Information we process
We process account identity, workspace membership, credential lifecycle metadata, essential session data, audit events, service logs, and messages you send to support. Signup uses your email, display name and workspace name; legacy pilot applications contain structured business contact and operational-fit details. Stripe processes payment card details; we retain provider references, subscription state and necessary billing records, not card numbers. Credential records are limited to identifiers, provider, environment, ownership, dates, policy intervals, and optional runbook URLs.
Information we do not request
Do not submit passwords, API keys, private keys, access tokens, certificate bodies, recovery codes, or other credential values. KeyGuardRail is a lifecycle monitor, not a secret vault.
How information is used
We use this information to operate and secure the service, calculate lifecycle status, deliver requested notifications, troubleshoot failures, prevent abuse, support users, and improve the service.
Cookies and measurement
KeyGuardRail uses an essential, host-only session cookie for authentication. Public-site measurement uses first-party daily page and signup-flow counts without a tracking cookie, persistent visitor ID, raw IP address, or user-agent record in those counters. We accept only predefined source, channel, campaign, and creative labels; other tracking parameters are discarded from these first-party counters. Your browser may keep these labels in tab-scoped session storage, which clears when the tab session ends. We use a stored label for up to 30 minutes to carry attribution between our public pages. These first-party counters do not create a unique visitor identifier.
When you request a signup email, those labels are saved with the request and, after verification, with your workspace. This lets us measure verified signup, a first useful inventory record, and a verified paid subscription by campaign. We do not send workspace contents, credential metadata, email addresses, or our workspace-linked acquisition records to advertising platforms. Workspace-linked acquisition records are removed after 365 days or on workspace deletion; aggregate daily counts are retained for up to 400 days. Legacy pilot applications retain their historical campaign labels. We do not sell personal information.
Optional Google Ads measurement
If you choose “Allow ad measurement,” Google receives measurement events from public pages and, after successful email verification and account creation, a signup event. Google may receive your IP address, browser information, Google ad-click identifiers and advertising-cookie identifiers. We send a public page address with unrelated query parameters removed, an empty referrer, and a random signup-event identifier used to avoid counting the same event twice. We do not include your email, name, account or workspace identifiers, credential records, or verification link. We do not enable personalized advertising or enhanced conversions in this integration.
Google measurement remains off until you allow it. You can decline and still use the service. Use “Ad privacy choices” in the public-site footer to change your choice; withdrawing removes our Google measurement frame and clears its first-party advertising cookies in this browser. We remember your choice for 90 days, and configure first-party Google measurement cookies for up to 90 days. A server-issued signup measurement receipt expires after ten minutes and is cleared when used. We honor Global Privacy Control by disabling this optional measurement. Google controls retention of information it receives under its privacy policy; see also how Google uses information from sites that use its services. Changing your choice does not erase information already sent to Google.
Optional OpenAI Ads measurement
If you choose “Allow ad measurement,” our server sends OpenAI a completed-registration event after successful email verification and account creation. The event contains a random event identifier, the event time, a fixed public completion-page address, and an OpenAI ad-click reference when available. We do not load the OpenAI browser Pixel, scan forms, or forward your email, name, IP address, browser information, account or workspace identifiers, credential records, or verification link. We mark events to opt out of future user-level personalization.
This measurement stays off until you consent, and Global Privacy Control disables it. An earlier Google-only consent does not enable OpenAI measurement; we ask again. “Ad privacy choices” lets you withdraw consent and clears the advertising cookies in this browser. We store an OpenAI click reference in a first-party cookie for up to 30 days and remember your consent choice for 90 days. The signed signup receipt expires after ten minutes and is cleared after OpenAI accepts the event. Leaving the completion page early, network failures, declining consent, or switching browsers can prevent an event or its attribution. OpenAI governs data it receives under its privacy policy. Withdrawal does not erase previously sent events.
Retention and security
Pilot application details are retained for up to 12 months after the last interaction unless you request deletion or a longer relationship requires them. Signup links expire after 30 minutes; signup request records are removed two days after expiry by recurring cleanup. The accepted terms version is recorded in workspace audit history. Authentication throttle records are removed after two days; expired sessions and MFA challenges are removed by a recurring cleanup; expired or used password-reset records are removed after seven days; and accepted or expired invitation records are removed after 90 days. Customer retention depends on the workspace plan and operational need; backups may persist for their documented retention window. We use TLS, access controls, data minimization, and encrypted offsite backups, but no Internet service can promise absolute security.
Your choices
Individuals can request access, correction, export, or deletion of their personal data. Workspace deletion requires a separate authority check. See our deletion policy and request process for verification, response targets, exceptions, and review rights.
Contact
Questions and privacy requests can be sent to privacy@keyguardrail.com.