productPrivacy Policy
This Privacy Policy explains how Keyline collects, uses, discloses and protects personal information when you visit our website or use the Keyline app on the web or on your phone (together, the “Service”). It is written for real estate professionals in the United States, and in particular in California, and it also meets our obligations as a company established in the European Union.
1. Who we are
Keyline is operated by B & CR GROWTH PARTNERS, S.L., a Spanish limited company (tax ID B26752469) with its registered office at Plaza Padre Jerónimo de Córdoba 13, 3º A, 41003 Seville, Spain, registered with the Mercantile Registry of Seville (“we”, “us”). For any privacy question or request, write to contact@carvexvs.com.
2. Two kinds of data, two roles
Your account data. Information about you as a Keyline user (your name, email, profile, brokerage, license number and how you use the Service). We decide how this data is used, so for this data we act as the “business” under California law and the “controller” under the EU General Data Protection Regulation (GDPR).
Your clients’ data. Information you enter about other people: buyers, sellers, leads, referrals, vendors and their companies, including notes, activities, tasks, deals, transactions and voice notes. You decide what to record and why. For this data we act only on your instructions, as your service provider under the California Consumer Privacy Act (CCPA) and your processor under the GDPR, as set out in our Data Processing Addendum. If one of your clients asks us about their data, we will refer them to you.
3. What we collect
| Category | Examples | Source |
|---|---|---|
| Identifiers and contact details | Name, email address, phone number, account ID | You |
| Professional information | Title, brokerage or company, California DRE license number and status (self-reported), brokerage logo, profile photo | You |
| Account credentials | Password (stored only as a one-way hash by our authentication provider), session tokens | You; generated by the Service |
| Preferences | Language, time zone, currency, enabled modules and widgets | You |
| Content you enter | Contacts and companies, notes, activities, tasks, opportunities, transactions, commissions, expenses | You |
| Voice notes | Audio you record (processed and then deleted), the resulting transcript and the draft record you confirm | You |
| Technical data | IP address, browser and device type, request logs, error reports | Your device, automatically |
We do not ask for, and you should not enter, Social Security numbers, financial account numbers, government ID images, health information or any information about a person’s race, religion, national origin, sex, disability, familial status or other characteristics protected by fair housing laws.
We do not use advertising cookies, tracking pixels or third-party analytics. See our Cookie Notice.
4. How we use it
- To create and secure your account, sign you in and keep you signed in.
- To provide the Service: store and show your records, calculate your metrics, send you account emails (confirmation and password codes).
- To turn a voice note into a draft record you can review, when you choose to use voice notes.
- To keep the Service secure and working: prevent abuse, investigate errors, back up data.
- To answer your messages and requests.
- To comply with law and enforce our Terms of Service.
We do not use your clients’ data for our own purposes, we do not combine it with other data, and we do not use any of your content to train artificial intelligence models. We will tell you before using your account data for a new purpose that is not compatible with the ones above.
Legal bases (GDPR). Performance of our contract with you (account, Service, voice notes on request); our legitimate interests in keeping the Service secure and improving it; compliance with legal obligations; and your consent where we ask for it, which you may withdraw at any time.
5. Voice notes
Recording starts only when you tap the button and stops after two minutes at most. The audio is sent over an encrypted connection to our speech-to-text provider, transcribed, and then deleted: we do not keep recordings. The transcript is sent to our AI extraction provider, which returns a draft (contact, activity, next step, follow-up task). Nothing is saved to your workspace until you review and confirm it. Our AI providers process this data under commercial terms that prohibit them from training their models on it and limit their retention to short periods for abuse monitoring. You can always type a note or log an activity by hand instead.
6. Who we share it with
We do not sell personal information and we do not share it for cross-context behavioral advertising, as those terms are defined in the CCPA, and we have not done so in the past 12 months. We disclose personal information only:
- To our service providers and subprocessors (hosting, database, authentication, email delivery and AI processing), under contracts that limit their use of it to providing services to us.
- When required by law, subpoena or court order, or to protect the rights, safety and property of our users, the public or us. Where allowed, we will notify you first.
- In a merger, acquisition or sale of assets, subject to this Policy, with notice to you.
- With your direction or consent.
7. How long we keep it
- Account data and your content: while your account is open. When you close it, we delete it from the live system within 30 days and from backups within the following 30 days, unless the law requires us to keep something longer.
- Voice recordings: deleted as soon as they are transcribed.
- Security and request logs: up to 90 days.
- Records of privacy requests: 24 months, as California law requires.
Before closing your account you can ask us for a copy of your data. Keep in mind that California real estate licensees have their own record-keeping duties (for example, three years for transaction records); Keyline is not a substitute for your brokerage’s official transaction files.
8. Security
Data is encrypted in transit (TLS) and at rest. Each workspace is isolated at the database level by row-level security policies, so one account cannot read another’s data. Files such as logos are kept in private storage and served through short-lived signed links. Access by our staff is limited to what is necessary to operate and support the Service. No system is perfectly secure; if a breach affects your personal information we will notify you and the authorities as the law requires, including under California Civil Code §1798.82.
9. Your California privacy rights
If you are a California resident you have the right to:
- Know what personal information we have collected about you, the categories of sources, the purposes, and the categories of third parties we disclose it to, and to get a copy of it.
- Delete personal information we collected from you, subject to legal exceptions.
- Correct inaccurate personal information.
- Opt out of sale or sharing. We do not sell or share personal information, so there is nothing to opt out of; we honor Global Privacy Control (GPC) signals as a valid opt-out request anyway.
- Limit the use of sensitive personal information. We use your account credentials only to provide the Service, which is a permitted purpose, and no other sensitive personal information about you.
- Non-discrimination. We will not deny you the Service, charge you a different price or give you a different quality of service for exercising these rights.
To make a request, email contact@carvexvs.com from the address on your account. We will confirm receipt within 10 business days and respond within 45 days (extendable once by 45 days with notice). We may ask for information to verify your identity. You may use an authorized agent with your signed permission. If you are a client of a Keyline user, please contact that agent directly; we will help them respond.
Notice at collection. The categories of personal information we collect and the purposes are listed in sections 3 and 4; retention periods in section 7. We do not sell or share personal information.
Shine the Light. We do not disclose personal information to third parties for their own direct marketing purposes.
Do Not Track. We do not track you across other websites, so our response to browser Do Not Track signals is the same with or without them.
Although the CCPA may not yet apply to a company of our size, we apply these rights to every user, in every state.
10. If you are in the European Economic Area or the UK
You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent. You can also complain to a data protection authority; in Spain, the Agencia Española de Protección de Datos (www.aepd.es). Because our infrastructure is in the United States, your data is transferred there under the EU–US Data Privacy Framework where the recipient is certified, or under the European Commission’s Standard Contractual Clauses.
11. Children
The Service is for real estate professionals aged 18 or over. We do not knowingly collect personal information from children under 16 and we do not sell or share the personal information of anyone. If you believe a child has given us information, contact us and we will delete it.
12. Changes
We will post any change here with a new “Last updated” date. If a change is material, we will also tell you by email or in the app at least 30 days before it takes effect.
13. Contact
B & CR GROWTH PARTNERS, S.L. · Plaza Padre Jerónimo de Córdoba 13, 3º A, 41003 Seville, Spain · contact@carvexvs.com