Privacy Policy

Keychime Inc. ("Keychime", "we", "us") builds software for real estate agents. This policy explains what we collect, how we use and protect it, and the rights you have over it. It covers the Keychime website, web application, and mobile applications (together, the "Services"). The rights and obligations described below apply where the relevant privacy law applies to Keychime and to your use of the Services.

Two roles: your data, and your contacts' data

For your own information — your account, billing, and usage — Keychime is the data controller and this policy applies directly. For the leads, contacts, and client information you enter into the app ("Customer Data"), you are the controller and we process it on your instructions as your service provider. This also includes information submitted through an agent's public Keychime page. We do not sell Customer Data or use it for targeted advertising.

What we collect

Information you give us

• Account details: name, email, password (stored hashed), team name and membership, plan selection.
• Billing details: handled by our payment providers. For web purchases, we may receive subscription status and limited card details such as the last digits, never the full number. Mobile in-app purchases are billed by Apple or Google; we receive the purchase and entitlement status, not your card details.
• Customer Data: the leads, contacts, addresses, notes, pipeline stages, follow-ups, and other business content you and your team enter.
• Public-page enquiries: when you contact an agent through a Keychime page, we place the name, email or phone number, message, property address, and request type you provide into that agent's CRM so the agent can respond.
• Calendar information: when you enable calendar features, Keychime may read calendar names, availability, and events you own, and may create or update events at your direction. Google Calendar connections request identity, email, calendar-list, free/busy, and owned-event permissions. Native device calendar access stays subject to the permission you grant in your device settings.
• Photos and videos: profile, business-card, listing, feedback, and report media you choose to upload. Content you choose to publish on a profile, digital business card, listing, or agent page is publicly visible until you unpublish or remove it, subject to cached or independently saved copies.
• Audio recordings: meeting recordings and door voice notes you choose to capture after starting the recorder and granting microphone permission. Audio is sent to transcription and AI providers to create transcripts, speaker labels, summaries, and notes. After a meeting recording is processed, a compressed copy is uploaded to private Cloudflare R2 storage when cloud audio is available so you can play it on your other devices. Some source audio may also remain on the device or browser that recorded it. You are responsible for telling recording participants and obtaining any consent required by the laws that apply to the conversation.
• Support messages you send us.

Information collected automatically

• Precise location (GPS): the knocking map uses your device's location while you use that feature, with your operating-system-level permission. Location is treated as sensitive information: we collect it only to power map and territory features, you can revoke the permission at any time in your device settings, and we never sell it or share it for advertising.
• Device & technical data: basic technical information needed to run the Services, such as browser/device type, app version, and server and error logs — used to keep the Services secure and working.
• Website registration data: when you register or contact us, we collect the contact information and account details you provide. Our service providers process technical request details for security and account communications. Previously collected launch-registration information remains subject to your consent and the retention terms below.
• Product & usage analytics: we use PostHog, a product-analytics provider, to understand how the app is used — which features are opened, screen views, and events such as signing up or starting a door-knock session — so we can fix problems and improve the product. For signed-in app accounts, we ask before starting analytics. It stays off unless you choose "Allow analytics" during first-use onboarding or enable it later in Data & Privacy settings. Choosing "Not now" keeps analytics off and you can continue using the app. Your choice is stored for the signed-in account on that device or browser, so you may need to set it separately elsewhere. Turning analytics off stops future collection from that installation; it does not erase events already sent. You can contact us to request deletion of linked analytics records. When analytics is active, we send a pseudonymous account identifier and a limited allowlist of feature and screen events. We do not send your email, lead/contact fields, notes, addresses, recording content, or commission amounts to PostHog. Analytics is not used for advertising and is not sold. We do not run this PostHog product analytics on the public marketing website or for anonymous website visitors.
• Cookies & local storage: the website uses strictly necessary cookies for sign-in sessions and local storage for preferences such as dark mode. The signed-in app also stores your analytics choice and creates a first-party analytics identifier only after you allow analytics. We do not use advertising cookies or cross-site tracking. In privacy laws, "share" can have a special meaning tied to behavioral advertising; Keychime does not share personal information for that purpose. We honor Global Privacy Control signals where required.

How we use information

• Provide, sync, and support the Services;
• Process subscriptions and prevent fraud and abuse;
• Power features you invoke, including AI features (see below) and map/territory tools;
• Improve the product using the app analytics described above and aggregated or de-identified information;
• Send service messages (receipts, security alerts) and — with consent where required by CASL — product news you can unsubscribe from at any time;
• Comply with legal obligations.

We collect only what we need for these purposes, and we don't use your information for automated decisions that produce legal effects about you.

AI features

Elite plans include Vio and other AI features. When you ask Vio to work with your business, Keychime may retrieve relevant leads, deals, notes, goals, calendar information, documents, or other account context and send the information needed to generate the answer or action you requested. Audio is sent for transcription and speaker labeling before summaries or notes are generated.

Keychime currently integrates Anthropic and, when configured with approved data-use settings, Google Gemini for assistant and summarization features; Groq with OpenAI as a fallback for transcription; and Soniox, Deepgram, or AssemblyAI for speaker-labeled transcription, depending on service configuration and availability; listing an available provider here does not mean it processes every request. OpenAI also supports specific research and image features when you invoke them. Keychime does not use Customer Data to train its own AI models. Provider handling, retention, and model-improvement controls are governed by the service terms and account settings applicable when a request is made.

Calendar connections

Calendar access is used to show your schedule and availability, avoid conflicts, copy selected Keychime appointments or work blocks to a calendar you choose, and perform calendar actions you request through Vio. Native calendar behavior depends on the sync choices stored on that device. You can disconnect Google Calendar in Keychime and can also revoke Keychime in your Google account; you can revoke native calendar permission in device settings. Disconnecting stops future access and starts revocation of stored Google credentials, but does not automatically delete events already written to a calendar. Google user data received through Google Workspace APIs is used only to provide or improve the user-facing calendar features you request. Keychime does not use it for advertising, credit decisions, or training generalized AI models. We do not allow humans to read Google user data except with your affirmative agreement for a specific support purpose, when necessary for security or abuse investigation, or to comply with applicable law. Internal operations unrelated to your requested feature use only aggregated and anonymized information. Our use and transfer of Google user data complies with the Google API Services User Data Policy, including its Limited Use requirements.

What we never do

We do not sell or rent personal information. We do not share it for cross-context behavioral / targeted advertising. We do not give one unaffiliated customer access to another customer's private records; team visibility and agent public pages work as described in the product. In the terms of the CCPA/CPRA: we have not "sold" or "shared" personal information in the preceding 12 months, and we don't process it for purposes beyond those in this policy.

How we share information

• Service providers under contract, only as needed to run Keychime: cloud hosting and database (with account-level access controls), authentication, private media storage, AI and transcription, payment processing, email delivery, map data, abuse prevention, and signed-in app product analytics;
• Your team: if you join a team, team leaders can manage membership and billing and see the team activity and performance information described in the product. Teammates may see shared activity or leaderboards shown in the app. Private lead and pipeline access is controlled separately;
• Legal: if required by law, subpoena, or to protect rights, safety, or the integrity of the Services — we'll push back on overbroad requests;
• Business transfers: if Keychime is acquired or merged, this policy continues to apply to transferred data and we'll notify you of any change in control.

Where data is stored & cross-border transfers

We and our providers may store or process information outside your province, state, or country, including in Canada and the United States. The exact location depends on the service and provider configuration. Information may be subject to the laws and lawful access requests of the country where it is processed. We use contractual and technical safeguards for cross-border processing and perform any transfer review required before making a transfer subject to applicable law.

Security

We protect data with encryption in transit and at rest, account-level database controls, private storage, and role-based access practices. Support Access is off by default and is the normal way you authorize staff to inspect account data for troubleshooting. A limited number of authorized personnel may access information without that setting when necessary to operate or secure the Services, investigate abuse, comply with law, or respond to an emergency. We restrict privileged access to authorized roles. No system is perfectly secure; if a breach creates a real risk of significant harm, we will notify you and the relevant regulators (e.g., the OPC, Quebec's CAI, or U.S. state authorities) as the law requires.

Retention & deletion

We keep personal information while your account is active and delete or de-identify it when no longer needed. To delete your account, use the in-app controls, follow the instructions at keychime.com/delete-account, or email support@keychime.com from your account email. We begin deletion after confirming the request and use operational targets of 30 days for active production systems and 90 days for backup expiration. These are targets rather than guarantees: some provider systems use their own documented retention cycles, and we may retain limited records longer for billing, tax, security, fraud prevention, dispute resolution, or legal compliance. Previously collected launch-registration details are kept until you unsubscribe or withdraw your marketing consent; limited suppression information may be retained as needed to honor an opt-out. Recordings or exports stored only on your devices must be deleted there. Before deleting, you can export lead records as CSV in the app. Contact us to request a copy of other personal information associated with your account.

Your rights

Depending on where you live and whether the relevant law applies to Keychime, you may have rights to:

• Access / know the personal information we hold about you;
• Correct inaccurate information;
• Delete your information (subject to legal retention duties);
• Receive a portable copy of eligible information;
• Withdraw consent or object to certain processing, and unsubscribe from marketing;
• Not be discriminated against for exercising any of these rights.

To exercise a right, email support@keychime.com with the subject "Privacy request" (lead export and correcting your own details are also self-serve in the app). We respond within the time applicable law requires, we'll verify your identity first, and authorized agents may submit requests where your law allows. If we refuse a request, we'll explain why and you may appeal by replying to our decision.

Canada

Where Canadian privacy law applies, you may complain to the Office of the Privacy Commissioner of Canada or the applicable provincial commissioner. Quebec law may also provide rights such as portability or de-indexation in applicable circumstances and a right to complain to the Commission d'accès à l'information (CAI).

United States

If a comprehensive U.S. state privacy law applies to Keychime and your information, it may provide the rights above and rights to opt out of sale, targeted advertising, or certain profiling. Keychime does not sell personal information or share it for cross-context behavioral advertising. We use sensitive information only for permitted purposes such as providing requested location or account-security features.

If an agent has your information

If a real estate agent using Keychime has recorded your information and you want it accessed, corrected, or deleted, the agent is the controller of that record — contact them directly. If you can't reach them, email support@keychime.com and we will forward your request to them and help resolve it.

Children

Keychime accounts are for adults and the Services are not directed to children. Customer Data may nevertheless include information about a minor when an agent has a lawful business reason and authority to enter it, such as a household or transaction record; the agent controls that information and is responsible for the required notice or consent. If a child submits information directly to Keychime without appropriate authorization, contact us so we can review and delete it where required.

Changes to this policy

We'll post updates here and refresh the date above. For material changes we'll notify you by email or in-app, and where the law requires fresh consent, we'll ask for it.

Contact & Privacy Officer

Keychime's Privacy Officer can be reached at support@keychime.com — mark your message "Privacy" so it gets priority. See also our Terms & Conditions and Terms of Use.