reaches us. The customer decides what is recorded and what is kept. Section 6 |
If you were recorded by a business using Keyway and you want the recording removed, contact that business. They hold it; we do not. If you cannot reach them and you believe we can help, write to [[PRIVACY EMAIL]] and we will tell you honestly what we do and do not have, which in Solo and Office modes is nothing.
3. The website and the store
- We collect what you type into a form on the site, for example an enquiry or a signup.
- We keep server logs, which include IP addresses, for security and to keep the site running.
- The site as built sets no analytics, advertising or tracking cookies, and loads no third-party analytics script.
- Public intake forms, where a customer publishes one, submit into that customer's own records using their own credential. We are not the recipient of what you type into one.
4. Your account and your billing
If you buy a subscription we hold:
| What | Why | How long |
|---|---|---|
| Name, business name, email, account role | to run your account | while you are a customer, then [[RETENTION: ACCOUNT RECORDS]] |
| Organisation identifier, which tools you hold, seat counts, licence expiry, install identifiers | to issue and renew your licence | while you are a customer, then as required for records |
| Usage counts: a meter name, a whole number, a period | to bill metered work and to show you your allowance | with your billing records |
| Billing records and invoices | to bill you and to meet tax and accounting obligations | as tax law requires, typically [[RETENTION: FINANCIAL RECORDS]] |
| Support correspondence | to answer you | [[RETENTION: SUPPORT]] |
We do not hold your card details. Payments are processed by Stripe. Your card number goes to Stripe and never to us.
Licence and usage traffic carries no business content. This is a fixed property of the product: adding a field to the licence, update or metering payloads is treated as a change to the product's decision record rather than as an implementation detail.
5. What the software does with data on your machine
5.1 The default is strict local
In the default configuration, in Solo or Office residency with local transcription and no cloud model, the following never leave your machine or your network:
- call and meeting audio;
- transcripts;
- contacts, companies, deals and jobs;
- documents, quotes, contracts and everything filed against a customer;
- your own business identity: your trading name, registered name, address, contact details, tax and registration numbers, and your logo.
5.2 What does leave, and exactly what it contains
| Traffic | Happens | Contains |
|---|---|---|
| Licence renewal | every six hours inside a renewal window, or by an offline copy-and-paste | organisation identifier, entitlement keys, seat count, expiry. No business content |
| Update check | if enabled | current versions, operating system build, install identifier |
| Usage metering | attached to a licence renewal, or exported offline | meter name, whole-number quantity, period. No content, and no identifier beyond your organisation identifier |
| Crash information | see 5.3 | stack trace, module version |
| Telemetry | never. There is none | |
| Outbound mail | only if you connect a mailbox | the recipient address and the message, sent to your own mailbox provider and nowhere else. Nothing is relayed through us |
| Mailbox sign-in | only if you connect a mailbox | the stored token and this install's application registration, sent to your provider's own sign-in service, at connect and before a send when the token needs refreshing. No message content |
| Scheduled reminders | only if you connect a mailbox | nothing, unless the reminder asks for the email channel, in which case it is ordinary outbound mail on the row above |
| Cloud transcription or a cloud model | only if you select it | the audio or text you send for that operation, to the provider you configured |
5.3 Crash information
Crash information is written to a file on your own machine and is not sent to us. There is no crash reporting service and no automatic upload.
5.4 Webhooks
If you configure an outbound webhook, it carries identifiers and small values only. It never carries transcript text and never carries document bytes.
5.5 You can check this rather than believe it
The product records, for every document it holds, whether its bytes stayed on the machine. An organisation running strict-local can run one database query and expect zero rows. We supply the query.
6. Recording, consent and audio
6.1 What is recorded
When a person at a customer's business starts a capture, the software may record:
- audio, as two separate tracks where the source has them;
- a transcript of that audio;
- who was on the call, as far as the business's own records identify them;
- when it happened, how long it lasted, and which of the business's people ran it;
- the consent that applied: the consent mode, whether the announcement played, and the jurisdiction that was used.
The person running the capture is recorded as the signed-in Keyway user, not the Windows user, so a shared front desk does not attribute everything to one login. A capture started with nobody signed in is attributed to the device, flagged, and put in a queue to be resolved. It is never silently attributed to whoever signs in next.
6.2 The consent modes
The business configures which rule applies, and can set different rules for different jurisdictions.
| Mode | What it means |
|---|---|
| All-party | everyone must be told. If the announcement cannot be played, the recording does not start |
| One-party | recording proceeds under a one-party rule |
| Notes-only | the other party's audio is discarded inside the recorder and is never written to disk |
| Not-required | no consent step is applied |
Two further controls sit on top:
- A person can refuse standing. A contact marked as refusing recording forces notes-only for that person, regardless of the organisation's default.
- Every change to the consent configuration is recorded in the audit log, and a new configuration must be attested by an administrator before capture modules will record under it.
6.3 Recordings do not leave the machine
Audio stays on the machine that recorded it. The only ways it goes anywhere are:
- the business selects a cloud transcription path or a cloud model, in which case the audio for that operation goes to the provider they configured; or
- the business runs the Hosted residency, in which case it is stored on our infrastructure under section 8.
Local transcription is the default. The setting is visible in the application and is recorded on each session.
6.4 Retention, and how deletion is proved
Retention is set by the business, not by us. The mechanism:
- Soft delete. The record is hidden from every view and can be restored by an administrator.
- Purge window. 30 days by default, and never less than 7, so an accidental deletion is recoverable for a working week.
- Hard delete. The record and its bytes are removed. An audit entry remains, carrying the content hash of what was removed, so the business can prove a deletion happened without keeping the thing they deleted.
- Legal hold. A hold is a row in a table, not a flag someone remembers. The purge refuses to touch a held record and logs the refusal.
- Audio in notes-only configurations is classified as short-lived and purged on that basis.
A cancelled subscription never triggers deletion. Billing state is not an input to any deletion path in the product.
7. Credentials you connect
If a business connects a mailbox or supplies its own model provider key:
- the credential is stored on their own machine or server, sealed with authenticated encryption, and unwrapped only inside the process that uses it;
- it is returned by no interface, is redacted from every rendering of the record that holds it, and is never displayed back;
- connecting and revoking are written to the audit log; using it is recorded in the operational log;
- a connection nothing sends through is never contacted, and an idle one eventually lapses.
8. The Hosted residency
This section applies only to customers who choose Hosted. In Solo and Office, we hold none of the data described here.
- Where. Amazon Web Services, United States, region
us-east-2. - What we hold. Everything the customer's organisation puts into the product, including recordings, transcripts, documents and records.
- Our role. We process it on the customer's instructions as their processor. The Data Processing Addendum governs, and it applies only to Hosted.
- Encryption. Encrypted at rest with managed keys, and in transit with TLS.
- Audio retention. 90 days by default, longer as a paid option. Transcripts follow the customer's own retention settings. The 90 days is enforced by the application, which reads legal holds first and writes a deletion record, rather than by a storage lifecycle rule that could delete under a hold and leave no proof.
- Who can see it. Named personnel under least privilege, and every access is recorded.
- Getting it out. A full export at any time, at no charge and with no notice period. After termination the tenant is kept for 30 days and then purged on request, with a deletion record per object.
9. Who we share data with
We do not sell personal information and we do not share it for advertising.
| Recipient | What they get | Applies to |
|---|---|---|
| Stripe | your billing details and card data, which goes to them and not to us | every customer |
| Amazon Web Services | hosted customer data, as our infrastructure provider | Hosted only |
| A model provider you configure | only what you send it for that operation | only if you configure one |
| Your own mailbox provider | your outbound mail, through your own credential | only if you connect a mailbox |
The full list, with what each one does, is in the Subprocessor List. Solo customers who connect nothing have no subprocessor other than Stripe for billing.
We may also disclose information where the law requires it, and we will tell you unless we are prohibited from doing so.
10. Security
- Encryption in transit everywhere: TLS 1.2 as a minimum, TLS 1.3 on Hosted, loopback only in Solo.
- Encryption at rest: full-disk encryption on customer-hosted modes, managed key-encrypted storage on Hosted.
- Per-user accounts with roles, optional single sign-on, time-based one-time passwords available and required for administrators on Hosted.
- An audit log covering sign-ins, permission denials, exports, downloads, consent changes, retention purges, credential changes and role changes, retained at least 12 months.
- An honest limitation: the local database file is not encrypted by Keyway. Full-disk encryption is what protects it. The installer checks whether the volume is protected, warns prominently if it is not, and records the state so an administrator can see every unprotected machine. If the file is taken from an unprotected volume it is readable, and saying otherwise would be false.
- We hold no SOC 2 report and have not had an independent penetration test. We will describe our controls to you in detail; we will not describe them as certification.
If we confirm a breach of customer data we hold, we will notify affected customers within 72 hours of confirmation, and sooner where the law or a contract requires it.
11. Your rights and choices
Depending on where you live, you may have the right to access, correct, delete, port or restrict the processing of your personal information, and to object to it.
- If you are a Keyway customer, the tools are in the product: export everything at any time at no charge, delete records, and set your own retention period. For your account and billing records, write to
[[PRIVACY EMAIL]]. - If you are a person recorded by a Keyway customer, we are not the holder of that recording in Solo or Office mode. Contact the business. We will help you reach them where we can.
- We will not discriminate against you for exercising a right.
12. Children
The product is business software and is not directed at children. We do not knowingly collect personal information from children.
13. International
We are based in the United States and our Hosted infrastructure is in the United States.
- In Solo and Office, data stays where the customer's equipment is. There is no transfer, because there is no transmission.
- Hosted stores data in the United States. There is no EU region today.
14. Changes
We will post any new version here with a new effective date. For a change that materially reduces protection, we will notify account holders at least 30 days beforehand.
15. Contact
[[PRIVACY EMAIL]] Seibs Management Co LLC, [[REGISTERED ADDRESS]] Security reports: [[SECURITY EMAIL]]