Legal
Privacy Policy
Effective July 14, 2026
1. Who we are
Keystone provides a cloud-based property management platform used by property management companies ("Customers") and the residents, staff, and vendors they invite ("Users"). This policy describes how we handle personal information on our marketing site (keystonepm.app) and within the platform.
2. Information we collect
On this website: information you submit through our contact form (name, email, company, portfolio details, message) and standard technical data such as IP address and browser type. Within the platform: information Customers and Users submit to operate their buildings, such as names, unit numbers, contact details, maintenance requests, package logs, community posts, and payment records. Payment card and bank details are collected directly by our payment processor and never stored by Keystone.
3. How we use information
We use personal information to provide and support the Service, respond to inquiries, secure the platform, comply with law, and improve the product using de-identified, aggregated data. We do not sell personal information, and we do not use resident data for advertising.
4. How information is shared
Within the platform, information is visible according to the roles and permissions configured by the Customer (for example, front desk staff see package logs; vendors see only their assigned work orders). We share information with service providers who help us run the platform (hosting, email delivery, and payment processing) under contracts that limit their use of it. We may disclose information if required by law.
5. Data on behalf of Customers
For data submitted to the platform, Keystone acts as a service provider to the Customer (typically your property management company or building). Requests to access, correct, or delete that data should be directed to your building management; we support Customers in fulfilling them.
6. Security
Data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Access is controlled by role-based permissions and enforced at the database row level. Keystone runs on SOC 2 Type II certified infrastructure with continuous backups. See keystonepm.app/security for more detail.
7. Retention
We retain personal information for as long as needed to provide the Service. When a Customer’s subscription ends, the Customer may export their data for 30 days, after which we delete it per our retention schedule, except where longer retention is required by law.
8. Your choices
You may opt out of marketing emails at any time via the unsubscribe link. Depending on your state, you may have rights to access, correct, or delete personal information. Contact us and we will honor applicable rights, or route the request to the relevant Customer where they control the data.
9. Children
The Service is not directed to children under 13, and we do not knowingly collect personal information from them. Resident accounts are intended for adults; minors in a household are represented by their guardians.
10. Changes and contact
We may update this policy; material changes will be posted here with a new effective date and, where appropriate, notified in-app or by email. Questions or requests: hello@keystonepm.app.