Privacy Policy

Keystone Systems LLC · Revised and Posted August 27, 2026 · Effective August 26, 2026

This Privacy Policy describes how Keystone Systems LLC (“Keystone,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information when people use the FieldFaktor mobile application, web workspace, websites, reports, support, and related services (collectively, “FieldFaktor”).

FieldFaktor is a business property-inspection documentation platform. Contractor companies use it to organize projects, document observations, create reports, and manage team access. A company customer generally controls the property, customer, and project information its users submit. Keystone also handles account, billing, security, website, and support information for its own business purposes. If you are a property owner or customer whose information was entered by a contractor, contact that contractor first; Section 16 explains this relationship.

1. What Information Do We Collect?

Information you or your company provide

• Name, email, phone number, password or authentication data, profile, role, invitations, company membership, and account preferences.
• Company name, contact and billing information, team administration, purchased and complimentary credits, transactions, and tax-related details.
• Project and property information, including addresses, property-owner or customer contact information, project reference data, and service dates.
• Inspection observations, answers, notes, annotations, measurements, scans, diagrams, documents, photos, video, audio if an enabled feature permits it, and generated or edited reports.
• Messages, report recipients, delivery instructions, feedback, support requests, and other communications.

Information collected through use

• Device type, operating system, app or browser version, identifiers, IP address, timestamps, pages, screens, actions, crash and diagnostic data, authentication events, and security or rate-limit records.
• Photo and file metadata, including timestamps and EXIF data.
• Approximate or precise location when a location-dependent feature is used and device permission is granted.
• Address-search, map, Street View, weather, and report-request parameters.
• Device-local or offline data required to let the app work with limited connectivity and later synchronize.

Information from other sources

We may receive information from your company administrator, invited team members, payment processor, mapping and address providers, app stores, weather-data sources, report-delivery recipients, security and diagnostic providers, and authorized integrations. Payment-card numbers are collected by Stripe through its processor-hosted payment flow; Keystone generally receives transaction identifiers, status, and limited billing details rather than full card numbers. Stripe's privacy notice is available at https://stripe.com/privacy.

2. How Do We Process Your Information?

We process information to:

• Create accounts, authenticate users, administer companies and teams, and provide offline and synchronized operation.
• Create and manage projects; receive, store, organize, edit, generate, export, share, and deliver inspection documentation and reports.
• Provide mapping, address matching, Street View, weather or hail evidence, and configured AI-assisted narrative features.
• Administer complimentary and purchased credits, checkout, taxes, refunds, receipts, and business records.
• Send invitations, reports, service notices, security messages, and support communications.
• Provide customer support, troubleshoot, test, maintain, and improve FieldFaktor.
• Prevent fraud, abuse, and unauthorized access; enforce agreements; protect users and FieldFaktor; and investigate incidents.
• Comply with law and establish, exercise, or defend legal claims.

We do not use FieldFaktor output to make insurance coverage, causation, damage, scope, engineering, repair, valuation, or legal decisions. The company and its users decide how to conduct an inspection and use or share a report.

3. When and With Whom Do We Share Information?

We may disclose information:

• To the company account and its authorized administrators, members, and report recipients.
• At a user's direction, such as when sending or downloading a report.
• To providers of infrastructure, authentication, database, storage, hosting, payment, email, support, security, monitoring, mapping, geocoding, weather, report processing, app distribution, and AI processing as needed for their services.
• To professional advisers, auditors, insurers, and authorities when reasonably necessary to comply with law or protect rights and safety.
• In connection with a merger, financing, acquisition, reorganization, bankruptcy, or sale of all or part of the business, subject to applicable confidentiality and notice requirements.
• With consent or as otherwise described when the information is collected.

The categories of third parties with whom we may disclose personal information, where configured and as necessary to provide FieldFaktor, include cloud infrastructure and hosting providers; database, authentication, and storage providers; payment processors; communications and support providers; security and monitoring providers; mapping and geocoding providers; public weather-data and report-processing providers; AI service providers; and application-distribution and notification providers. Where configured, we use Google mapping and geocoding services to process property addresses and location data for requested features. Providers and features may change. A current subprocessor list is available upon written request. We do not authorize providers to use company project content for their own advertising.

4. Do We Use Cookies and Similar Technologies?

We use local storage, cookies, software development kits, and similar technologies where needed for authentication, security, preferences, offline operation, service delivery, and performance measurement. We identify any non-essential analytics or advertising technology in the applicable notice and choices interface before enabling it when required by law. Browser controls may affect functionality. Device permissions can be managed in operating-system settings.

5. Do We Offer AI-Based Features?

FieldFaktor may offer a bounded AI-assisted narrative feature that processes selected project observations to suggest draft language. The configured provider may process the submitted inputs and generated output to supply that feature. Do not submit data you are not authorized to process.

AI output may be incomplete, inaccurate, or inappropriate. It is a draft aid, not a property inspection or a coverage, causation, damage, scope, engineering, repair, valuation, or legal determination. A qualified user must review and approve all output. Keystone does not authorize a provider to train generalized models on company project content unless the company expressly agrees in writing. Provider retention protections, including any zero-data-retention arrangement, apply only when available, verified for the configured production service, and incorporated into the applicable agreement.

6. How Long Do We Keep Information?

We retain information for as long as reasonably needed to provide FieldFaktor, maintain the company account and its reports, complete transactions, support users, secure the service, meet contractual and legal obligations, resolve disputes, and enforce agreements. Company-controlled project records may remain after an individual member leaves or deletes a personal login. Billing, fraud-prevention, security, audit, and legal-hold records may be retained after other data is deleted.

When information is no longer required, we delete or de-identify it according to our procedures. Copies in backups may remain until ordinary backup rotation and are protected from routine use.

7. How Do We Keep Information Safe?

We use administrative, technical, and physical safeguards designed to protect information in light of its nature and the risks of processing. These safeguards may include access controls, encryption provided by our infrastructure vendors, tenant-level data restrictions, credential protections, monitoring, and vulnerability scanning. No transmission or storage system is completely secure. Users must protect credentials, use appropriate device controls, limit access to authorized people, and promptly report suspected compromise. This section is not a certification or guarantee that an incident cannot occur.

8. Do We Collect Information From Minors?

FieldFaktor is a United States business service for users who are at least 18. It is not directed to children, and we do not knowingly create accounts for children. If you believe a child supplied personal information directly to Keystone, contact us using Section 18.

9. What Are Your Privacy Rights?

Depending on where you live and subject to legal exceptions, you may request access, correction, deletion, or a portable copy of personal information, or object to or restrict certain processing. You may withdraw consent where consent is the basis for processing. Withdrawal does not affect prior lawful processing. You may also have a right to appeal a denied request and to use an authorized agent.

We must verify requests and may ask for information reasonably necessary to do so. We will not discriminate against you for exercising applicable rights. If information is controlled by a FieldFaktor company customer, we may direct the request to that company and assist it as required by law and contract.

10. Controls for Do-Not-Track Features

There is no uniform industry standard for browser “Do Not Track” signals, so FieldFaktor does not currently respond to them as a universal setting. We process legally recognized opt-out preference signals as required by applicable law for processing to which those signals apply. FieldFaktor does not use company project content for cross-context behavioral advertising.

11. U.S. State Privacy Rights

Residents of some U.S. states may have additional rights concerning categories of information collected, purposes, recipients, access, correction, deletion, portability, sale or targeted-advertising opt-outs, sensitive-data processing, and appeals. Keystone does not sell FieldFaktor company project content or share it for cross-context behavioral advertising. Statutory definitions and exemptions can differ.

Submit a request using Section 19. We will authenticate and respond as required by applicable law. To appeal a denied privacy request, email legal@keystonestack.com with the subject “Privacy Appeal” and explain the request and decision you want reviewed. Authorized agents must provide proof of authority, and we may separately verify the request with the individual.

12. When Is Keystone a Controller or Processor?

A company customer generally determines why and how its property, customer, project, inspection, and report content is processed. For that content, Keystone generally acts as the company's processor or service provider under the customer agreement and any data processing addendum. Keystone acts for its own purposes with respect to direct account administration, billing, website, security, legal-compliance, and direct-support data. A signed agreement or data processing addendum controls if it conflicts with this summary.

13. What Is Outside This Policy?

This policy does not govern a contractor company's independent processing, third-party websites or services linked from FieldFaktor, or data a report recipient uses outside FieldFaktor. Those parties have their own practices. A third-party provider integrated into FieldFaktor remains covered here to the extent Keystone discloses information to it to provide FieldFaktor.

14. Do We Use Project Content to Train AI Models?

Keystone does not use company project content to train generalized AI models unless the company expressly authorizes that use in writing. We may use service metrics and information that has been aggregated or de-identified so it cannot reasonably identify or be re-associated with a company, person, property, project, or report, subject to the customer agreement and law.

15. Do We Sell or Share Personal Information?

Keystone does not sell FieldFaktor company project content or personal information, and does not share it for cross-context behavioral advertising. Disclosures to service providers and company-authorized recipients are made to operate FieldFaktor and are described in this policy. We will update this policy and provide legally required choices before materially changing these practices.

16. Requests About Property or Customer Information

If a contractor or contractor company entered your information into FieldFaktor, contact that company first. It determines the purpose for which the project information is used and can identify the project and your relationship to it. Keystone may respond directly for information Keystone independently controls and will assist the company where required. We will verify authority before confirming that a project or report exists or disclosing its contents.

17. Do We Update This Policy?

We may update this policy to reflect changes in FieldFaktor, law, or our practices. The “Revised” date identifies the current version. When required, we will provide additional notice or seek consent. Material changes may be communicated by email, in-app notice, or another legally permitted method.

18. How Can You Contact Us?

Keystone Systems LLC
3723 Greenville Ave
Dallas, TX 75206
Privacy and legal: legal@keystonestack.com
Support: support@fieldfaktor.com

19. How Can You Review, Update, or Delete Your Data?

Use the account settings or deletion-request path available in FieldFaktor, or email legal@keystonestack.com. We will verify your identity and process an account-deletion request within 30 days of receipt. We will email confirmation when processing is complete or explain any information that must be retained.

Deleting an individual user account does not delete company-controlled projects, inspections, photographs, reports, or other company business records. It also does not require deletion of completed transaction, billing, fraud-prevention, security, audit, legal-hold, or other records that Keystone or the company must retain. Access by the departing user will be removed, and retained records will remain subject to applicable access controls, agreements, and law.