Privacy Policy

1. Introduction and Scope

KeyKonnect is a call intelligence platform built for asset managers, asset owners, and property management companies. We record, transcribe, and analyze leasing calls using artificial intelligence to help operators improve agent performance, flag compliance risks, and understand leasing activity across their portfolios.

This Privacy Policy applies to:

• Users who access the KeyKonnect platform (app.keykonnect.com) — including property managers, leasing agents, administrators, and asset owners
• Visitors to our marketing website (keykonnect.com)
• Callers whose calls are recorded and processed through the KeyKonnect system on behalf of our customers

By using our platform or services, you agree to the collection and use of information as described in this Policy. If you do not agree, please discontinue use immediately and contact us at privacy@keykonnect.com.

2. Identity of the Data Controller

KeyKonnect is operated by:

• Legal name: 17932804 Canada Inc., operating as KeyKonnect
• Location: Toronto, Ontario, Canada
• Privacy Contact: privacy@keykonnect.com

For questions about this Policy or your rights, contact us at the email above. We will respond within 30 days.

3. Information We Collect

3.1 Information You Provide Directly

• Account registration details: name, email address, job title, organization name
• Profile information: role, assigned properties, contact preferences
• Payment information: handled by our payment processor; KeyKonnect does not store credit card numbers
• Communications: emails, support requests, or other correspondence sent to us

3.2 Information Collected Through the Platform

• Call recordings: audio recordings of inbound calls routed through Twilio phone numbers assigned to your organization
• Call transcripts: speaker-labeled text transcriptions generated by AssemblyAI
• AI analysis: summaries, caller type classification, outcome tagging, sentiment analysis, compliance flags, and action items generated by Anthropic's Claude AI
• Call metadata: timestamp, duration, caller phone number, called number, call outcome, lead source tag
• Usage data: login timestamps, pages visited, features used, actions taken within the platform
• Device and technical data: IP address, browser type, operating system, session identifiers

3.3 Information About Callers (Third Parties)

When a caller contacts a property managed by a KeyKonnect customer, the following data may be collected:

• Phone number (caller ID)
• Voice recording of the call
• Transcript of the call
• AI-generated analysis of the call content

Callers are informed of recording through an automated disclosure played at the start of each call. Property management companies using KeyKonnect are required under our Terms of Service to comply with all applicable call recording consent laws in their jurisdiction.

4. How We Use Your Information

4.1 Service Delivery

• Processing and storing call recordings, transcripts, and AI analyses
• Powering the KeyKonnect dashboard, call detail views, agent scorecards, and reporting features
• Generating automated PULSE reports and delivering them by email to authorized recipients
• Sending keyword trigger alerts when monitored terms are detected on calls
• Authenticating users and managing access permissions by role and property assignment

4.2 Service Improvement

• Analyzing platform usage patterns to improve product features and user experience
• Diagnosing technical issues, errors, and performance problems
• Evaluating and improving AI model prompts and output quality on an anonymized basis

4.3 Business Operations

• Processing subscription payments and managing billing
• Communicating with customers about their account, product updates, and service changes
• Complying with legal obligations and enforcing our Terms of Service

4.4 What We Do Not Do

• We do not sell personal information to third parties
• We do not use call recordings or transcripts to train AI models without explicit customer consent
• We do not use personal information for targeted advertising

5. Legal Basis for Processing

For users subject to Canadian privacy law (PIPEDA and provincial equivalents), our legal basis for processing is consent, contractual necessity, legitimate interests, and legal compliance.

For users in jurisdictions covered by the EU General Data Protection Regulation (GDPR), the same basis categories apply under Articles 6(1)(a), (b), and (f).

For California residents under CCPA/CPRA, your rights are described in Section 9.

6. How We Share Information

6.1 Service Providers (Sub-Processors)

We engage the following sub-processors to deliver our service. Each is bound by data processing agreements requiring them to protect your data:

6.2 Customer Organizations

Data collected within a customer's account is accessible to authorized users within that customer's organization as determined by their account administrator.

6.3 Legal Requirements

We may disclose information if required by law, court order, or regulatory authority, or to protect the rights and safety of KeyKonnect, our customers, or the public.

6.4 Business Transfers

In the event of a merger or acquisition, personal information may be transferred as part of that transaction. We will provide notice before personal information becomes subject to a materially different privacy policy.

7. Data Retention

• Call recordings and transcripts: retained for the duration of the customer's subscription plus 90 days following account termination
• AI analysis and call metadata: retained for the same period as call recordings
• User account data: retained for the duration of the account plus 30 days following deactivation
• Usage and technical logs: retained for a maximum of 12 months
• Billing records: retained for 7 years as required by Canadian tax law

Customers may request deletion of their data at any time by contacting privacy@keykonnect.com. Deletion will be completed within 30 days of a verified request, subject to legal retention obligations.

8. Data Security

We implement industry-standard technical and organizational safeguards including:

• All data in transit encrypted using TLS 1.2 or higher
• All data at rest encrypted in our database
• Role-based access controls enforced at the database level (Row Level Security)
• HTTP security headers including Strict-Transport-Security, Content-Security-Policy, and X-Frame-Options
• Authentication managed through Supabase Auth with secure session handling
• Call recording webhooks validated using Twilio signature authentication
• Administrative access to production systems limited to authorized personnel only

In the event of a data breach affecting your rights and freedoms, we will notify affected parties and relevant authorities in accordance with PIPEDA's mandatory breach reporting requirements.

9. Your Privacy Rights

9.1 Rights Under PIPEDA (Canada)

• Access the personal information we hold about you
• Request correction of inaccurate or incomplete information
• Withdraw consent to collection or use (subject to legal and contractual limitations)
• File a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca)

9.2 Rights Under GDPR (European Users)

• Access, rectify, or erase your personal data
• Restrict or object to processing
• Data portability
• Lodge a complaint with your local supervisory authority

9.3 Rights Under CCPA/CPRA (California Residents)

• Know what personal information is collected and how it is used
• Delete personal information (subject to exceptions)
• Opt out of the sale or sharing of personal information — KeyKonnect does not sell personal information
• Non-discrimination for exercising privacy rights

To exercise any of these rights, contact privacy@keykonnect.com. We will verify your identity before processing your request and respond within 30 days.

10. Call Recording Notice

KeyKonnect customers use our platform to record inbound calls to their leasing offices. All calls routed through a KeyKonnect-assigned phone number are recorded. Callers are informed of this recording at the start of each call through an automated disclosure message.

If you are a caller who does not wish to be recorded, you may disconnect the call and contact the property management company directly through an alternative channel.

Property management companies using KeyKonnect are solely responsible for ensuring that their call recording practices comply with applicable laws in their jurisdiction.

11. International Data Transfers

KeyKonnect is incorporated in Canada. Our application infrastructure and database are hosted in the United States (US East — North Virginia). By using our service, you acknowledge that your data may be transferred to and processed in the United States.

All such transfers are made subject to appropriate contractual safeguards with our sub-processors, binding them to standards consistent with Canadian privacy law.

12. Cookies and Tracking Technologies

Our platform uses session cookies strictly necessary for authentication and platform functionality. We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

Our marketing website (keykonnect.com) may use limited analytics to understand visitor traffic. No personally identifiable information is collected through website analytics.

13. Children's Privacy

KeyKonnect is a business-to-business platform not directed at individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided personal information to us, contact privacy@keykonnect.com and we will delete it promptly.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify customers by email and update the "Last Updated" date at the top of this document. Your continued use of the platform after the effective date of any changes constitutes your acceptance of the updated Policy.

15. Contact Us