KeyBoltSub-processors
Last updated: October 29, 2026
The table below lists the services KeyBolt currently uses to deliver the platform. Each listed service that processes personal data on our behalf is contractually bound by data processing terms equivalent to or stronger than those in our Privacy Policy, with one exception: the map, geocoding, and routing services (Geoapify, OpenStreetMap Nominatim, Project OSRM, OpenFreeMap, and TomTom) are used under their own published terms, as each description says. A few are public data sources or infrastructure that receive no customer or personal data, noted as such in their description.
We will provide at least 30 days' notice at this URL before adding a new sub-processor. To receive notifications by email, write to [email protected].
Planned addition: BILL
We plan to offer BILL as an optional service for invoice delivery and payment reconciliation. For the customers and invoices a shop selects, BILL would receive invoice identifiers, dates, line descriptions, amounts, invoice PDFs, and selected supporting attachments. Those files may include customer names, contact details, service addresses, job photos, signatures, and customer documents. KeyBolt would read customer contact details and invoice, credit memo, received-payment, and reversal records from BILL to reconcile those invoices, including credit amounts and their invoice allocations. KeyBolt would store encrypted BILL connection and session credentials and related identifiers.
Processing may occur in the United States and other countries under BILL’s privacy notice. Production use will begin only after at least 30 days' advance notice at this URL, completion of required data processing terms, and separate activation.
| Service | Role | Country |
|---|---|---|
| Supabase | Primary database, authentication, file storage. Stores all customer records, jobs, invoices, key codes, photos, and identity-verification uploads. | United States (Northern Virginia, AWS us-east-1) |
| Stripe | Payment processing for subscription billing and shop-to-customer invoices, including Stripe-hosted payment pages and Stripe card-entry fields in the web and mobile apps. Card details go directly to Stripe. Stripe Connect routes payouts to the locksmith’s bank account; Stripe Terminal handles in-person payments. | United States |
| Intuit (QuickBooks Online) | Optional accounting integration. When a locksmith connects their own QuickBooks Online company, KeyBolt sends the records needed to keep those books current: customer names and contact details, billing and service addresses, invoices and their line items, estimates, payments and refunds, credit memos, vendors, bills, and inventory items and quantities. KeyBolt stores the shop’s encrypted QuickBooks tokens and company identifier. Stripe remains the payment processor and sends customer receipts; KeyBolt does not charge cards through QuickBooks. Payroll access is read-only and is not enabled. | United States |
| Square | Optional support-assisted payment processor. When a locksmith uses their own Square account, KeyBolt can process that shop’s customer invoice payments through Square instead of Stripe. KeyBolt stores the shop’s encrypted Square access tokens and merchant/location identifiers to send payable invoices and reconcile payments; card details are entered on Square-hosted pages and are never stored by KeyBolt. | United States |
| Telnyx | Telecommunications carrier for KeyBolt Pro — voice calls, SMS, MMS, A2P 10DLC registration, call recording, and Whisper-based transcription. On a call a tech hands to the AI phone receptionist, the whole call recording, including the caller’s conversation with the receptionist, is transcribed with Deepgram speech to text, because it returns the timing needed to separate the part before the hand-off. Acts as the underlying carrier for the shop’s business phone number. Where a shop enables the AI phone receptionist, caller audio on those calls is processed within Telnyx’s AI assistant platform using speech-recognition and language models Telnyx makes available (currently Deepgram for speech to text and the Kimi language model), as configured by KeyBolt. | United States |
| Resend | Transactional email delivery — invoices, payment receipts, team invites, password resets. | United States |
| Cloudflare Turnstile | CAPTCHA on signup, contact form, password reset, and customer-portal flows. No tracking cookies. | United States (with global edge) |
| Sentry | Error tracking, and session replay for debugging inside the signed-in dashboard only. Visitors detected in the EEA or UK are not replay-recorded. Replay masks visible text, form inputs, and media. Technical metadata may still include identifiers. | United States |
| Vercel | Application hosting, edge runtime, and analytics. Receives request metadata (IP, user-agent, geo) for serving the application. | United States |
| Google (Local Services Ads) | Optional integration on KeyBolt Pro. When connected, KeyBolt pulls LSA leads via the Google Ads API v24 and posts replies on the locksmith’s behalf. Google’s sub-processor when handling LSA conversation content. | United States |
| Google (Merchant Center / Merchant API) | Optional integration on any KeyBolt plan. When a locksmith connects a Google Merchant Center account, KeyBolt syncs the shop’s online-storefront product listings (titles, descriptions, prices, availability, and product images) to Google so they can appear in Google’s free product listings. Only product-catalog data is sent; no customer or order information is shared through this integration. | United States |
| Geoapify (KEPTAGO LTD) | Address autocomplete on web and mobile. Receives partial address text typed by staff and, when available, shop map coordinates to prefer nearby suggestions. Requests go through KeyBolt servers. KeyBolt does not add customer names, contact details, job notes, or key codes from other record fields. Suggestions are cached briefly and a selected address is saved in the relevant customer or job record. If Nominatim cannot return a precise location, Geoapify also receives the full address for the same geocoding purposes described below. Successful coordinates are cached to avoid repeat lookups; a cached result older than 30 days is refreshed on next use. Coordinates saved with the relevant record remain until corrected or deleted. Used under its standard developer terms. | Cyprus; EU hosting with a global Cloudflare network |
| OpenStreetMap Foundation (Nominatim) | Geocoding addresses to latitude and longitude: the shop address, saved service-location addresses, every job address (when a job is created or its address changes, and again later if the first lookup failed), the address of a new job being scheduled in a shop with the dispatch board turned on (to check the drive time, even if the job is not saved), and Minnesota sales-tax lookup addresses. Results are cached to avoid repeat lookups (a cached result older than 30 days is refreshed on next use). The cache is keyed on a one-way hash of the address; the address itself is never stored in it. Used under its published usage policy. | United Kingdom |
| OpenFreeMap | Map tile rendering for the in-app jobs map. The user’s browser fetches vector tiles directly from the tile CDN, which receives the user’s IP and the map area being viewed. OpenFreeMap is donation-funded and does not log requests or run analytics. Used under its published terms of use. | European Union |
| Project OSRM | Multi-stop driving previews and ordering suggestions for the map route planner. Drive previews update automatically when a route with two or more locations is opened or changed. Only stop coordinates (lat/lng pairs), including the shop when selected, are sent, with no customer names, address text, or contact information. Used under its published usage policy. | Germany |
| TomTom | Traffic-aware drive-time checks, only for shops with the dispatch board turned on. Receives the map coordinates (latitude and longitude) of two job addresses and the planned departure time, to estimate the drive between them. This happens when a job is scheduled, rescheduled, or moved, and while the board’s live view is open, which refreshes drive times about every 30 seconds, whenever the shop’s schedule changes, and when the page is opened again. The address text, customer names, contact details, job notes, and key codes are not sent. An unavailable estimate uses a labelled 15-minute fallback. Used under its standard developer terms. | Netherlands (processing may also occur in service-provider countries) |
| AI model providers via the Vercel AI Gateway (currently Google Gemini, OpenAI) | Powers the optional in-app AI helper, the drafting of jobs from inbound emails, the junk classification that keeps ads and verification codes out of the shop inbox, and (on KeyBolt Pro) call-transcript summaries and field suggestions. With the shop’s AI permission, enabled automatic Colab merging may send selected original messages (including those imported from Google Local Services Ads), transcripts, work documents, and images to Google Gemini to read attachments and compare work details. When a shop scans a paper drop-off form, the photo is sent to Google Gemini to read the customer details, claim number, item, and work requested into a draft job. When staff fill a reply template, the customer’s recent emails, text messages, and call summaries in that conversation are sent to Google Gemini to fill its blanks; messages imported directly from Google Local Services Ads, Messenger, Instagram, and Yelp are excluded from reply-template filling. Notifications or relays received as email or SMS may still be included. Conversation text, inbound email content (sender, subject, and body; plus, for job-draft generation only, selected PDF attachments such as work orders that Google reads using optical character recognition when scanned), and call transcripts are routed through the Vercel AI Gateway, currently to Google (Gemini models, for the chat helper, job-draft generation, email classification, and call summaries) and to OpenAI (text-embedding models, for search indexing). The structured key-code, bitting, and safe-combination fields on customer records are never sent. The providers are directed, via the Vercel AI Gateway, not to use content for model training; brief provider-side retention for abuse monitoring under standard API terms, then deleted. | United States (provider routing may vary) |
| Cloudflare (Email Routing + Workers) | Receives inbound emails sent or forwarded to your KeyBolt inbox address ([email protected]). A Cloudflare Worker reads the message and any attachments and files them into KeyBolt for routing to the Colab inbox. Distinct from Cloudflare Turnstile (CAPTCHA), which is listed separately. | United States (with global edge) |
| Google (Business Profile API) | Optional integration. When a locksmith connects their Google Business Profile, KeyBolt reads the shop’s own review data to display it inside the app. Connected via OAuth; disconnectable at any time from Settings. | United States |
| Zapier | Optional integration. When a locksmith connects the KeyBolt app on Zapier to route their Yelp leads, Zapier carries that content between Yelp and KeyBolt in both directions. Inbound, Zapier sends KeyBolt the lead’s name, the masked email address Yelp relays, phone number, postal code, requested services, availability, survey answers, free-text messages, and links to any photos the customer attached. Outbound, KeyBolt sends Zapier each reply a team member writes, along with the Yelp lead and business identifiers, the Colab identifier and number, the sending team member’s display name, and the time sent, so the reply reaches the customer on Yelp. Zapier is the only route for outbound Yelp replies; KeyBolt will not send one unless a Zap is connected. Separately, when an account owner opens the Yelp page and clicks Start setup, the embedded Zapier setup panel receives that owner’s own first name, last name, and email address so they can create or sign in to a Zapier account. That is Subscriber account data rather than End Customer content, and it is the only Subscriber contact detail this integration sends. Nothing reaches Zapier from merely opening the page. | United States |
| Yelp | Optional integration. The source of the lead and message content that reaches KeyBolt through the Zapier connection, and the destination for the replies a locksmith sends back. KeyBolt holds no Yelp credentials and calls no Yelp API directly; the locksmith makes the connection inside Zapier. Photo links arriving with a lead are hosted by Yelp and stop working after about 24 hours. | United States |
| PowerSync (JourneyApps) | Offline sync service for the KeyBolt mobile app. Changes between the encrypted offline copy on a team member’s device and the KeyBolt database synchronize through PowerSync, which processes the organization’s business data in transit for that purpose. | United States |
| Apple (Push Notification service) | Delivers mobile push notifications to team devices. Receives the device push token, deliberately generic notification text, notification type, and pseudonymous record identifiers used to open the relevant screen. Notification text never includes an end customer’s name or phone number. | United States |
| Google (Firebase Cloud Messaging and Play Integrity) | Delivers deliberately generic push notifications to Android team devices and verifies Android app, license, and device integrity before a device can register for push. Google receives the device push token, notification text, notification type, and pseudonymous record identifiers used to open the relevant screen. Integrity checks receive the app package name, signing certificate information, device integrity and license signals, plus a one-way request hash; KeyBolt does not send the request contents to Google. | United States |
| Expo (EAS Update) | Application-code updates for the KeyBolt mobile app. Receives the device’s update request (app version and platform) — no business data. | United States |
| Upstash | Rate limiting. Short-lived request counters keyed by identifiers such as IP address, account identifier, or sender email address. No message content is stored. | United States |
| Esri (ArcGIS Online) | Public reference-data source for the Minnesota sales-tax rate lookup — not a recipient of your data. To fill in the correct rate for a Minnesota job, KeyBolt geocodes the job or customer address (through OpenStreetMap Nominatim or Geoapify, above) and matches the resulting location against Minnesota Department of Revenue tax-area boundaries within our own systems. KeyBolt retrieves those public boundary files in bulk from Esri’s ArcGIS Online; it sends Esri no customer, business, or personal data, and none is sent to any tax authority. | United States |
| NHTSA (vPIC VIN decoder) | Public reference-data source for the VIN Decode button on a customer’s vehicle. KeyBolt sends only the first 11 characters of the VIN, which describe the model (year, make, model and factory), to the free US government vPIC service, and stores the answer in its own systems. The last 6 characters, which identify one specific car, are never sent, and neither are customer, business, or personal details. Used under NHTSA’s published terms. | United States |
Data Processing Addendum
A standard Data Processing Addendum (DPA) incorporating the EU Standard Contractual Clauses and UK Addendum is available on request. Email [email protected] to receive a countersignable copy.