Privacy policy
Last updated
Who we are
Keyhold is operated by , . For privacy questions or requests, email .
For data that property managers put into their workspace about their tenants and vendors, the property manager is the data controller and we act as their processor. For account and billing data of property managers, we are the controller.
What we collect
- Account details: name, email address, phone number (optional), company name, and a securely hashed password. If you use Google sign-in, we receive your Google account ID, name and verified email address.
- Workspace content: properties, units, maintenance requests, comments, status changes and the activity log.
- Billing: plan, billing currency and subscription status. Card details are handled entirely by Stripe; we never see or store them.
- Security data: IP addresses in sign-in rate-limiting records (kept 24 hours) and in server logs.
Why we use it
- To provide the service: showing requests, sending notifications, and assigning vendors (performance of a contract).
- To bill subscriptions (performance of a contract, legal obligations for tax records).
- To keep accounts secure and prevent abuse (legitimate interests).
We don't sell personal data, show ads, or use it to train AI models. We don't use tracking or advertising cookies.
Cookies
We only use cookies that are strictly necessary for the service, so no consent banner is required:
keyhold_sid: keeps you signed in during a visit.keyhold_rm: only if you tick "Remember me"; keeps you signed in for up to 30 days.keyhold_cur: remembers the currency you chose on the pricing page.
Who we share it with
- Stripe, for payments and invoices.
- Google, only if you choose Google sign-in.
- Our hosting and email delivery providers, to run the service and send notifications.
Some of these providers process data outside your country. Where required, transfers are covered by appropriate safeguards such as Standard Contractual Clauses.
How long we keep it
Workspace data is kept while the workspace is active. After a workspace is closed, we delete it within 30 days, except billing records we must keep for tax law. Backups roll off within 14 days.
Your rights
Depending on where you live (for example under the EU and UK GDPR, the UAE Personal Data Protection Law, or California's CCPA), you can ask to access, correct, export or delete your personal data, or object to certain processing. Property managers can export their workspace data at any time from Settings. Tenants and vendors should contact their property manager first, or email us. You can also complain to your local data protection authority.
Security
All traffic is encrypted with HTTPS. Passwords are hashed, each workspace's data is kept separate, sign-ins are rate-limited, admin access requires two-factor authentication, and data is backed up daily.
Changes
We'll post any changes here and update the date above. For significant changes we'll notify workspace owners by email.