Keystona treats the data you entrust to us with the same care your finance and people teams treat it inside your organization. This page explains what we collect, why, and what you control.
1. What we collect
When you use Keystona, we collect:
- Account information — your name, work email, company, and authentication credentials.
- Operational data — the people, payroll, time, leave, and audit data you create in the platform.
- Usage data — page views, feature interactions, and performance metrics, used to improve the product.
- Technical data — browser type, device, IP address, and similar information collected automatically when you access the platform.
2. How we use it
We use the data we collect to:
- Provide, operate, and maintain the platform.
- Process and complete the transactions you initiate (payroll runs, leave approvals, etc.).
- Send you operational notices, security alerts, and support communications.
- Improve product performance and reliability.
- Detect, investigate, and prevent fraud, security incidents, or abuse.
- Comply with legal obligations.
3. What we don't do
- We don't sell your data.
- We don't share your operational data with third parties for marketing.
- We don't read your customer data outside of providing support — and only with your authorization.
- We don't profile your employees for any purpose other than the operational work you've configured.
4. How long we keep it
Operational data is retained for as long as your account is active, plus the period required to meet our legal and accounting obligations. You can request data export or deletion at any time by writing to privacy@keystona.io.
5. Where it's stored
Data is encrypted at rest and in transit. Production data is stored in secure, audited data centers. Backups are encrypted and retained on the same standard. Access is restricted to authorized personnel and logged.
6. Your rights
You can:
- Access the personal data we hold about you.
- Request correction of inaccurate data.
- Request deletion of your data (subject to legal retention requirements).
- Export your data in a structured, machine-readable format.
- Withdraw consent for any optional processing.
- Lodge a complaint with a data protection authority.
7. Subprocessors
We use a small number of carefully vetted infrastructure subprocessors (cloud hosting, payment processing, email delivery, analytics). A current list is available on request at privacy@keystona.io. Each subprocessor is bound by data protection agreements no weaker than this policy.
8. Cookies
We use a small number of strictly necessary cookies for session management and security. We don't use cross-site tracking cookies.
How we count visits. Our own visit counting on the public website is cookie-less and anonymous, so it needs no consent and no banner choice. When a page loads, your browser tells our server the page, the site that linked to it, any campaign tags in the address, and your device type. Our server combines a secret value that changes every day with your connection address and browser description into a scrambled key, stores only that key, and discards the address. The key cannot be turned back into you, and because the secret changes daily, nobody can follow you from one day to the next. We never store your IP address, your browser description or the full address of the page that linked to us.
One optional choice. The banner asks whether we may remember your browser with a random identifier kept in your browser's storage. If you allow it, we can tell which page or campaign brought you here when you later sign up, which helps us understand what to write more of. Declining never affects the visit count and never limits the site. You can change the choice at any time from "Cookie settings" at the bottom of every public page.
9. Changes to this policy
If we materially change how we handle your data, we'll notify you by email and in-product before the change takes effect. The current version is always available at this URL with a "last updated" date.
10. Contact
The data controller for the information described in this policy is Keystona Systems Limited (RC 9932165), registered office 26 Unzok Ugbizi, University View Estate, Ajah, Lagos, Nigeria.
Questions, requests, or concerns about this policy: privacy@keystona.io