Privacy policy

Last updated: 26 September 2026

Who we are

This policy explains how Keystone AI Ltd ("Keystone AI", "we", "us") collects and uses personal information. We are the data controller for the information described here.

Keystone AI Ltd is a private limited company registered in England and Wales, company number 17476306, with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.

For anything to do with your personal information, email hello@keystoneai.ltd.

What we collect

When you contact us

If you use our contact form or email us, we collect your name, email address, the name of your business or organisation if you give it, and whatever you choose to tell us in your message.

When you become a client

If we work together, we also hold the information needed to deliver and invoice the work: contact details for you and your colleagues, billing details, our correspondence, and the content and materials you provide for a project. Some projects involve us handling personal information on your behalf — for example, your customers' details within a tool we build. In that case we act as your data processor, and we agree how that information is handled in writing before any of it is processed.

When you visit this website

Like any website, our hosting provider records basic technical information when pages are requested, such as IP address, browser type and the time of the request, to keep the site running and secure. This website does not use cookies, advertising trackers or analytics tools. If that changes, we will update this policy and ask for your consent where the law requires it.

How and why we use it

Data protection law requires a lawful basis for each use of personal information. Ours are:

• Replying to enquiries — our legitimate interest in responding to people who contact us.
• Preparing proposals and delivering work — to take steps at your request before entering a contract, and to perform our contract with you.
• Invoicing, accounts and tax — to comply with our legal obligations.
• Keeping the website secure — our legitimate interest in running a secure, working website.
• Occasional updates about our work or products — only where you have asked for them or are an existing client, and you can opt out at any time.

We do not sell personal information, and we do not use it for automated decision-making that has legal or similarly significant effects on you.

Who we share it with

We share personal information only with organisations that help us run the business, and only as much as they need:

• our website hosting provider, which also receives contact form submissions;
• our email and document provider (Google Workspace);
• our bank, payment providers, accountant and other professional advisers;
• where a project uses a third-party AI service, the provider of that service — we will tell you which service is involved, and agree how data is handled, before any personal information is processed through it;
• anyone we are legally required to share it with, such as HMRC.

International transfers

Some of our providers are based outside the UK, including in the United States. Where personal information is transferred outside the UK, we make sure it is protected by a recognised safeguard — such as UK adequacy regulations (including the UK–US data bridge) or the ICO's international data transfer agreement or addendum.

How long we keep it

• Enquiries that don't lead to work: up to 12 months from our last contact.
• Client records, contracts and invoices: six years from the end of the financial year they relate to, as required for tax and company records.
• Personal information we process on a client's behalf: as set out in our agreement with that client, and returned or deleted when the work ends.

Your rights

You have the right to ask for a copy of your personal information, to have it corrected, to have it deleted, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time. Some of these rights have limits — for example, we may need to keep invoices for tax purposes — and we will explain if one applies.

To make a request, email hello@keystoneai.ltd. We will respond within one month.

Concerns and complaints

If you are unhappy with how we have handled your personal information, please tell us first so we can put it right. We will acknowledge your complaint within 30 days and respond without undue delay.

You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, or 0303 123 1113.

Security

We use reputable providers, encrypted connections, strong authentication and access limited to the people who need it. No system is entirely without risk, but we take reasonable technical and organisational steps to protect the information we hold.

Changes to this policy

We will update this page when our practices change. The date at the top shows when it was last revised.