Privacy Policy
This Privacy Policy describes how KeyPort collects, uses, stores, and protects information when you use our platform. This policy applies to keyport.sbs, app.keyport.sbs, api.keyport.sbs, and customer.keyport.sbs.
We are committed to protecting your privacy in accordance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and applicable international privacy standards.
1. Information We Collect
1.1 Information You Provide
- Email address (for account registration and magic link authentication)
- Display name and profile information
- Discord account information (if you connect Discord)
- Organization name and details
- Payment information (processed by Dodo Payments — we do not store card details)
- Content you create in the Service (products, licenses, webhook configurations)
1.2 Information Collected Automatically
- IP address of requests to our API
- Browser and device information (user agent)
- Session tokens (stored as hashed values)
- Login timestamps and authentication events
- API usage counts per product per day
- Webhook delivery logs
1.3 Customer End-User Data
If you use KeyPort to manage licenses for your own customers, we store the following about your customers on your behalf:
- Email address or Discord ID used when creating their license
- IP addresses from which they have called the validation API
- License keys assigned to them
You are the data controller for your customers' data. We process it on your behalf as a data processor.
2. How We Use Information
We use the information we collect to:
- Provide, maintain, and improve the Service
- Process billing and manage subscriptions
- Send transactional emails (magic links, invitations, billing alerts)
- Enforce our Terms of Service and Acceptable Use Policy
- Detect and prevent fraud and abuse
- Provide customer support
- Analyze usage to improve the Service
- Comply with legal obligations
3. Information Sharing
We do not sell your personal information. We share information only in the following circumstances:
Service Providers: We share information with third-party service providers who assist in delivering the Service:
- Dodo Payments — billing and payment processing (we do not directly store full card details on our systems)
- Zoho SMTP — Transactional email delivery
- Supabase — database hosting (PostgreSQL, hosted on AWS ap-south-1)
- Vercel — frontend and API hosting
- Cloudflare — DDoS protection and DNS
Each service provider is bound by data processing agreements and may not use your data for their own purposes.
Legal Requirements: We may disclose information if required by law, court order, or government authority under Indian law.
Business Transfers: If KeyPort is acquired or merged, your information may be transferred as part of that transaction. We will notify you before this occurs.
4. Data Storage and Security
Your data is stored in Supabase's PostgreSQL database, hosted on AWS infrastructure. We implement the following security measures:
- All passwords and tokens stored as bcrypt or SHA-256 hashes — never in plain text
- API keys stored as bcrypt hashes — cannot be recovered
- HTTPS enforced on all endpoints
- Cloudflare DDoS and proxy protection on all domains
- Session tokens stored as HTTP-only cookies
- Rate limiting on all authentication endpoints
No method of transmission or storage is 100% secure. We cannot guarantee absolute security but implement industry-standard practices.
5. Data Retention
| Data Type | Retention Period |
|---|---|
| Account information | Until account deletion + 30 days |
| License data | Until org deletion + 30 days |
| API usage logs | 90 days |
| Audit logs | 1 year |
| Auth events | 90 days |
| Billing records | 7 years (legal requirement) |
| Deleted account data | 30 days after deletion request |
6. Your Rights
Under applicable law, you have the right to:
- Access: Request a copy of personal information we hold about you
- Correction: Request correction of inaccurate information
- Deletion: Request deletion of your account and associated data
- Portability: Request your data in a machine-readable format
- Objection: Object to processing of your data in certain circumstances
To exercise any of these rights, please contact us at email@keyport.sbs. We will respond within 48 hours (excluding weekends and public holidays).
7. Cookies
We use cookies to maintain your login session. See our Cookie Policy at keyport.sbs/legal/cookies for full details.
8. Third-Party Links
The Service may contain links to third-party websites. We are not responsible for the privacy practices of those websites.
9. International Users
The Service is operated from India. If you access the Service from outside India, your information may be transferred to India for processing. By using the Service, you consent to this transfer.
10. Children
The Service is not directed at children who do not meet the minimum age requirement for online services in their jurisdiction. We do not knowingly collect information from children below the legal age (generally 13+) without parental consent where required. If we discover we have collected information in violation of these rules, we will delete it promptly.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or notice on the Service. Continued use after changes constitutes acceptance.
While we typically aim to provide reasonable prior notice (at least 7 days where practicable) for material updates, some changes—including those related to security, abuse prevention, or legal compliance—may apply immediately at our discretion. On any changes, we will notify you via email or a notification in our service dashboard.
12. Contact
For privacy-related inquiries or to exercise your rights, please contact us. We respond within 48 hours (excluding weekends and public holidays):
Email: email@keyport.sbs