Privacy Policy

1. Scope and Roles

1.1 Covered Services. This Privacy Policy applies to all data collected through the KeyBolt website (keybolt.tech), the KeyBolt web application, the KeyBolt mobile applications (iOS and Android), transactional emails sent via the Service, SMS messages sent via the Service, voice calls placed or received through KeyBolt Pro, call recordings and transcripts, the customer portal, and any related APIs or integrations.

1.2 Data Controller vs. Data Processor. When a locksmith shop (“Subscriber”) uses KeyBolt to manage their customers, the Subscriber is the data controller and KeyBolt acts as the data processor on behalf of the Subscriber. When KeyBolt collects data directly from Subscribers for account management, billing, and support purposes, KeyBolt is the data controller. A Data Processing Addendum (DPA) is available upon request for GDPR compliance, as referenced in our Terms of Service.

1.3 End Customers. If you are a customer of a locksmith shop that uses KeyBolt (an “End Customer”), your data is primarily governed by the locksmith shop’s own privacy practices. KeyBolt processes your data on the shop’s behalf. For questions about how your data is used, please contact your locksmith directly. For questions about how KeyBolt processes data on behalf of locksmith shops, you may contact us at the address in Section 18.

2. Information We Collect

2.1 Information You Provide Directly. We collect information that you voluntarily provide when you register for an account, use the Service, or contact us:

• Account information: Name, email address, phone number, business name, business address, and password.
• Business data: Customer records (names, addresses, phone numbers, emails), job details, invoices, estimates, payment records, inventory items, team member information, job photos, and documents.
• Team-member timekeeping data: When your shop uses the time clock, we process the clock-in and clock-out times your shop records for team members, the hours worked, any notes your shop enters for an entry, and the pay class your shop assigns to each entry: regular, overtime, double-time, or holiday. We use this to show each person their own hours and to give owners and managers team hours totals plus a weekly CSV you can download for payroll.
• Sensitive locksmith data: Key codes, bitting data, safe combinations, transponder chip information, key blank references, and vehicle access data entered into customer records.
• Identity verification data: For lockout jobs, photos of identification documents and proof of residence/ownership uploaded by techs.
• Payment information: Credit card and billing details for your KeyBolt subscription (processed by Stripe; we do not store full card numbers). Payment details your customers provide to pay invoices are processed entirely by Stripe.
• Communications: Any messages, feedback, or support requests you send to us.
• Voice and SMS data (Pro plan only): If your shop uses KeyBolt Pro, we process inbound and outbound call audio, call recordings, automatically generated call transcripts (English and Spanish), DTMF keypad presses (transfer codes), caller-ID numbers, call duration and routing metadata, two-way SMS message content sent and received through the platform, and auto-reply templates configured by your shop. Call recordings are stored by Telnyx (the underlying carrier) on its own infrastructure under its retention schedule; KeyBolt does not retain a copy of the call audio in its own storage unless your shop explicitly clicks “Save Permanently” on a specific call or enables automatic archiving (KeyBolt Pro). See Section 8a.6 for the full retention story. Transcripts and call metadata are stored on the call record on KeyBolt’s side.
• Online store and request-form data: When a Subscriber turns on their public online store, “request a service” form, or public shop page, people who buy a product or submit a request through those KeyBolt-hosted pages provide a name, email address, and phone number, plus a shipping address for shipped orders, together with the items ordered and the amount paid. Card details are handled entirely by Stripe; KeyBolt does not store card numbers. This buyer and requester information is stored on the order or lead record, is visible to the Subscriber who operates that store or form, and is permanently deleted when that Subscriber deletes their KeyBolt account.

2.2 Information Collected Automatically. When you access the Service, we automatically collect certain technical information:

• Device and browser data: IP address, browser type and version, operating system, device type, screen resolution, and language preferences.
• Usage data: Pages visited, features used, click patterns, time spent on pages, referring URLs, and navigation paths.
• Log data: Server logs including request timestamps, HTTP methods, response codes, and request durations.

2.4 Mobile Application. If your team uses the KeyBolt mobile app, the following also applies:

• Offline copy on the device: The app keeps an offline copy of your organization’s business data on the device so it works without a connection. That local database is encrypted on the device, and the encryption key is stored in the device’s secure keychain. Changes synchronize with our database through the PowerSync sync service (see Section 6.1). When a team member is deactivated, the app signs out and removes its local data.
• Push notifications: Delivered through Apple Push Notification service on iOS and Firebase Cloud Messaging on Android. Notification text is deliberately generic (for example, “Missed call”) and never includes an End Customer’s name or phone number. Each team member can turn alert categories on or off in the app’s settings and can disable visible alerts in the device’s system settings. KeyBolt may still deliver a data-only security message that tells the app to recheck authorization and remove local data after the account or device is deactivated.
• Device permissions: Both apps may ask for camera or photo access for job photos, notification permission, and optional biometric authentication to unlock sensitive customer data stored for offline use. The iOS app may also ask for location access to set up or use Tap to Pay on iPhone. KeyBolt does not offer Bluetooth-reader setup in the mobile app. The Android app does not request location, Bluetooth, activity-recognition, microphone, or screen-overlay permission. Each requested permission is optional and requested only when the related feature is used.
• App and device integrity: On Android, Google Play Integrity checks whether the installed app is recognized by Google Play, whether the Play license is valid, and whether the device meets basic integrity requirements. Google receives the app package name, signing certificate information, device integrity signals, license status, and a one-way hash that binds the check to a push-registration request. KeyBolt does not send the request contents to Google.
• Crash reporting and updates: The app reports crashes to Sentry with personal data collection disabled, and checks Expo’s update service for application-code updates (Expo receives the update request, not your business data).

2.5 Information from Third Parties. We may receive limited information from third-party services:

• Stripe: Subscription status, payment confirmation, and Connect account verification status.
• Square: For Subscribers who connect a Square account, merchant connection status and payment confirmations.
• Intuit (QuickBooks Online): For Subscribers who connect a QuickBooks Online company, the company name and connection status, the chart of accounts, tax codes and items used to map records, and the accounting records KeyBolt reads back to keep the two systems consistent (customers, invoices, estimates, payments, refunds, credit memos, vendors, bills, and inventory).
• OpenStreetMap Nominatim: Address autocomplete when you type an address into the Service (Nominatim returns matching suggestions), and geocoding — converting the shop address, saved service-location addresses, and any address you look up for the Minnesota sales-tax rate into map coordinates. Nominatim receives the address text; we do not send any other customer data with it.
• Minnesota sales-tax rate lookup: For a job or customer address in Minnesota, we determine the correct sales-tax rate by geocoding the address (through OpenStreetMap Nominatim, described above) and matching the resulting location against Minnesota Department of Revenue tax-area boundaries within our own systems. No customer data is sent to any tax authority.
• Google Ads API (Local Services Ads): For Subscribers who connect their Google Local Services Ads account, we receive lead metadata (lead identifier, type, status, category, service, creation timestamp, charge state) and the message content of any messages or call transcripts the lead and Subscriber exchange via Google’s Local Services platform. On our current access tier, Google does not return the lead’s name, phone number, or email address through its API; those become visible to the Subscriber only inside Google’s own Local Services dashboard. This data is used only to surface LSA leads in the Subscriber’s KeyBolt inbox and to deliver replies they compose back through the API. Use of this data adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• Meta (Facebook Messenger): For Subscribers who connect a Facebook Page, we receive the Page identifier and name, each sender’s Page-scoped identifier, the sender’s public profile name when Meta makes it available, and the message content and attachment metadata exchanged with that Page. We use this information to identify the conversation in the Subscriber’s KeyBolt inbox and deliver replies through Messenger. If Meta no longer authorizes the saved Page token, KeyBolt stops profile lookups and replies. During connection setup, KeyBolt temporarily receives the Facebook user access token and the identifiers, names, and access tokens for authorized Pages the owner manages so the owner can choose a Page. Only the selected Page credential is retained. The user token and unselected Page credentials are not persisted, and encrypted Page selection tickets expire after 10 minutes. Prior conversation history remains subject to the retention and account-deletion terms in Section 10.
• Meta (Instagram): For Subscribers who connect an Instagram professional account, we receive the account identifier, username, and account type; each sender’s Instagram-scoped identifier; the sender’s name and username when Meta makes them available; and message content and attachment type exchanged with that account. We use this information to identify the conversation in the Subscriber’s KeyBolt inbox and deliver replies through Instagram. KeyBolt stores the selected account’s access token encrypted. If Meta no longer authorizes the saved token, KeyBolt stops profile lookups and replies until the account owner reconnects it. Prior conversation history remains subject to the retention and account-deletion terms in Section 10.
• Cloudflare Turnstile: Bot detection signals during account signup, password recovery, contact form submission, and customer portal authentication (no personal data is shared; only a challenge token is verified).

3. How We Collect Information

3.1 Direct Collection. We collect information directly from you when you create an account, fill out forms, enter data into the Service, upload files, send us correspondence, or make a purchase.

3.2 Automated Collection. We use cookies and similar technologies to collect usage data automatically when you interact with the Service. See Section 7 for details on cookies and tracking technologies.

3.3 From Your Use of the Service. When Subscribers use KeyBolt to manage their locksmith business, the data they enter about their customers, jobs, and operations is stored and processed by us on their behalf.

4. How We Use Information

4.1 To Provide and Maintain the Service. We use your information to operate the platform, process transactions, send invoices, deliver SMS and email notifications, manage team accounts, track inventory, generate reports, and provide customer support.

4.2 To Process Payments. We use Stripe to process KeyBolt subscription payments and to process payments from End Customers on behalf of Subscribers via Stripe Connect and Stripe Invoicing. Where a Subscriber connects their own Square account instead, End Customer invoice payments for that Subscriber are processed through Square. Payment data is shared with the relevant processor as necessary to complete transactions.

4.3 To Communicate with You. We use your contact information to send transactional emails (invoice confirmations, payment receipts, team invitations, password resets), service announcements, and responses to your inquiries.

4.4 To Improve the Service. We analyze aggregated, de-identified usage data to understand how the Service is used, identify bugs, improve features, and develop new functionality. Sensitive locksmith data (key codes, bitting, safe combinations) is never included in analytics.

4.5 To Ensure Security. We use technical information to detect fraud, prevent abuse, enforce rate limits, maintain audit logs, and protect the integrity of the Service and your data.

4.6 To Comply with Legal Obligations. We may process your information as required by applicable law, regulation, legal process, or governmental request.

4.7 AI Features. KeyBolt includes several AI features. They are disabled by default until an owner or manager explicitly allows the listed third-party AI providers to process the listed categories of shop and customer data in Settings. That permission applies to the whole shop, is tied to the disclosed policy version, and can be withdrawn in Settings at any time; after withdrawal, new AI processing stops. First, an in-app AI helper answers questions about your own shop’s data; when you send a message, the text of your message and the related business records the helper needs to answer (such as jobs, customers, and invoices) are sent to our AI provider to generate a reply. Second, an AI email job-draft reads inbound emails received at your shop’s KeyBolt inbox address (the sender name and address, the subject, and the first portion of the message body) and suggests a pre-filled job or estimate for your review. For the job draft only, selected PDF attachments such as work orders are also sent to our AI provider and read, including optical character recognition for scanned documents, to pull out job details. Separately, the sender, subject, body text, and limited email header signals (but not attachments) are read to sort junk out of your inbox: email that is clearly an advertisement, a newsletter, or a verification code is placed in a reviewable Filtered list instead of your inbox, and you can move any email back with one tap. This processing applies to every email that arrives at your inbound address, including mail you choose to forward there from another mailbox, and the account owner can turn junk filtering off in Settings. Third, on KeyBolt Pro, your call transcripts are automatically processed by the same AI provider after a call to produce a short call summary and to suggest structured fields (such as a customer name or job type) from the call.

AI phone receptionist and live handoffs. On KeyBolt Pro, a shop may enable an AI phone receptionist for missed or after-hours calls; when it answers, the caller’s audio is processed for speech recognition and spoken responses within our carrier Telnyx’s AI assistant platform, which uses speech-recognition and language models Telnyx makes available (currently Deepgram for speech to text and the Kimi language model for responses), as configured by KeyBolt. What the receptionist is given depends on how it was started. When it answers a missed or after-hours call on its own, it is given only the caller’s phone number and language preference, not your customer records. It can also be handed a live caller by someone at the shop, from the browser phone or by entering the shop’s AI transfer code on the keypad. On that handoff, it receives any of the following that are available: the customer or business name, phone number, email address, a short excerpt from customer notes, a short list of recent jobs, the latest available transcript excerpt, and any reason typed by the person making the handoff. This context helps it continue from the handoff. Either way, those calls are recorded and transcribed like any other inbound call.

Except for the phone receptionist (which runs within Telnyx’s platform as described above), these features run through the Vercel AI Gateway, currently to Google (Gemini models); separately, KeyBolt currently uses OpenAI embedding models through the same Gateway to index your records for search. We send only the data needed for each request. We never send the key-code, bitting, or safe-combination fields stored on customer records; note, however, that content you type or upload into the AI knowledge base is sent as-is, so do not paste those secrets there. We do not use your content to train AI models, and we direct our AI providers, through the Vercel AI Gateway, not to use your prompts or their outputs to train their models. A provider may retain this data briefly to operate the feature and to detect abuse under its standard API terms, after which it is deleted. These AI features are assistive only. A person at your shop reviews and confirms any suggestion before it is acted on, so no job, invoice, or other consequential action is created solely by automated means. KeyBolt stores your AI helper conversations and any suggested job draft inside your own account; the Data Retention section describes how long. If we change or add an AI provider, we will update the sub-processor list at keybolt.tech/subprocessors with at least 30 days’ advance notice, the same as for any other sub-processor change.

5. Sensitive Locksmith Data Handling

We recognize that key codes, bitting data, safe combinations, and related security information are extraordinarily sensitive. Unauthorized disclosure could compromise the physical security of homes, businesses, and vehicles. We apply the following enhanced protections to this data:

5.1 Encryption. All sensitive locksmith data is encrypted at rest in the database and encrypted in transit using TLS. Database backups containing this data are also encrypted.

5.2 Access Isolation. Sensitive locksmith data is protected by row-level security (RLS) policies in the database. Only authenticated users belonging to the same organization can access their organization’s data. No other Subscriber can view your data. KeyBolt employees cannot view key codes, bitting data, or safe combinations.

5.3 Exclusion from Logging and Analytics. Sensitive locksmith data is never written to application logs, error reports, analytics systems, or debugging tools. Log redaction rules are enforced at the application layer.

5.4 No Third-Party Transmission. The key-code, bitting, and safe-combination fields stored on a customer record are never transmitted to any third-party service. They are stored exclusively in our Supabase (PostgreSQL) database and are never sent to Stripe, Telnyx, Resend, Vercel, Google, our AI provider, or any other external provider, and the AI features described in Section 4.7 exclude those fields from what they send. One exception: content you type or upload into the AI knowledge base is sent to the AI provider as you wrote it, so you should not paste key codes, bitting, or safe combinations into the knowledge base.

6. How We Share Information

6.1 Service Providers. We share data with the following third-party service providers, strictly as needed to operate the Service. One (Esri) is instead a public data source we retrieve public files from and send no data to; it is listed for transparency. A current list with country of processing is maintained at keybolt.tech/subprocessors; we will provide at least 30 days’ advance notice on that page before adding any new sub-processor.

• Supabase (database, authentication, and file storage hosting) — stores all application data including account information, business data, and encrypted sensitive locksmith data. Supabase provides the PostgreSQL database and authentication infrastructure.
• Stripe (payment processing) — receives customer names, email addresses, invoice line items, and payment amounts to process KeyBolt subscription payments and End Customer invoice payments via Stripe Invoicing and Stripe Connect. Stripe’s privacy policy governs their handling of payment card data.
• Square (payment processing). When a Subscriber connects their own Square account, Square receives customer names, email addresses, invoice line items, and payment amounts to process that Subscriber’s End Customer invoice payments. Square’s privacy policy governs their handling of payment card data.
• Intuit (QuickBooks Online accounting). When a Subscriber connects their own QuickBooks Online company, Intuit receives the records needed to keep those books current: End Customer names and contact details, billing and service addresses, invoices and their line items, estimates, payments, refunds, credit memos, vendors, bills, and inventory items and quantities. This integration is optional and off by default, and a Subscriber can disconnect it at any time from Settings. Stripe remains the payment processor and sends payment receipts; KeyBolt does not charge cards through QuickBooks. Intuit’s privacy statement governs their handling of this data.
• Telnyx (telecommunications carrier and recording / transcription processor): on the KeyBolt Pro tier, Telnyx receives End Customer phone numbers, full call audio, SMS content, and DTMF keypad input. Telnyx generates and stores the call recording on its own infrastructure under its retention schedule (typically 30 days on the Telnyx CDN after which the recording is removed by Telnyx); KeyBolt persists only the call metadata and the multilingual transcript (English and Spanish) on the call record. On KeyBolt Pro, that transcript is also processed by our AI provider to generate a short call summary and suggested fields (see Section 4.7). KeyBolt does not retain a copy of the call audio in its own object storage unless a Subscriber explicitly clicks “Save Permanently” on a specific call or enables automatic archiving (KeyBolt Pro). See Section 8a.6 for the full retention story. If a shop enables the AI phone receptionist, caller audio on those calls is processed within Telnyx’s AI assistant platform using speech-recognition and language models Telnyx makes available (currently Deepgram for speech to text and the Kimi language model), as configured by KeyBolt; see Section 4.7. Telnyx is also used to send transactional SMS (appointment reminders, “On My Way” notifications, invoice links). Each shop runs through its own Telnyx subaccount; voice + SMS usage is billed by Telnyx at carrier rates without markup. Telnyx’s privacy policy governs their handling of call audio: telnyx.com/privacy-policy.
• Resend (email delivery) — receives recipient email addresses and email content for transactional email delivery (invoices, payment receipts, team invitations, overdue reminders, estimate notifications, low stock alerts).
• Vercel (application hosting and analytics) — processes HTTP requests and serves the web application. Vercel receives standard HTTP request data (IP address, headers, request path). Vercel Analytics collects anonymous page view metrics (page URL, referrer, country) without using cookies or collecting personally identifiable information.
• Google Business Profile API (reviews) — for Subscribers who connect their Google Business Profile via OAuth, receives the connection authorization and returns the shop’s own review data for display inside KeyBolt. Subscribers can disconnect at any time from Settings.
• Google Ads API / Local Services Ads (lead synchronization for Subscribers who connect a Google Local Services Ads account) — when a Subscriber explicitly authorizes the connection via OAuth, KeyBolt receives lead metadata from the Google Ads API on their behalf, including the lead identifier, lead type, status, category, service, creation timestamp, and the message content of any conversation rows the lead and Subscriber exchange via Google’s Local Services platform. On our current Google API access tier, the End Customer’s name, phone number, and email address are not returned to KeyBolt — those fields remain visible only inside Google’s own Local Services dashboard. We use the data we do receive only to display LSA leads in the Subscriber’s KeyBolt inbox and to send replies the Subscriber composes back to the lead through the same API. We do not share Google LSA lead data with any third party, use it for advertising, or sell it. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Subscribers can disconnect the integration at any time from Settings, which immediately revokes our OAuth tokens and stops all further data sync.
• Google Merchant Center / Content API (online storefront product listings) — for Subscribers who connect a Merchant Center account, receives the shop’s product catalog (item names, descriptions, prices, and images) to list those products on Google. No End Customer personal information is sent to Merchant Center. Subscribers can disconnect at any time from Settings, which revokes our access.
• Sentry (error tracking, performance monitoring, and session replay) — receives error traces (without personally identifiable information), browser metadata, performance data, and session replay recordings (sampled at 10% of all sessions and 100% of sessions where an error occurs, with all text, form inputs, and media masked to prevent capture of readable content) for debugging and application reliability. Sentry may use cookies for session tracking during error reports and replay sessions. Full privacy policy: sentry.io/privacy.
• Cloudflare (bot detection via Turnstile) — receives IP addresses, browser fingerprint data, and challenge tokens during CAPTCHA verification on signup, login, and password reset forms. Cloudflare uses this data to distinguish human users from automated bots. Full privacy policy: cloudflare.com/privacypolicy.
• OpenStreetMap Foundation (Nominatim) (address autocomplete and geocoding) — receives address text typed by users to return suggestions, and receives the shop address, saved service-location addresses, and Minnesota sales-tax lookup addresses to convert into latitude / longitude coordinates. The lat/lng result is cached locally to avoid repeat lookups (a result older than 30 days is refreshed on next use), keyed on a one-way hash of the address — KeyBolt never stores the address itself in the cache. Located in the United Kingdom. Operations policy: operations.osmfoundation.org/policies/nominatim.
• Esri (ArcGIS Online) (public Minnesota sales-tax boundary data) — a public reference-data source, not a recipient of your data. For a Minnesota sales-tax rate lookup, KeyBolt geocodes the job or customer address (through OpenStreetMap Nominatim, above) and matches the resulting location against Minnesota Department of Revenue tax-area boundaries within our own systems. KeyBolt retrieves those public boundary files in bulk from Esri’s ArcGIS Online; it sends Esri no customer, business, or personal data, and none is sent to any tax authority. Located in the United States.
• Project OSRM (multi-stop route optimization) — receives only stop coordinates (lat/lng pairs) when a tech requests an optimized route across multiple jobs. No customer names, addresses, phone numbers, or other personal data is sent. Located in Germany. More information: project-osrm.org.
• OpenFreeMap (map tile rendering) — the user’s browser fetches vector map tiles directly from the OpenFreeMap CDN for the in-app jobs map. The CDN receives the user’s IP and the map area being viewed; OpenFreeMap is donation-funded and does not log requests or run analytics. More information: openfreemap.org.
• AI model providers (in-app AI helper, AI email drafting, and AI call-transcript summaries): when you use the in-app AI helper, your message text and the related business records the helper needs to answer (jobs, customers, invoices, and similar operational data) are routed through the Vercel AI Gateway, currently to Google (Gemini models), to generate a reply. When an inbound email arrives at your shop’s KeyBolt inbox address (whether sent there directly or forwarded from another mailbox), the email’s sender, subject, and body text are sent the same way to draft a suggested job or estimate and to classify whether the email is work mail or junk (see Section 4.7); for the job draft only, selected PDF attachments such as work orders are also sent and read using optical character recognition when scanned. On KeyBolt Pro your call transcripts are sent the same way to generate a short summary and suggested fields. We also currently use OpenAI (text-embedding models, via the Vercel AI Gateway) to index your records for search. We never send the key-code, bitting, or safe-combination fields stored on customer records (though content you type into the AI knowledge base is sent as-is). We direct these providers, through the Vercel AI Gateway, not to use this data to train their models; a provider may retain it briefly to operate the feature and detect abuse under its API terms, then deletes it. These providers are U.S.-based; processing is routed through the Vercel AI Gateway and may occur in the United States or another region the Gateway selects. See Section 4.7 for details.
• Cloudflare (Email Routing and Workers) (inbound email handling): emails sent or forwarded to your shop’s KeyBolt inbox address (for example, [email protected]) pass through Cloudflare Email Routing and a Cloudflare Worker, which receives the message and any attachments and files them into KeyBolt for routing to your Colab inbox. More information: cloudflare.com/privacypolicy.
• PowerSync (mobile offline sync) — when your team uses the KeyBolt mobile app, changes between the encrypted offline copy on the device and our database synchronize through the PowerSync sync service, which processes your organization’s business data in transit for that purpose. More information: powersync.com/legal/privacy-policy.
• Apple (Push Notification service) — delivers mobile push notifications to your team’s devices. Apple receives the device push token, deliberately generic notification text, notification type, and pseudonymous record identifiers used to open the relevant screen. Notification text never includes an End Customer’s name or phone number.
• Google Firebase Cloud Messaging and Play Integrity (Android notifications and app-integrity checks). Firebase Cloud Messaging receives the device push token, deliberately generic notification text, notification type, and pseudonymous record identifiers used to open the relevant screen. Play Integrity receives the Android package name, signing certificate information, device integrity signals, license status, and a one-way request hash. KeyBolt does not send the push-registration request contents to Google.
• Expo (EAS Update) — the KeyBolt mobile app checks Expo’s update service for application-code updates. Expo receives the device’s update request (app version and platform), not your business data.
• Upstash (rate limiting) — to enforce the rate limits described in this policy, short-lived request counters are stored in Upstash Redis keyed by identifiers such as IP address, account identifier, or sender email address. No message content is stored.

Connected third-party platforms. Meta is an optional platform a Subscriber chooses to connect, not a KeyBolt sub-processor. When a Subscriber connects a Facebook Page, Meta sends KeyBolt the Page identifier and name, each sender’s Page-scoped identifier, the sender’s public profile name when available, and message content and attachment metadata exchanged with that Page. When the Subscriber replies, KeyBolt sends Meta the recipient’s Page-scoped identifier and reply content for delivery through Messenger. KeyBolt stores the Page access token encrypted. When a Subscriber connects an Instagram professional account, Meta sends KeyBolt the account identifier, username, and account type; each sender’s Instagram-scoped identifier; the sender’s name and username when available; and message content and attachment type exchanged with that account. When the Subscriber replies, KeyBolt sends Meta the recipient’s Instagram-scoped identifier and reply content for delivery through Instagram. KeyBolt stores the Instagram access token encrypted. Meta handles this data under its own terms and privacy policy.

6.2 No Sale of Data. We do not sell, rent, or trade your personal information or your customers’ personal information to any third party for monetary or other valuable consideration. We do not share data with advertising networks, data brokers, or marketing platforms.

6.3 Legal Requirements. We may disclose your information if required to do so by law, court order, subpoena, or other legal process, or if we believe in good faith that such disclosure is necessary to: (a) comply with a legal obligation; (b) protect and defend our rights or property; (c) prevent fraud or other illegal activity; (d) protect the personal safety of users or the public; or (e) protect against legal liability.

6.4 Business Transfers. If KeyBolt is involved in a merger, acquisition, asset sale, bankruptcy, or reorganization, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on the Service before your information is transferred and becomes subject to a different privacy policy.

7. Cookies and Tracking Technologies

7.1 Cookies We Use. KeyBolt uses cookies for authentication, session management, and error monitoring. These cookies are required for the Service to function and cannot be disabled. They include:

• Authentication cookies: Supabase session tokens that keep you logged in and identify your account.
• CSRF tokens: Security tokens that protect against cross-site request forgery attacks.
• Application interface cookie (keybolt-user): Contains your display name, role, and organization name to render the application interface without additional server requests. This cookie does not contain sensitive data and is used only for the logged-in application experience.
• Region and consent cookies (kb-eu, kb-eu-consent): Remember whether you are visiting from a region that requires consent for non-essential cookies, and the choice you made in the consent banner.
• Cloudflare Turnstile: Our bot detection service may set functional cookies (such as cf_clearance) during challenge verification. These are strictly necessary for security and cannot be disabled.
• Sentry session tracking: Sentry may set cookies to correlate error reports and session replay recordings for debugging purposes. These cookies do not track you across other websites.

7.2 No Tracking or Advertising Cookies. We do not use tracking cookies, third-party advertising cookies, social media pixels, retargeting tags, or any other non-essential tracking technologies. We use Vercel Analytics for anonymous page view metrics. We do not use Google Analytics, Facebook Pixel, or advertising platforms.

7.3 Cookie Consent. In addition to strictly necessary cookies, Sentry may set cookies for session tracking during error reports and session replay. Vercel Analytics does not use cookies. For visitors located in the European Economic Area, the United Kingdom, or other regions requiring prior consent for non-essential cookies, we display an in-page consent banner before any session-replay recording is initialized. Visitors who decline are not session-replay recorded; only error events (with PII scrubbed at the SDK before transmission) are sent to Sentry. Strictly necessary cookies (authentication, CSRF, session) remain regardless of consent status because the platform cannot function without them.

8. SMS Messaging

8.1 Purpose. KeyBolt enables Subscribers (locksmith shops) to send transactional SMS messages to their End Customers. These messages are strictly service-related and include:

• “On My Way” notifications when a tech is en route to a job
• Appointment reminders for scheduled jobs
• Invoice payment links after job completion
• Payment receipts for paid invoices
• Declined-payment attempt notices for in-person card payments
• On the KeyBolt Pro tier, two-way conversational SMS replies between shop staff and End Customers from the shared inbox

No marketing, promotional, or advertising messages are sent through the Service.

8.2 Consent. Subscribers are responsible for obtaining appropriate consent from their End Customers before sending SMS messages. KeyBolt provides tools to record consent status in each customer record. Subscribers must obtain verbal or written consent before initiating SMS communication through the platform. Subscribers on the KeyBolt Pro tier register their brand and campaign through A2P 10DLC (handled in-app) before US carriers will deliver outbound SMS.

8.3 Opt-Out. End Customers can opt out of SMS messages at any time by replying STOP to any message received through the Service. The system will immediately cease all SMS communication to that phone number. End Customers may re-subscribe by contacting the locksmith shop directly.

8.4 Message Frequency and Content. For transactional sends, message frequency is limited to 1–3 messages per service visit. The Service enforces two layered rate limits to prevent abuse: 10 SMS messages per user per rolling hour, and 50 SMS messages per organization per rolling hour. These limits apply to outbound SMS only; inbound replies from End Customers do not count toward the cap. Message content is limited to job status updates, appointment information, invoice links, payment receipts, declined-payment attempt notices, and (on KeyBolt Pro) two-way conversation with End Customers initiated by the customer. No sensitive locksmith data (key codes, bitting, safe combinations) is ever included in SMS messages.

8.5 Carrier Disclaimer. SMS messages are delivered via Telnyx. Message and data rates may apply depending on the End Customer’s mobile carrier and plan. Carriers are not liable for delayed or undelivered messages. Delivery success may vary by carrier and geography.

8a. Voice Calls and Call Recording (KeyBolt Pro)

8a.1 Scope. This section applies only to Subscribers on the KeyBolt Pro tier and the End Customers who call or are called by those Subscribers’ shop phone numbers. Subscribers on the Basic tier do not place or receive calls through KeyBolt and this section does not apply to them.

8a.2 Recording & Transcription. Every inbound call to a KeyBolt Pro shop number is recorded and automatically transcribed. Recording starts immediately after the call connects, and an audible disclosure (“This call will be recorded for quality and training”) plays at the start of each inbound call before any tech is rung; this disclosure is built into the platform and cannot be disabled. Outbound calls a tech places through the KeyBolt mobile app’s call bridge (dialing out to an End Customer through the shop number) are also recorded, and the same audible disclosure plays to the End Customer when they answer. Outbound calls dialed directly from the browser softphone are not recorded by the platform. Calls answered by the AI phone receptionist (where a shop has enabled it) are recorded and transcribed like any other inbound call. Transcripts are generated by Telnyx in English and Spanish and stored on the call record alongside the recording URL.

8a.3 Two-Party Consent. Several US states (California, Florida, Pennsylvania, Illinois, Maryland, Massachusetts, Montana, Nevada, New Hampshire, and Washington) require all parties to a call to consent to recording. The platform-played disclosure is intended to satisfy the audible-notice requirement in those jurisdictions. Subscribers are responsible for confirming that their use of call recording complies with applicable law in every jurisdiction where their End Customers are located.

8a.4 Caller-ID Match. When a known End Customer calls a KeyBolt Pro number, KeyBolt looks up that number against the Subscriber’s customer database and surfaces the matching customer name and most recent job to the shop staff before the call is answered. End Customers may opt out of this matching by removing their phone number from the Subscriber’s records.

8a.5 DTMF (Keypad) Input. Keypad presses during a call — including IVR menu selections (e.g., “press 1”) and internal transfer codes (e.g., **11) — are processed by Telnyx and KeyBolt to route the call. Individual keypad events are recorded only in the telephony webhook diagnostic log used for routing; that log is retained for thirty (30) days and then deleted (see 8a.6 below). Keypad input is not retained on the call record itself, is not transcribed, and is not used to train any model.

8a.6 Retention. Call audio, call metadata, and transcripts each follow a different retention path:

• Call audio (recordings): stored by Telnyx on its own infrastructure under its retention schedule — typically 30 days on the Telnyx CDN, after which Telnyx removes the file. KeyBolt does not retain a copy by default. The Subscriber may, on a per-call basis, click “Save Permanently” on the call detail page; doing so triggers KeyBolt to download the audio from Telnyx and archive it in our object storage indefinitely until the Subscriber deletes the call or the parent customer record. On KeyBolt Pro, a Subscriber may instead enable automatic archiving (Section 8a.6), a best-effort daily job that copies call recordings into our storage shortly before Telnyx deletes them. Archived recordings (saved-permanently or auto-archived) are deleted within 30 days of an account deletion request (see Section 10).
• Transcripts and call metadata (caller number, duration, timestamps, recording URL) are persisted on the KeyBolt call record and retained as part of the customer’s record per Section 10. Once the underlying Telnyx audio is removed by Telnyx, the recording URL on our call record becomes a stale pointer; the transcript and metadata remain readable.
• Telephony webhook diagnostic events from Telnyx (call-progress events used for routing) are retained for 30 days, then deleted.

Subscribers who want to retain audio beyond Telnyx’s default window have two options: use the “Save Permanently” control on an individual call, or, on KeyBolt Pro, enable automatic call-recording archiving in Settings → Phone & SMS. When automatic archiving is enabled, a daily job copies your call recordings into KeyBolt’s own object storage shortly before Telnyx deletes them (around day 25 of Telnyx’s roughly 30-day window), so recordings are less likely to be lost when Telnyx removes them. This automated archiving is best-effort and subject to limits such as your account’s overall storage cap. Automatic archiving is off by default and can be turned on only by an owner or manager, for the whole organization. Archived recordings are retained until the Subscriber deletes them (per call or per customer record) or closes the account, after which they are removed from KeyBolt’s storage within 30 days.

8a.7 Access. Call recordings and transcripts are visible only to authenticated users belonging to the Subscriber’s organization, protected by the same row-level security policies as the rest of the customer record. KeyBolt employees cannot access call audio or transcripts.

9. Email Messaging

9.1 Transactional Emails. KeyBolt sends transactional emails on behalf of Subscribers to their End Customers. These include invoices, payment receipts, estimate notifications, appointment confirmations, and overdue payment reminders. KeyBolt also sends transactional emails directly to Subscribers, including team invitations, password resets, subscription confirmations, low stock alerts, and job completion notifications. All transactional emails are delivered via Resend. The Service enforces a rate limit of 50 emails per hour per organization and a monthly quota of 750 emails per organization.

9.2 No Marketing Emails to End Customers. KeyBolt does not send marketing or promotional emails to End Customers. All emails sent through the Service are transactional in nature and directly related to a service interaction. Subscribers may receive occasional product updates or service announcements from KeyBolt, from which they can unsubscribe at any time.

9.3 Forwarded Mailboxes and Junk Filtering. A Subscriber may set up forwarding from another mailbox (for example, a Gmail account) to their KeyBolt inbox address. Forwarded email is processed the same way as email sent to that address directly, including the AI job-draft and junk-filtering features described in Section 4.7. Emails the junk filter sets aside go to a reviewable Filtered list rather than the inbox; a Subscriber can move any filtered email back, and the account owner can turn junk filtering off in Settings. Filtered emails are permanently deleted 30 days after they arrive (see Section 10.3). Because forwarding sends whatever the Subscriber’s forwarding rules select, a Subscriber who forwards a mixed-use mailbox may route personal (non-business) email through the Service; that email is handled under this same policy.

10. Data Retention

10.1 Active Accounts. Your data is retained for as long as your KeyBolt account is active and your subscription is in good standing. You may access, export, or delete your data at any time while your account is active.

10.2 After Account Deletion. When you delete your account, data is handled in three categories:

• Deleted on request: Non-financial data including job photos, identity verification documents, uploaded documents, communication logs, inventory items, and job templates are permanently deleted once your deletion request is processed. Processing starts as soon as you confirm the request and finishes within 24 hours. All files in cloud storage buckets are removed, and auth credentials are deleted in the same pass.
• Soft-deleted and retained: Financial records (invoices, payments, and credit memos) and customer records are soft-deleted and retained for up to 7 years to comply with tax and legal record-keeping requirements. Estimates are retained for 90 days after deletion.
• Audit logs. Live audit logs are retained for 1 year and remain visible in the in-app activity view during that window. After 1 year, entries are moved to a long-term archive that is not exposed in the dashboard but is preserved for legal compliance and account-recovery purposes. Archive entries lose linkage to individual users as related user records expire under their own retention periods.

10.3 Soft-Deleted Records and Retention Periods. When you delete a customer record within the Service, the record is soft-deleted and retained while linked financial records exist. Soft-deleted financial records (invoices, payments, and credit memos) are permanently removed after 7 years per tax compliance requirements. Customer records are retained while linked financial records exist. Estimates are retained for 90 days after deletion. Notifications are retained for 15 days. Communication logs (email and SMS records) are retained for 90 days, then deleted. Inbound customer emails received in your shop’s Colab inbox are kept as part of the associated customer record (sender, subject, message text, and attachments) and follow the customer-record retention rules above; the exact original message file (a raw email copy kept only for forensic and deliverability purposes, never shown in the app) is retained for 24 months and then deleted. Emails the junk filter keeps out of your inbox (the Filtered list) are permanently deleted 30 days after they arrive, together with their attachments and raw message files. Telephony webhook diagnostic events from carriers (call-progress events used for debugging routing) are retained for 30 days, then deleted; the durable summary of each call (caller, duration, recording, transcript, status) lives on the call record itself and follows the customer-record retention rules above. Identity verification photos are retained for the same period as the associated job record. AI helper conversations and any AI-suggested job drafts are stored as part of your account; they are retained while your account is active and are permanently deleted when you delete your account. Expired estimate approval tokens and processed webhook events are cleaned up weekly.

11. Data Security Measures

We implement industry-standard technical and organizational security measures to protect your data, including but not limited to:

• Encryption: All data is encrypted at rest (AES-256) and in transit (TLS 1.2+). Database connections use TLS. Backups are encrypted.
• Row-level security: Every database table is protected by PostgreSQL row-level security policies that restrict data access to the owning organization.
• Authentication security: Support for multi-factor authentication (TOTP), configurable account lockout after failed login attempts, configurable session timeouts, and Turnstile CAPTCHA on signup.
• Rate limiting: Sensitive endpoints (SMS, email, authentication) are rate-limited to prevent abuse.
• Audit logging: All significant actions are recorded in an append-only, immutable audit log. Database triggers prevent modification or deletion of audit records.
• Webhook security: Stripe webhook signatures are verified on every request. Processed events are deduplicated via a persistent tracking table to prevent replay attacks.
• Input validation: All user inputs are validated server-side using Zod schemas to prevent injection attacks and data corruption.
• Least privilege: Service role keys are never exposed to client code. Browser clients use only anon keys with RLS enforcement.

No method of electronic storage or transmission is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

12. Data Breach Notification

In the event of a data breach that compromises the security, confidentiality, or integrity of your personal information, we will notify affected Subscribers via email without unreasonable delay and no later than 72 hours after becoming aware of the breach. The notification will include: (a) the nature of the breach; (b) the categories of data affected; (c) the approximate number of records affected; (d) the likely consequences of the breach; and (e) the measures taken or proposed to address the breach. We will also notify applicable regulatory authorities as required by law.

13. Children’s Privacy and Account-Holder Age Requirements

13.1 Children under 13 (COPPA). The Service is not directed to children under 13. Consistent with the Children’s Online Privacy Protection Act (COPPA), we do not knowingly collect, use, or disclose personal information from children under 13. If you are a parent or guardian and believe a child under 13 has provided us with personal information, please contact us at the address in Section 18. If we become aware that we have collected personal information from a child under 13 without verifiable parental consent, we will delete that information promptly.

13.2 Account holders must be 18 or older (capacity to contract). The Service is a paid B2B platform offered to professional locksmith businesses. To create or hold an Organization Account or to act as an Authorized User of one, you must be at least 18 years of age (or the age of majority in your jurisdiction) and have the legal capacity to enter into a binding contract. Users between 13 and 17 are not permitted to register an account, and the Service is not designed for personal consumer use.

13.3 End Customer data. KeyBolt does not require End Customers (the people the locksmith serves) to be 18, since End Customers do not register a KeyBolt account — their data is provided by the Subscriber as part of the Subscriber’s own customer record. Subscribers are responsible for their own legal obligations when collecting personal information about minors, including any parental-consent requirements under applicable law.

14. International Data Transfers

KeyBolt Inc. is a New York corporation based in the United States. Our service providers (Supabase, Stripe, Square, Telnyx, Resend, Vercel, our AI provider, and our map and geocoding providers, some of which are operated in the EU and UK, including OpenStreetMap Nominatim, OSRM, and OpenFreeMap) may process and store data in the United States and other countries. If you access the Service from outside the United States, your information may be transferred to, stored in, and processed in the United States or other jurisdictions where our service providers maintain facilities. These jurisdictions may have data protection laws that differ from those in your country. By using the Service, you consent to the transfer of your information to the United States and other jurisdictions as described in this policy.

If a Subscriber connects a Facebook Page or Instagram professional account, Meta may also process Messenger or Instagram messaging data in the United States or other countries under Meta’s own terms and privacy policy.

15. Your Rights and Choices

15.1 General Rights. Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Right of access: Request a copy of all personal data we hold about you.
• Right of correction: Request that we correct inaccurate or incomplete personal data.
• Right of deletion: Request that we permanently delete your personal data, subject to legal retention requirements.
• Right of portability: Request your data in a structured, commonly used, machine-readable format (CSV).
• Right to restrict processing: Request that we limit how we process your data in certain circumstances.
• Right to object: Object to the processing of your personal data for certain purposes.

15.2 Exercising Your Rights. To exercise any of these rights, email us at [email protected] with the subject line “Privacy Rights Request.” We will verify your identity before processing your request and respond within 30 days. If we need additional time, we will inform you of the extension and the reasons within the initial 30-day period.

15.3 Account Controls. You can manage much of your data directly through the Service:

• Update your profile and business information in Settings.
• Export your data (customers, jobs, invoices, inventory) via CSV export in the QuickBooks integration page.
• Delete your account from Settings, which initiates the data deletion process described in Section 10.2. Instructions are also available at keybolt.tech/account-deletion.
• Manage notification preferences (email toggles in Settings; per-category mobile push toggles in the mobile app).
• Enable or disable multi-factor authentication in Security settings.

16. CCPA/CPRA Notice and California Rights

This section applies to California residents and supplements the information in the rest of this Privacy Policy, as required by the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (collectively, “CCPA”).

16.1 Categories of Personal Information Collected. In the preceding 12 months, we have collected the following categories of personal information:

1. Identifiers: Name, email address, phone number, IP address, account ID.
2. Commercial information: Subscription records, payment history, invoice records, transaction details.
3. Internet or electronic network activity: Browser type, pages visited, features used, device type.
4. Professional or employment-related information: Business name, business address, team member roles, and, when a Subscriber uses the time clock, team-member timekeeping records (clock-in and clock-out times, hours, and pay class).
5. Geolocation data: Approximate location derived from IP address; job site addresses entered by Subscribers.
6. Audio, electronic, and visual information: For KeyBolt Pro shops, inbound call recordings, call transcripts, and two-way SMS content. For Subscribers who connect a Facebook Page or Instagram professional account, Facebook Messenger or Instagram message content. Job photos and uploaded documents.
7. Sensitive personal information: Identity-verification and proof-of-residence document photos a Subscriber may upload for a job. We use this only to provide the Service and do not use or disclose it to infer characteristics about any individual (see Section 16.7).

16.2 Sources of Personal Information. Personal information is collected from: (a) directly from you when you create an account or use the Service; (b) automatically through cookies and server logs; and (c) from third-party services (Stripe, OpenStreetMap Nominatim address suggestions, Cloudflare Turnstile, Google Local Services Ads lead metadata and conversation content, Meta Facebook Messenger and Instagram profile and conversation data, and inbound emails sent or forwarded to your shop’s address and routed through Cloudflare into your Colab inbox) as described in Section 2.5.

16.3 Business or Commercial Purpose for Collection. We collect personal information for the purposes described in Section 4, including providing the Service, processing payments, communicating with you, improving the Service, ensuring security, and complying with legal obligations.

16.4 Categories of Third Parties. We share personal information with the service providers listed in Section 6.1 and at keybolt.tech/subprocessors (Supabase, Stripe, Square, Telnyx, Resend, Cloudflare Turnstile, Cloudflare Email Routing, Sentry, Vercel, Google (including Gemini AI models, Local Services Ads, Merchant Center, Business Profile, Firebase Cloud Messaging, and Play Integrity), PowerSync, Apple (push notifications), Expo, Upstash, our AI model providers, and our map and geocoding providers (Nominatim, OSRM, and OpenFreeMap)) for the business purposes described in this policy. If a Subscriber connects a Facebook Page or Instagram professional account, Meta is a separate connected third-party platform and receives the Messenger or Instagram data described in Section 6.1 for delivery through its service.

16.5 Service-provider relationships. Each KeyBolt service provider listed in Section 16.4 is engaged as a “service provider” as defined in Cal. Civ. Code §1798.140(ag) and processes personal information solely on KeyBolt’s behalf under a written contract that (a) prohibits the service provider from selling or sharing the personal information, (b) prohibits use of the personal information outside the direct business relationship and the specific purposes stated in the contract, (c) requires the service provider to comply with applicable obligations under the CCPA, and (d) grants KeyBolt the right to take reasonable and appropriate steps to ensure the service provider uses the personal information consistently with KeyBolt’s obligations under the CCPA. Disclosures to service providers under this Section are not considered “sales” or “sharing” under the CCPA. Two exceptions: the public map and geocoding services (OpenStreetMap Nominatim, Project OSRM, and OpenFreeMap) operate under their own published usage policies rather than a KeyBolt-specific contract; and Esri (Section 6.1) is a public data source that receives no personal information from KeyBolt and is not a service provider. This service-provider statement does not apply to optional connected third-party platforms such as Meta, which operate under their own terms as described in Sections 6.1 and 16.4.

16.6 No Sale or Sharing of Personal Information. We do not sell personal information. We do not “share” personal information for cross-context behavioral advertising as defined by the CCPA. We have not sold or shared personal information in the preceding 12 months.

16.7 California Consumer Rights. As a California resident, you have the following rights under the CCPA:

• Right to know: You may request the categories and specific pieces of personal information we have collected about you, the sources of collection, the business purposes for collection, and the categories of third parties with whom we share it.
• Right to delete: You may request that we delete your personal information, subject to certain exceptions provided by law.
• Right to correct: You may request that we correct inaccurate personal information.
• Right to opt-out of sale/sharing: Because we do not sell or share personal information, this right is not applicable but is acknowledged.
• Right to limit use of sensitive personal information: We only use sensitive personal information as necessary to provide the Service. You may request that we limit its use to what is necessary.
• Right to non-discrimination: We will not discriminate against you for exercising any of your CCPA rights. We will not deny you services, charge different prices, provide a different quality of service, or retaliate in any way.

16.8 Exercising CCPA Rights. To exercise your California rights, email us at [email protected] with the subject line “CCPA Request.” We will verify your identity by matching information you provide against information we have on file. You may also designate an authorized agent to submit a request on your behalf by providing written authorization. We will respond to verifiable requests within 45 days. If we need additional time (up to 45 more days), we will inform you in writing.

16.9 Retention of Personal Information. We retain personal information for as long as described in Section 10. We do not retain personal information for longer than is reasonably necessary for the disclosed purposes.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other operational reasons. If we make material changes, we will notify you by email at least 30 days before the changes take effect and will update the “Last updated” date at the top of this page. Two kinds of changes may instead take effect when posted: (a) changes that only describe a new or optional feature of the Service, particularly a feature you can turn off in Settings; and (b) changes required by law or by a regulator. In both cases we will still update the “Last updated” date and will send an email notice where the change is significant. Non-material changes (such as formatting or clarification) may be made without advance notice. Continued use of the Service after the effective date of any changes constitutes your acceptance of the revised Privacy Policy.

18. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your privacy rights, or have concerns about how your data is handled, please contact us:

• Email: [email protected]
• Support email: [email protected]
• Website: keybolt.tech

We aim to respond to all privacy-related inquiries within 30 days.