Last updated: 2 November 2026
In short. We collect what you type into our forms and the newsletter signup, any emails you send us, and, only if you accept the cookies for it, how you use the site and how our ad campaigns perform. We use it to reply to you and to improve the site. We do not sell it. The services that receive some of it are listed below; most are in the United States. To get a copy of your data or have it deleted, write to info@keymate.io.
This policy explains what personal data keymate.io collects, why we collect it, who receives it, how long we keep it and what rights you have. It covers this website, including the documentation at keymate.io/docs, its forms, its newsletter signup and emails you send us. It does not cover the Keymate product, which runs on our customers' own infrastructure and reports nothing back to us, or applications made through our careers portal at careers.keymate.io. Which cookies the site sets is described in our Cookie Policy.
Who is responsible for your data
Keymate Inc., a Delaware corporation, decides how your personal data on this website is used. In data protection law this makes Keymate Inc. the controller.
Our postal address and email are under Contact at the end of this policy.
We have not appointed a data protection officer. Write to info@keymate.io about anything in this policy.
What we collect, why, and on what legal basis
We collect personal data in five ways: when you send a form, when you email us, when you subscribe to the newsletter, when you make a choice in the cookie banner, and when your browser loads our pages.
| What happens | Data | Why | Legal basis |
|---|---|---|---|
| You send the contact form | Topic, full name, email address, your message, company (optional), phone number (optional), and the time zone your browser reports | To answer your message | Our legitimate interest in replying to people who write to us |
| You request a demo | Full name, work email, company, what you tell us about your setup (optional), and the time zone your browser reports | To arrange and prepare the demo | Our legitimate interest in arranging the demo you asked for and in discussing Keymate with your organization |
| Either form is sent | A confirmation email to you, and a notification email with the same details to the Keymate team | To confirm we received it and pass it to the person who answers | Same as the form |
| You email us at info@keymate.io or careers@keymate.io | Your name, email address and what you write or attach | To answer you or, for a job application, to consider you for a role | Our legitimate interest in replying to people who write to us; for a job application, steps you asked for before a contract |
| You subscribe to the newsletter | Email address and the date you subscribed | To send you the newsletter | Your consent |
| You make a choice in the cookie banner | A consent record (see below) and a cookie that remembers your choice | To respect your choice and to be able to show that we asked | Our legal obligation to show that consent was given |
| You accept analytics cookies | Pages viewed, how you arrived, device and browser type, approximate location, and an identifier stored in a cookie. When you send a form: which form it was, whether it went through, for the contact form its topic, and whether the address is a work or personal one; never your name or email address | To count visits and see which pages help visitors | Your consent |
| You accept analytics cookies | Session recordings and heatmaps (see below) | To see where pages confuse visitors and fix them | Your consent |
| You accept marketing cookies, while we run an ad campaign | An identifier stored in an advertising cookie, the pages you view, and whether you send a form after seeing our ad; never your name or email address | To measure our ad campaigns and to show our ads to people who have visited this site | Your consent |
| You accept marketing cookies | Microsoft's own browser identifiers (MUID and related cookies), stored on Microsoft's domains when Clarity runs | Microsoft uses them for its own purposes, including advertising; Keymate does not receive them | Your consent |
| You reject cookies, or have not chosen yet | A signal that a page was viewed, without cookies or an identifier that recognizes you: the page address, the time, browser details and, while it is sent, your IP address | To estimate overall traffic | Our legitimate interest in knowing how much the website is used |
| Your browser loads any page | IP address, browser details, the address of the page and the time | To deliver the page and our tag container, and to keep the site running and secure | Our legitimate interest in running the website |
No law or contract requires you to give us personal data. To answer a message we need the topic, your name, email address and message; to arrange a demo, your name, work email and company. Without them we cannot reply. The other fields are optional. Your browser sends its IP address and browser details whenever it loads a page; without them we cannot show you the page.
All of this data comes from you or from your browser. Two things are worked out from it: your approximate location, which Google Analytics derives from your IP address, and whether an email address is a work or personal one, which our site decides from its domain. We do not obtain data about visitors from other sources.
We make no decision about you based solely on automated processing, including profiling, that has legal or similarly significant effects on you.
Careers: if you choose the Careers topic in the contact form, nothing is sent. The form links to our careers page, and applications made through the careers portal are handled on careers.keymate.io.
Consent records
When you accept or reject cookies, a record of that choice is kept so we can show that we asked and what you answered. Our cookie banner service, CookieHub, keeps the record for us. It holds a random consent token, your choice for each cookie category, the date and time, the page and browser you used, and your IP address with its last part removed, so it no longer points to your device. It does not hold your name or email address. Consent records are deleted after 12 months.
Session recordings and heatmaps
If you accept analytics cookies, we use Microsoft Clarity to record how visitors move through our pages: mouse movements, clicks, scrolling and the page as it was shown. Clarity turns these into session recordings and heatmaps, which show where a page works and where visitors get stuck.
- Clarity loads only after you accept. If you reject, it does not run. If you later withdraw your choice, Clarity stops and its cookies on keymate.io are removed; cookies Microsoft set on its own domains (clarity.ms and bing.com) stay until they expire, and you can delete them in your browser settings.
- Clarity is set to mask everything you type into form fields. Masked text is replaced in your browser before anything is sent to Microsoft, so a recording does not show what you entered.
- We use recordings to improve the website, not to identify you.
Microsoft's terms for Clarity describe Microsoft as a controller of this data in its own right, not only a service provider to us, and allow Microsoft to use it for its own purposes, including advertising. We decide to collect this data on our pages and send it to Microsoft, and for that step we are responsible together with Microsoft. What Microsoft does with the data once it has it is described in the Microsoft Privacy Statement.
Who receives your data
We do not sell your personal data. These companies receive it. Most provide a service to us and act only on our instructions. Microsoft also uses Clarity data for its own purposes (see Session recordings and heatmaps), and our advertising partners also use advertising data for their own purposes.
| Service | Company | What it receives | Role | Safeguard in its terms |
|---|---|---|---|---|
| CookieHub | CookieHub ehf., Iceland | Your cookie choice, as the consent record described above | Processor | Based in the European Economic Area; standard contractual clauses where data leaves it |
| Netlify | Netlify, Inc., United States | Every page request, and the form details while they pass through the site | Processor | EU-U.S. Data Privacy Framework and its UK Extension; standard contractual clauses as a fallback |
| MongoDB Atlas | MongoDB, Inc., United States | Form and newsletter records, stored in its database service in Frankfurt, Germany | Processor | EU-U.S. Data Privacy Framework and its UK Extension; standard contractual clauses and the UK Addendum where those do not apply |
| Microsoft 365 | Microsoft Corporation, United States | The confirmation and notification emails for each form | Processor | Standard contractual clauses (2021) and, for the UK, the International Data Transfer Agreement |
| Google Tag Manager | Google LLC, United States | Your IP address when the page loads the tag container | Processor | EU-U.S. Data Privacy Framework; standard contractual clauses where Google relies on them |
| Google Analytics | Google LLC, United States | Visit data, only if you accept analytics cookies | Processor | EU-U.S. Data Privacy Framework; standard contractual clauses where Google relies on them |
| Microsoft Clarity | Microsoft Corporation, United States | Session recordings and heatmap data, only if you accept analytics cookies; its own browser identifiers too, only if you also accept marketing cookies | Independent controller under Microsoft's Clarity terms | Microsoft is certified under the EU-U.S. Data Privacy Framework |
| Advertising partners: Google Ads, LinkedIn, Microsoft Advertising | Google LLC, LinkedIn and Microsoft (the contracting company is named here when we first run a campaign on that platform) | Advertising data, only while we run a campaign there and only if you accept marketing cookies | Each also uses the data for its own purposes, under its own advertising terms | Named here with the contracting company |
If you reject analytics cookies, Google may still receive a basic signal that a page was viewed, without any cookie or identifier that recognizes you. Google uses these signals to estimate overall traffic.
One article on our blog shows a YouTube video in YouTube's privacy-enhanced mode. When the video comes into view, your browser loads YouTube's player from Google, which receives your IP address and browser details. YouTube stores no cookies until you start the video; from then on Google's own privacy policy applies.
We may also disclose personal data when the law requires it, or to a buyer if Keymate Inc. or its business is sold. People at Keymate see your data only if they need it to answer you.
Transfers outside your country
Keymate Inc. is based in the United States. When you use this website from the European Economic Area or the United Kingdom, you send your data directly to us in the United States, and most of the services above process it there. Each service that acts for us is bound by its data processing terms to protect the data, and the table above names the safeguard each one states in those terms: certification under the EU-U.S. Data Privacy Framework and its UK Extension, or standard contractual clauses approved by the European Commission, with the UK addendum or agreement for data from the UK. You can ask us for a copy of these terms.
How long we keep it
| Data | How long |
|---|---|
| Contact and demo form records, including the notification emails in our team mailboxes | 24 months after our last contact with you. If you become a customer, for the term of the contract plus the time needed for any legal claims. Spam is deleted at once |
| Emails you send us at info@keymate.io | As for form records |
| Job applications sent by email to careers@keymate.io | 6 months after the hiring decision. Longer only if you agree to join our talent pool |
| Newsletter subscription | Until you unsubscribe. After that we keep only your email address, on a list of addresses we must not write to again |
| Consent records, kept by CookieHub | 12 months |
| The cookie that remembers your cookie choice | 12 months |
| Google Analytics data | 14 months for data linked to a cookie or identifier, the period set in our Analytics account; after that only totals that identify no one remain |
| Clarity session recordings and heatmaps | We can see recordings for 30 days; recordings we mark as favourites, a random sample Microsoft selects, and heatmaps for up to 9 months. Data Microsoft uses for its own purposes is kept under the Microsoft Privacy Statement |
| Netlify logs of the form functions | 24 hours to 7 days, depending on the Netlify plan. Netlify sets this period |
| Security logs kept by Netlify, including records of page requests | Up to 90 days online and 1 year in archive, under Netlify's data processing terms. Netlify sets this period |
| Google Tag Manager request logs | Deleted by Google within 14 days |
| Advertising cookies and the data our advertising partners receive | Set by each partner under its own terms. Each cookie and its duration is listed in our Cookie Policy before a campaign starts |
Services that set their own periods delete the data for us when the period ends. Records we hold ourselves (form records, emails and job applications) are reviewed once a year, in February, and everything past its period is deleted then.
Your rights
You have the right to:
- ask for a copy of the personal data we hold about you;
- have it corrected if it is wrong;
- have it deleted;
- have its use restricted while a question about it is settled;
- receive the data you gave us in a common, machine-readable format;
- withdraw your consent at any time. Withdrawing does not affect what we did before. For cookies, use the link at the bottom of every page. For the newsletter, write to us and we stop sending it.
Your right to object. Where we rely on our legitimate interest (answering forms and demo requests, and running the website), you can object at any time on grounds relating to your situation. Write to info@keymate.io and we stop, unless we have compelling legitimate grounds that override your interests or need the data for a legal claim.
To use any of these rights, write to info@keymate.io. We may ask you to confirm your identity before we act. We answer within one month.
You also have the right to complain to a data protection authority. In the European Economic Area, that is the authority in the country where you live or work, or where you think the problem happened (list of authorities). In the United Kingdom, it is the Information Commission. We would like the chance to answer your concern first, so please write to us too.
How we protect it
Data travels to and from the site over encrypted connections. Form and newsletter records are kept in a database that only the people who answer forms and run the site can reach. Netlify, MongoDB, Microsoft 365 and Google handle the data for us under data processing terms that require them to protect it; Microsoft Clarity is covered by its own terms, described above.
Children
keymate.io is a website for businesses. It is not meant for children, and we do not knowingly collect their data.
Changes to this policy
When we change how we use personal data, we update this page and the date at the top.
Contact
Keymate Inc., 8 The Green #18616, Dover, DE 19901, United States · info@keymate.io