Privacy Policy.

This Privacy Policy describes how KeystoneTelX (“KeystoneTelX,” “we,” “our,” or “us”) collects, uses, shares and protects personal information when you visit keystonetelx.com (the “Site”), submit a contact form, or use the client portal or admin console (collectively, the “Services”).

The Services are intended for businesses located in the United States. We do not currently target, market to, or knowingly accept accounts from individuals or businesses outside the United States. If we expand outside the United States we will update this policy first to reflect any additional rights and obligations that apply.

This Privacy Policy is one of three documents that together govern your use of the Services. For the contractual terms that apply when you visit the Site, create an account, or use the portals, see our Terms of Service. For details on cookies and similar technologies, see our Cookie Policy.

This policy does not cover the personal information that our enterprise customers process inside their own networks or applications. Where KeystoneTelXacts as a service provider or processor for an enterprise customer, the customer’s Master Service Agreement and Data Processing Addendum (DPA) govern that relationship.

For personal information collected through the Services, KeystoneTelXis the “business” under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (together, the “CCPA”), and is the equivalent under comparable privacy laws in other US states.

You can reach our privacy team at privacy@keystonetelx.com. See section 12 for the full contact details.

We collect information in three ways: directly from you, automatically from your interactions with the Services, and (only if you choose Google sign-in) from a third-party identity provider.

3.1 Information you provide directly

• Account signup — work email, password (only the bcrypt hash is stored), optional name and company name.
• Contact form — name, work email, optional company, optional phone number, topic and the message you send.
• Anything else you choose to send us — for example, by emailing enterprise@keystonetelx.com or support@keystonetelx.com.

3.2 Information collected automatically

• Server and security logs — IP address, browser user-agent, request URL, response status, timestamp. Generated by our hosting provider for every request.
• Authentication metadata— sign-in time, sign-out time, the JSON Web Token issued for your session, and events such as “administrator forced sign-out” or “session invalidated by Google Cross-Account Protection”.
• Strictly necessary cookies — see the Cookie Policy for the full list and durations.

3.3 Information from third parties (only if you use Sign in with Google)

• Google OpenID profile — email, full name, Google account ID, profile picture, and OAuth tokens needed to maintain the link between your KeystoneTelX account and your Google account. We never receive your Google password.

3.4 Categories of information at a glance

3.5 Information we do not collect

We do not collect, and the Services do not require, any of the following: government identifiers (SSN, passport, driver’s license), payment card numbers, biometric data, precise geolocation, or any data revealing race, ethnicity, religious beliefs, health, sexual orientation, or trade-union membership. If we ever introduce a feature that requires any of the above, we will update this policy first.

We use personal information for the following purposes only:

• Provide and operate the Services — authenticate you, decide what the portal shows you (client vs admin), let you contact us, route you back to the page you came from after sign-in.
• Account approval workflow — new client accounts are reviewed by a KeystoneTelX administrator before access is granted; the administrator reviewing your account will see your name, email, company and signup time.
• Security and fraud prevention— detect and respond to suspicious sign-ins, enforce session expiry, honor Google Cross-Account Protection (RISC) signals such as “account disabled” or “credentials compromised.”
• Respond to inquiries — when you submit the contact form or email us, we use your name and email to reply, and your company name and message content to route your inquiry to the right team.
• Service communications — operational emails related to your account (e.g., approval, status changes, security notices). These are not marketing.
• Legal compliance — comply with a valid legal obligation, court order, or government request, and to enforce our Terms of Service.
• Diagnose and improve — investigate errors, fix bugs, and improve reliability of the Services using aggregate or anonymized data.

We do not sell personal information. We do not use personal information for cross-context behavioral advertising. We do not run automated decision-making with legal or similarly significant effects on you.

We share personal information only as described below.

• With our sub-processors — companies that host, run or secure the Services on our behalf, under written agreements that bind them to confidentiality and security obligations comparable to ours. The full list is in section 6.
• With our administrators — internal KeystoneTelX personnel who need access to perform their roles (e.g., approving new accounts, supporting client tickets). Access is role-based and audited.
• To comply with the law — when we believe in good faith that disclosure is required by a valid legal process or to protect the rights, property or safety of any person.
• In a corporate transaction — if KeystoneTelX is acquired, merges with another entity, or sells substantially all of its assets, your information may transfer to the successor, subject to this Privacy Policy or one at least as protective.
• With your consent or at your direction — for any other sharing not described in this policy.

We do not share, sell, rent, lease or trade personal information for advertising or marketing purposes. All personal information is stored and processed in the United States.

The companies below act as our sub-processors. We disclose personal information to them strictly to operate the Services.

We will update this list when sub-processors change. Material additions will be reflected in the “Last updated” date at the top of this page.

We retain personal information only as long as it is needed:

• Active accounts — for as long as your account exists. You can ask us to delete it at any time (see section 9).
• Suspended accounts — up to 12 months after suspension to support possible reinstatement and to comply with legal hold obligations, then deleted or anonymized.
• Contact form submissions — typically up to 24 months from receipt, to enable follow-up and continuity of conversation. You can ask us to delete sooner.
• Authentication metadata — sign-in events used for security investigations are retained for up to 18 months.
• Server logs — retained by our hosting provider for the period set in their service terms (typically a few weeks of detail logs and longer for aggregated diagnostic data).
• Backups — encrypted database backups roll off automatically on the schedule set by our database provider; data deleted from the live database may persist in backups for that window.

We use industry-standard administrative, technical and physical safeguards:

• Encryption in transit — TLS 1.2 or higher for all traffic to the Services.
• Encryption at rest — managed by our database provider; passwords are stored only as bcrypt hashes and are never logged in clear text.
• Short-lived sessions — JSON Web Token sessions expire automatically and are sliding (renewed on activity). Session-invalidation events from Google Cross-Account Protection cause us to revoke matching sessions.
• Role-based access control — administrators see admin data; clients see only their own.
• Pending account approval— new self-signups start in a “pending” state and cannot reach client or admin areas until manually approved.
• Audit logging — security-relevant events (forced sign-out, RISC events, administrative actions) are recorded in a tamper-resistant audit log.

No system is completely secure. If we ever experience a data breach affecting your personal information we will notify you and the appropriate regulators within the timeframes required by applicable law.

9.1 Everyone

Regardless of where in the United States you live, you can email us at privacy@keystonetelx.com to:

• Ask what personal information we hold about you.
• Ask us to correct inaccurate information.
• Ask us to delete your account and the personal information associated with it (subject to legal retention obligations).
• Withdraw any consent you have previously given.

9.2 California residents (CCPA / CPRA)

California residents have the right to:

• Know what categories of personal information we have collected about you, the categories of sources, the business purpose, and the categories of third parties with whom we share it (this Privacy Policy provides that disclosure).
• Access a copy of the specific pieces of personal information we hold.
• Delete personal information we have collected (subject to permitted exceptions).
• Correct inaccurate personal information.
• Opt outof the “sale” or “sharing” of personal information. KeystoneTelX does not sell or share personal information as those terms are defined under the CCPA/CPRA, and we honor the Global Privacy Control (GPC) signal where it has legal effect.
• Limit use of sensitive personal information — we use account credentials only to authenticate you; nothing further.
• Non-discrimination — we will not discriminate against you for exercising any of these rights.

You can submit a verifiable consumer request by emailing privacy@keystonetelx.com. You may use an authorized agent; we may ask you to verify their authority. We will respond within the timeframes required by law (generally 45 days, extendable once by another 45 days).

9.3 Other US states

A growing number of US states have enacted comprehensive consumer privacy laws that grant rights similar to the CCPA. If you are a resident of one of the states listed below, you may have rights to access, delete, correct, or port your personal information, and to opt out of certain processing, subject to the specific provisions of your state’s law:

• Currently in effect: California, Colorado, Connecticut, Utah, Virginia, Iowa, Indiana, Tennessee, Texas, Oregon, Montana, Delaware.
• Effective in 2026 or later: Maryland, Minnesota, Nebraska, New Hampshire, New Jersey, Kentucky, Rhode Island.

To exercise any of these rights, contact us at the address in section 12.

KeystoneTelXprovides a business-to-business service. The Services are not directed to children under 13 (the threshold under the United States Children’s Online Privacy Protection Act, “COPPA”), and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us at privacy@keystonetelx.com and we will delete it.

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page reflects the date of the most recent change. Material changes — such as a new category of personal information, a new sub-processor in a new region, or a change to your rights — will be brought to your attention before they take effect, by an in-product notice or by email to the address on your account.

Questions, concerns, or requests under this Privacy Policy can be sent to:

privacy@keystonetelx.com
KeystoneTelX
United States

We aim to acknowledge requests within under 4 business hours and respond substantively within the timeframes required by applicable law.