Privacy Policy

Keydole Ltd ("we", "us", "our") is the data controller for personal data processed in connection with the Keydole streaming service. This policy explains what data we collect, why, who we share it with, how long we keep it, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Contact for data matters: message us on WhatsApp or email support@keydole.co.uk.

1. Data we collect and why

Account data

Email address and password (hashed). Collected when you register. Lawful basis: contract — necessary to provide you with an account and deliver the Service. Retained for the duration of your subscription plus 12 months after closure, then deleted.

Payment data

Payment method type (card, PayPal, etc.) and a tokenised payment reference. We do not store full card numbers; these are held by our payment processor Stripe (see §3). Lawful basis: contract. Retained for 7 years to meet tax and accounting obligations.

Usage and device data

Device type and operating system, stream start/stop events, buffering events, IP address (used for connection-limit enforcement and approximate region detection). Lawful basis: legitimate interests — detecting fraud, enforcing device limits, and improving stream quality. Retained for 90 days unless required longer for an active investigation.

Support communications

Messages you send to our support team. Lawful basis: contract (resolving service issues) and legitimate interests (quality monitoring). Retained for 3 years.

Checkout consent log

A timestamped record of your acceptance of Terms, Privacy Policy, and the Consumer Contracts Regulations 2013 immediate-access waiver at checkout. Lawful basis: legal obligation and legitimate interests (defending legal claims). Retained for 7 years.

2. Cookies and analytics

We use strictly necessary cookies to operate the Service (session management, authentication). For analytics we use Google Analytics 4 (Google LLC). GA4 operates under Google Consent Mode v2 — all consent signals are denied by default and the GA4 script does not load until you explicitly accept analytics cookies via our cookie banner. No analytics cookies are set and no data is sent to Google before consent is given.

For advertising measurement we use the Meta Pixel (Meta Platforms Ireland Limited). The Meta Pixel is loaded only after you accept the Marketing category via our cookie banner. When loaded, it sends limited event data (page views, contact clicks, form submissions) to Meta so we can measure the effectiveness of our Facebook and Instagram ads and reach similar audiences. Lawful basis: consent, which you can withdraw at any time from the cookie preferences panel. See our Cookie Policy for the full list of cookies set and their retention periods.

3. Third parties we share data with

• Stripe, Inc. — Payment processing. Stripe acts as a processor and is contractually bound to handle data only on our instructions. Stripe may transfer data outside the UK under standard contractual clauses. See Stripe's Privacy Policy.
• Supabase, Inc. — Database hosting and authentication infrastructure. Data is stored on servers in the EU. See Supabase's Privacy Policy.
• Google LLC — Analytics (Google Analytics 4). Google acts as a data processor under a Data Processing Agreement. Data may be transferred to the United States under the EU-US Data Privacy Framework (UK Extension) and standard contractual clauses. GA4 only receives data after you have consented to the Analytics category. See Google's Privacy Policy.
• Meta Platforms Ireland Limited — Advertising measurement (Meta Pixel). Meta acts as an independent controller for personal data collected via the Pixel and as a joint controller with us for the specific processing operations relating to the collection and transmission of Pixel events, in line with Meta's Controller Addendum. The Pixel only sends data to Meta after you have consented to the Marketing category. Data may be transferred to the United States under standard contractual clauses. See Meta's Privacy Policy.

We do not sell your personal data. Where you have consented to the Marketing category, limited event data is shared with Meta so we can measure ad performance and reach similar audiences — you can withdraw this consent at any time from the cookie preferences panel.

4. International transfers

Where we transfer personal data to third-party processors outside the UK, we rely on the UK International Data Transfer Agreement (IDTA) or equivalent adequacy decisions. Details are available on request.

5. Your rights

Under UK GDPR you have the right to:

• Access — request a copy of your personal data.
• Rectification — correct inaccurate data.
• Erasure — request deletion of your data (subject to legal retention obligations).
• Portability — receive your data in a structured, machine-readable format.
• Restriction — ask us to restrict processing while a dispute is resolved.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent (e.g. non-essential cookies), you may withdraw at any time.

Data export and account deletion are available from your account. For other requests or if you cannot action something yourself, message us on WhatsApp or email support@keydole.co.uk. We will respond within 30 days.

6. Complaints

If you are unhappy with how we handle your data you have the right to lodge a complaint with the UK's supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
ico.org.uk/make-a-complaint

7. Changes to this policy

We will notify you by email of material changes to this policy at least 30 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.