Privacy Policy

Last updated

Keystone is a rent book for landlords, property managers and their tenants. It is run by 1001 Toolbox, operated by Ehtesham Ali ("we", "us"). This page explains what we store, why, who else handles it, and what you can ask us to do with it.

Who is responsible for what

For your own account (your name, email and sign-ins) and for our website, we decide how data is used, so we are the controller.

The records an organization keeps in Keystone, such as its tenants, leases, bills and payments, belong to that organization. The landlord or management company is the controller of that data and we are its processor: we store and process it only to run the service for them, and we don't use it for anything else. If you are a tenant and want to see, correct or delete what your landlord holds about you, ask your landlord first; we will help them do it.

What we store

Your account

  • Your name and email address, and a phone number if you add one.
  • Your password, stored only as a one-way bcrypt hash. We can't read it.
  • When you last signed in, and which organizations or tenancies you belong to and in what role.

Your organization

  • Its name, address, phone, email, currency, logo, bill and receipt numbering, and document layouts.
  • Its plan and licence, and if you pay for Keystone: your Paddle customer and subscription ids, the subscription status and renewal date, and each payment's date, amount, currency and invoice number.

The records you keep

  • Properties and units: addresses, floors, sizes, market rent and notes.
  • Tenants: name, email, and, if you enter them, phone number, ID number, emergency contact and notes.
  • Leases, bills, payments, receipts and the ledger: amounts, dates, due days, deposits, payment methods and references.
  • Tenant portal accounts, for tenants you invite, and the payments tenants report through the portal.

The activity log

Every change and every sign-in is recorded with who made it, what it touched, when, the IP address, the browser's user agent and the page it came from. This is how Keystone explains every balance, and how we investigate misuse.

Email to us

If you email us, we keep the message and our reply so we can help you and follow up.

Why we use it

  • To run the service you signed up for: sign-in, the rent book, the tenant portal, documents and invites (performing our contract with you).
  • To send the emails the service needs: invites, account notices, and replies to you.
  • To keep the service secure, prevent abuse and fix problems (our legitimate interest).
  • To bill paid plans and keep the financial records the law requires (legal obligation).
  • To understand how people find and use our public pages, with Google Analytics (our legitimate interest; you can opt out, below).

We don't sell personal data, we don't show ads, and we don't use your records to train AI models.

Who else handles it

  • Hosting. Keystone and its MongoDB database run on a server we rent and manage ourselves. No hosting company reads your records.
  • Email. Our emails go out through Resend or through an SMTP email provider, which receive the recipient's address and the message. Email sent to our support addresses reaches us through Resend.
  • Payments. Paddle.com is our reseller and Merchant of Record. When you pay for Keystone, Paddle collects and processes your payment details, billing address and tax information under its own privacy notice. We never see or store your full card number.
  • Analytics. Google Analytics 4 receives which public pages are visited, the referring site, an anonymised IP address, and the browser and device type.

Some of these providers process data outside your country. Where the law requires it, they do so under standard contractual clauses or an equivalent safeguard.

Cookies and local storage

Keystone sets only the cookies it needs to work:

  • ks_session: keeps you signed in, for up to 30 days. It is HTTP-only, so page scripts can't read it.
  • ks_org and ks_tenancy: remember which organization or tenancy you last opened.
  • sidebar_state: remembers whether you collapsed the sidebar.

Your browser's local storage also keeps your theme (light or dark) and accent colour. These never leave your device.

On our public pages (the home page, pricing, sign-up, sign-in and these legal pages), Google Analytics sets _ga and _ga_<id> to tell one visit from another. Analytics is switched off inside the signed-in app and the tenant portal. You can block these cookies in your browser, or install Google's opt-out add-on.

How long we keep it

  • Account and organization records: for as long as the account is open. The ledger is append-only by design, so while the account is open entries are corrected, not erased.
  • When an organization is closed, we delete its records within 30 days, and they leave our backups within a further 30 days.
  • The activity log: for as long as the organization exists, so the history behind every balance stays explainable.
  • Billing records (payment dates, amounts and invoice numbers): as long as tax and accounting law requires, usually up to 7 years. Paddle keeps its own records under its own policy.
  • Support email: up to 2 years after the conversation ends.

Your rights

Depending on where you live, you can ask us to:

  • Access the personal data we hold about you, and get a copy.
  • Correct anything that is wrong. You can edit your profile and your organization's records yourself.
  • Delete your account and your organization's records.
  • Export your data in a portable format. Ledgers already export to CSV from the app; email us for everything else.
  • Object to or restrict how we use it, and withdraw consent where we rely on it.

Email hello@1001toolbox.com from the address on your account. We answer within 30 days. You can also complain to your local data protection authority.

Security

Traffic is encrypted with HTTPS, passwords are hashed, stored secrets are encrypted, and every organization's records are kept apart from every other's. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.

Children

Keystone is a business tool for adults. It isn't meant for anyone under 18, and we don't knowingly collect their data.

Changes

When we change this policy we update the date at the top. If a change matters, such as a new kind of data or a new provider, we tell account owners by email or in the app before it takes effect.

Contact

Questions, requests or complaints: hello@1001toolbox.com. 1001 Toolbox is based in Pakistan. See also our Terms of Service and Refund Policy.