Privacy

Only what the product needs to do its job:

• Your email address and password, so you can sign in. We never see the password itself — it is stored as a one-way hash by our database provider.
• Your business name, town, trade, and website address.
• What we read from your website once, when you sign up: the words on it, your colours, and the services you list.
• Photographs you upload, and a short written description of each.
• The posts we write for you, your approvals, and any note you send back with one.
• The permission each social account grants us when you connect it — the key that lets us publish there. It is held encrypted and it is never shown to anyone, including us.
• Your plan, and — for payments — a customer reference held at Stripe. Card numbers never reach us.
• Ordinary technical records: when a post went out, when something failed, and what each post cost us to produce.

We do not hold your card details. We do not read your social media inbox, your followers, or anything on your accounts beyond the posts we published and how they performed. We do not buy or sell data about you, and we do not use your business's material to train anyone's software.

Almost all of it is because you asked us to run this service for you — a contract between us. Keeping records of what was published and what it cost is our own legitimate interest in running a business that can answer questions later. Where a law requires us to keep an invoice, we keep it.

Feedaly is built on other companies' services. Each one sees only the part it needs.

• Supabase — stores everything above, and runs the code that talks to it.
• Anthropic — the company whose software writes the words. What we send it is your business details, what your website said, and any note you have written about how you want to sound. Anthropic does not use it to train its systems.
• Meta (Instagram and Facebook) and LinkedIn — receive the posts you approve, because that is where they are published, and return how each one performed.
• Stripe — takes the payment and holds the card details, which never touch our systems.
• Fly.io — runs the small service that draws the picture on a post.

Some of these companies are outside the UAE and the UK, so your information travels. Each one is bound by its own contract with us covering that transfer.

For as long as you have an account, and then thirty days, so an account closed by mistake can be brought back. After that it is deleted. Invoices and payment records are kept for as long as UAE law requires, because we are not allowed to delete those on request.

We write to you seven days before it goes, so nothing about it is a surprise. If you would rather we kept it, or you want a copy first, reply to that message and we will.

Ask, and we delete it. There is no form to fill in and nothing to negotiate. Write to hello@keystonelabs.pro from the address on your account, or if you connected Instagram or Facebook you can ask through Meta and the request reaches us directly.

You get a receipt with a reference code — quote it back to us at any time and we will tell you what happened to your request. What goes is everything in the list above except the payment records the law makes us keep. Posts already published to your own feed stay on your feed — they are yours, on your account, and we have no way to remove them.

You can ask for a copy of what we hold, ask us to correct it, ask us to delete it, or object to us holding it. Write to hello@keystonelabs.pro and we will answer within thirty days. If you are unhappy with how we answer, you can complain to the data-protection authority where you live.

If we start holding something new, or send it somewhere new, this page changes and the date at the top changes with it. If the change is significant we will email you rather than hope you noticed.