Privacy notice

1. Who we are

This notice explains how the operator of KeyAccess (“KeyAccess”, “we”) handles personal data when you visit keyaccess-ai.com, create an account, or use the KeyAccess application.

KeyAccess has two roles. For your account, billing and our own records, we decide how data is used, so we are its controller. For the information an agency puts into KeyAccess about its clients and contacts, the agency is in charge and we act for it as its processor, under our data processing agreement. If you are an agency’s client, the agency’s own privacy notice explains how it uses your data.

2. What we collect, and why

We collect only what we need to run KeyAccess:

Account details: your name, email address, and a scrambled form of your password (we can’t read the password itself). We use these to give you an account and keep it secure.
Organisation details: your agency’s name, country, team members and their roles, packages and settings. We use these to run your workspace.
Billing details: your package, subscription, credit balance and purchases. Paddle, which processes payments, holds your card or payment details; we never see them.
Usage records: what work used credits, how much, and what it cost, so we can bill accurately and show you your usage.
Security and audit records: sign-ins, important actions such as approvals and permission changes, and error reports with email addresses and keys removed. We use these to keep KeyAccess safe and to investigate problems.
Your acceptance of our Terms: which version, and when.
What you tell us: support requests and requests for new integrations.

Our legal reasons are that we need this data to provide the service you signed up for, that we have a legitimate interest in keeping KeyAccess secure and improving it, and that some records, such as billing, are required by law.

3. Information agencies put into KeyAccess

Agencies use KeyAccess to work with their own clients and contacts. On the agency’s instructions, we process:

enquiries, contacts and leads, and the replies drafted and sent to them;
properties and their details, viewings and viewing notes, deals and their steps, and promises made to clients;
buyers’ property requirements, such as area, price and bedrooms. KeyAccess refuses requirements about the person themselves, such as their nationality, religion or family;
the names and email addresses of sellers the agency invites to its seller portal, and what the agency chooses to share with them;
for a mailbox its owner has chosen to connect and track, only the sender, recipients, time and conversation of messages with known leads. The content of those messages isn’t stored.

We use this information only to do the work the agency asks for. We don’t sell it, use it for advertising, or use it to train AI models.

4. Connected apps and website logins

When you connect an app directly, such as Gmail, you sign in on that app’s own page. We receive a connection that lets approved work happen in your account; we never see your password.

When you log in to a website through KeyAccess, you type your password into the website yourself, on a secure computer that’s only yours. KeyAccess doesn’t ask for, see or keep website passwords. Your logged-in session is sealed with a key held separately from the computer, and logging out or removing the website destroys that key.

While a bot works on a website, pictures of the screen are sent to an AI provider so it can decide each step. They aren’t kept afterwards. Your own personal connections and website logins can’t be seen or used by anyone else in your organisation, including admins.

5. AI providers

Bots use AI models from Anthropic and, if your organisation chooses them, OpenAI or xAI. Each request sends only the content needed for that piece of work, such as the enquiry being answered or the notes being sorted. Drafts are shown to you before anything is sent.

If your organisation uses its own AI keys, requests go to your own account with that provider, under your agreement with it.

We don’t use your content to train AI models.

6. Who we share data with

We share data only with the suppliers that help us run KeyAccess, only as much as each needs, and under contract:

Anthropic: AI models that draft, sort and check work. The content needed for each request, such as an enquiry, viewing notes or a page screenshot. Based in United States.
OpenAI: AI models, when an organisation chooses them. The content needed for each request. Based in United States.
xAI: AI models, when an organisation chooses them. The content needed for each request. Based in United States.
Composio: Connecting apps such as Gmail, and carrying out approved actions in them. Connection tokens, and the messages or records an approved action sends or reads. Based in United States.
Orgo: Secure remote computers for website logins and website work. Sealed website sessions, and what's on screen while a computer runs. Based in United States.
Paddle: Payments, as reseller and merchant of record. Billing name, email, address, tax details and payment details. Based in United Kingdom.
Render: Hosting the KeyAccess website, application, background work and database. All data held by KeyAccess, stored in its Virginia region. Based in United States.
Supabase: The KeyAccess database, if chosen instead of Render's. All data held by KeyAccess, stored in the region KeyAccess chooses. Not chosen yet, and listed here before it receives any data.
Resend: Sending account emails, such as email confirmations, password resets and invitations. Name, email address and the email’s content. Based in United States.

We may also disclose data where the law requires it, to protect people’s safety, or as part of a sale or reorganisation of our business, in which case this notice continues to apply. We don’t sell personal data.

7. International transfers

Several of our suppliers are based in the United States or the United Kingdom, so your data may be processed outside the country where you live. Where the law requires it, we protect those transfers with appropriate safeguards, such as standard contractual clauses approved by the relevant authority.

8. How long we keep data

Account and organisation data: while your account is open.
Agency information about clients and contacts: until the agency deletes it, or until the agency’s account is deleted after it ends.
Website logins: until you log out or remove the website. Removing a person from an organisation deletes their computer and every login on it.
Sign-in sessions: 14 days, unless you log out sooner.
Billing, tax and Terms acceptance records: as long as the law requires, even after an account ends.
Security and audit records: as long as needed to keep KeyAccess safe and to deal with disputes.

When an agreement ends, the agency can get a copy of its data before its account is deleted.

9. Keeping data safe

Every organisation’s data is kept apart at the database level, so one agency can never see another’s. Passwords are stored in a scrambled form that can’t be reversed. Keys and website sessions are encrypted. Each person has their own secure computer, never shared. Access within an organisation follows each person’s role, and important actions are recorded. No system is perfectly secure, but we work to protect your data and will tell you about a breach that affects it as the law requires.

10. Cookies

KeyAccess uses only the cookies it needs to work: one keeps you signed in, and one keeps sellers signed in to a seller portal. We don’t use advertising or analytics cookies. When you buy something, Paddle’s checkout may set its own cookies, explained in Paddle’s privacy notice.

11. Your rights

Depending on where you live, you may have the right to see the personal data we hold about you, have it corrected or deleted, receive a copy in a portable form, object to or limit how we use it, and withdraw consent where we rely on it.

To use these rights, contact us through the support contact published at keyaccess-ai.com. If your data is held by an agency that uses KeyAccess, contact the agency first; we will help it respond. You can also complain to the data protection authority where you live.

12. Children

KeyAccess is for people aged 18 and over. We don’t knowingly collect data from children.

13. Changes to this notice

We will update this notice when how we handle data changes, and show the date it was last updated. If a change is significant, we will tell account holders before it applies. Earlier versions stay available.