Privacy Policy

Keystone is a customer relationship manager for real estate agents, operated from Ontario, Canada. This policy covers the website at keystonecrm.ca and the application behind it.

There are two kinds of people in it, and they are not the same:

• Customers — the agents and teams who hold an account. Keystone decides what happens to your account information, so we are responsible for it.
• Your contacts — the buyers, sellers and leads whose details a customer puts into Keystone. That information belongs to the customer. We hold and process it on their instructions and do nothing else with it. If you are a member of the public asking why an agent has your details, the agent is who can answer; we will pass your request to them and help them act on it.

From customers, because the product cannot work without it:

• Name, email address, the business name you sign up with, and the province you are registered in (Keystone is offered one province at a time).
• Billing details handled by Stripe. Card numbers go from your browser to Stripe directly — they never reach a Keystone server, and we could not show you one if you asked.
• Sign-in records: when you signed in, from which IP address and browser, and whether it worked. This is how account takeover gets noticed.
• What you do in the app, at the level of “a contact was edited” or “a message was sent”, so there is an audit trail behind anything that goes out under your name.

From customers about their contacts, because they typed it in or imported it:

• Names, email addresses, phone numbers, mailing addresses and photos.
• Notes, tags, stage in a deal, and a lead score Keystone calculates from how that person has behaved.
• Short notes the assistant writes for itself about a person from what it is told in conversation — how they prefer to be contacted, who makes the decision — and the same kind of note about the customer’s own preferences. These are capped at a few lines, shown to the customer on the person’s page or read back on request, can be dropped by asking the assistant to forget them, and are deleted with the contact.
• The content of email and text messages sent to or received from them through Keystone, and whether each one was delivered, opened, bounced or unsubscribed.
• Documents uploaded to a deal, including agreements of purchase and sale, and the dates and terms read out of them.
• Consent records: what a person agreed to receive, when, and how that was established. Canadian anti-spam law requires us to be able to prove this, so these outlive the contact record itself.
• Readiness records: for each client on a transaction, what you recorded about the RECO guide, the representation arrangement and the identity step handed on to your brokerage’s own process — a status, a date, a note, the name of a document you linked, and who recorded it. They are your brokerage’s compliance records, so, like consent records, they outlive the contact record itself.

If a customer connects a mailbox or calendar, Keystone reads the messages and events in it in order to show them in the app. We take no more than the product displays, and disconnecting the mailbox stops the synchronisation. What that means for a Google account specifically is set out in the next section.

If you connect a Gmail account, Keystone asks Google for permission to read your mail and to send mail as you. Here is exactly what is done with what that permission returns.

• What is read. Only messages exchanged with people who are already contacts in your Keystone workspace: their headers, body text and attachment count. Mail with anyone else is never copied out of your mailbox, never stored, and never shown to the assistant.
• What it is used for. Showing those conversations on the contact’s timeline, and letting the assistant draft replies to them. A draft goes to Google’s Gemini API in the same way as anything else you ask the assistant, described above. No email content is used to train or improve any AI model, ours or anyone else’s.
• What is sent. Only what you or the assistant compose in Keystone and you press send on. Sent mail appears in your own Sent folder like any other message.
• Who else sees it. Nobody, beyond the processors listed below that store or move it on our behalf. We do not sell it, do not use it for advertising, and no person at Keystone reads it unless you ask us to for support, we need to for security or abuse investigation, or the law requires it.
• How to stop. Disconnect the mailbox under Settings, or revoke Keystone’s access from your Google account. Either one stops synchronisation at once; copies already on a contact’s timeline follow the retention rules below.

Keystone’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Key, the assistant inside Keystone, runs on Google’s Gemini models. When you ask it something, the information needed to answer — which can include a contact’s name and details, the text of your emails, and the contents of a contract you uploaded — is sent to Google’s API and comes back as an answer or a draft. Nothing is removed or masked before it is sent; the assistant would be useless if it were.

Keystone uses Google’s paid API tier. Google states that content submitted through the paid tier is not used to train its models and is retained only briefly for abuse monitoring. That is Google’s undertaking rather than ours, and their terms are the authority on it.

The assistant drafts; it does not send. Nothing goes to a client until a person has read it and pressed send, and Keystone keeps a record of who did.

• Run the product you are paying for.
• Send the messages you tell it to send, at the times you tell it to.
• Take payment, and tell you when a payment fails.
• Notice and fix faults. Error reports go to our monitoring provider; they carry the shape of what broke, not the records involved.
• Answer you when you write to us, and warn you about something that affects your account.
• Meet legal obligations — anti-spam consent evidence, tax records, a lawful order.

We do not sell personal information. We do not share it with advertisers. We do not use one customer’s contacts to improve anything for another customer, and the database enforces that at the row level rather than trusting the application to remember.

Keystone runs in the United States — the application and its database are hosted in Oregon. Personal information collected in Canada is therefore stored and processed outside Canada, and while it is there it is subject to United States law, including lawful access requests by American courts and agencies. Canadian privacy law requires us to tell you that plainly, and there is no version of this product today in which it is not true.

These are the companies that process data on our behalf:

Each of them is bound to use the information only to provide their service to us. We will also disclose information where the law requires it, and to a buyer if the business is sold — in which case this policy follows the data.

Account and contact records are kept for as long as the account is open, because a CRM whose memory expires is not a CRM. When an account is closed we delete its data within 30 days, except where we are required to keep something longer — anti-spam consent evidence and financial records are the usual reasons.

Consent evidence is the record that someone agreed to hear from you: what they agreed to, how, when, and their name, email and phone number at the time. Because anti-spam law may require you to prove that agreement later, it is kept for 3 years from when it was recorded — even after the contact is deleted or the account is closed — and then deleted. While the account is open, it is included in your data export.

Readiness records are the history of what was recorded for each client on a transaction. They are your brokerage’s compliance records, so, like consent evidence, they are kept when a contact is deleted: what was recorded can still be shown later, with the person’s name as it was recorded. Corrections and withdrawals are added to the history and never written over it. Unlike consent evidence, they are deleted with the transaction or the account, and while the account is open they are included in your data export.

Some things expire on their own, whatever else happens:

• Sign-in and security events: 90 days.
• Ended sessions: 30 days.
• Rate-limiting counters: 24 hours.

Under Canadian privacy law you may ask for a copy of the personal information we hold about you, ask us to correct it, ask us to delete it, or withdraw a consent you gave. Write to [email protected] and we will answer within 30 days. There is no charge.

If you are asking about details an agent holds about you rather than about your own Keystone account, tell us who the agent is. The information is theirs to release, so we will pass the request on and make sure they can act on it.

To stop receiving messages sent through Keystone, use the unsubscribe link in any of them or reply with the word STOP. That takes effect immediately and covers email, text and calls from that agent.

If you are not satisfied with how we have handled a privacy question you can complain to the Office of the Privacy Commissioner of Canada. We would rather you told us first.

Traffic is encrypted in transit and data is encrypted at rest by our hosting provider. Each customer’s records are isolated from every other customer’s inside the database itself, so a mistake in the application cannot show one agent another agent’s contacts. Access to production systems is limited to those who need it, and sign-ins are logged.

No system is perfect. If personal information under our control is lost or exposed in a way that creates a real risk of significant harm, we will notify the people affected and the Privacy Commissioner, as Canadian law requires.

Keystone is a tool for licensed professionals. It is not intended for anyone under 18 and we do not knowingly collect their information.

When this policy changes we update the date at the foot of the page. If a change materially affects how we handle your information we will tell account holders by email before it takes effect. This version has been in force since 23 September 2026.

Privacy questions, access requests, corrections, complaints and everything else go to the same place: [email protected].

Our Terms of Service cover the rest of the relationship.