Privacy and inquiries

What we collect

For a website brief: your name, email, business name, current website (optional, or that you are starting fresh), up to two optional reference websites and your description of what to keep, change or add. For an AI or roadmap inquiry: your name, email, company, current website where applicable, request type, priorities, workflow scope, timing and optional notes. Please do not include passwords, payment details or sensitive personal information. This inquiry service does not fetch submitted website addresses.

Storage and providers

Our hosting provider hosts the site and stores inquiries. Access to stored requests is restricted to authorized operators. When enabled, our email provider sends Keystone a private alert about each new request. It processes inquiry details only to notify Keystone; you are not added to a mailing list.

Security and measurement

Custom site events describe button clicks, inquiry steps and successful saves through an optional analytics service provided by our hosting provider. They do not include your name, email, website or notes. Event delivery has not been independently confirmed. Hosting providers may process connection information to operate and secure the site. The inquiry form uses hashed network and email counters to prevent abuse.

Advertising measurement

Keystone advertises on Google Search. The site loads the Google Ads tag, which can set cookies, so Google can tell Keystone when a visitor who clicked one of our ads sends a website brief. Only that a brief was saved is reported; your name, email, website and brief details are not sent to Google. Visitors in the European Economic Area, the United Kingdom, Switzerland and Canada are asked first, and nothing loads unless they allow it. Elsewhere this measurement is on by default; browsers that send a Global Privacy Control signal are treated as declining. You can allow or decline at any time with “Cookie settings” at the bottom of every page; your choice and when you made it are stored in your browser. Learn how Google uses information from sites that use its services: business.safety.google/privacy.

Retention and privacy requests

Keystone reviews unconverted inquiries after 90 days and removes those no longer needed for an active conversation. This is a manual review procedure, not an automatic deletion deadline. Active client records are retained under the engagement’s agreed terms and applicable recordkeeping requirements. Abuse counters are removed after 24 hours during routine request processing; they store no raw network addresses.

To ask for access, correction or removal, reply to a Keystone follow-up or use the inquiry form and identify your request as a privacy request in the notes. We may need to verify that the inquiry belongs to you. Removal from active storage does not promise immediate removal from provider backups.