Get KeyUp

Legal

Data Processing Addendum

Version 1.0. Last updated October 31, 2026

This addendum is for organizations (a company, crew, school, club or other group) that use KeyUp for their people. It sets out how KeyUp handles the personal data your organization’s members put into your Space. It adds to the Terms of Service and the Privacy Policy; if they differ on how we process your organization’s data, this addendum wins.

How to put it in place: email [email protected] with your organization’s name and the Space it covers, and we send back a signed copy. A summary for whoever approves new tools is on the Trust page.

1. Who is who

  • “You” or “the Customer” is the organization that owns a KeyUp Space and decides who joins it and how it is used.
  • “KeyUp”, “we” is KeyUp, a sole proprietorship in Pennsylvania, USA.
  • “Customer Data” is personal data about your members and guests that KeyUp processes to provide your Space: the things listed in section 2.
  • For Customer Data, you decide why it is processed and we process it for you. Under US state privacy laws, such as the California Consumer Privacy Act, we act as your service provider or processor. For each person’s own account (their sign-in, devices and billing), we act on our own behalf as the Privacy Policy describes.

2. What we process

  • People: your members, admins and guests in your Space.
  • Data: account details (name, username, email, profile picture), the devices they sign in on, voice as it is relayed live, and, only when your rooms turn them on, Replay clips and transcripts; messages, photos and voice notes in your rooms; reminders; and the records the service needs to run (who heard a talk, missed talks, sign-ins, crash reports).
  • What we do with it: host it, relay it between your people, store it for the times set by your plan and your room settings, keep the service safe, and help you when you ask. A talk a device missed because its connection dropped is held in the server’s memory, never on disk, for up to 5 minutes to deliver it.
  • How long: for as long as you use KeyUp, then as described in section 8. Each kind of data and its time is in the Privacy Policy (“How long we keep it”).

3. Only on your instructions

We process Customer Data only to provide KeyUp to you, as set out in the Terms, this addendum and the settings your owners and admins choose, for the legal, safety and service-health uses described in the Privacy Policy (such as counting talks to see that KeyUp works, and reports that protect people), or where the law requires it (and then we tell you first, unless the law forbids it). We do not:

  • sell or share Customer Data, use it for advertising, or use it to train AI models;
  • use it for any purpose other than the ones above;
  • combine it with data from other customers or other sources, except as needed to run the service (for example, a person who is in two Spaces has one account).

We understand and will comply with these limits. If we can no longer meet them, we tell you, and you may take reasonable steps to stop and fix any use of Customer Data that breaks them.

4. Who can access it

Inside KeyUp, only the person who runs KeyUp can access stored Customer Data, and only to keep the service running, keep it safe, or help you when you ask. That person keeps it confidential. Your own Space owners and admins see what their roles allow, and Microsoft hosts the data on Azure (section 6).

5. Security

We protect Customer Data with the measures described on How KeyUp protects you and in the Privacy Policy (“Security”), including:

  • encryption in transit (TLS) for everything between your devices and our servers, and end-to-end encryption for private 1-to-1 calls (beta);
  • hashed passwords, and encrypted push tokens, AI keys and transcription keys;
  • servers in a Microsoft Azure data center in the United States (Central US). Traffic arrives through Cloudflare, which ends the TLS connection and can technically see traffic that is not end-to-end encrypted as it passes;
  • nightly database backups, also copied to a second machine we control, each kept for at most 30 days;
  • fixes for security problems coming first, and a public way to report them (Security).

Rooms, messages and regular calls are not end-to-end encrypted: our server handles them as they pass so the features work. We may improve these measures over time, but we won’t make them weaker for your data.

6. Service providers (sub-processors)

You allow us to use the service providers listed in the Privacy Policy (“Our service providers”) to run KeyUp, each only for its own job and under terms that protect the data. We stay responsible for them. Before we add a new provider that will process Customer Data, we update that list and email your Space owner at least 14 days ahead. If you object for a reasonable data protection reason and we can’t address it, you may cancel your plan; refunds follow the Refund policy (on the web, the first payment of a plan within 7 days; purchases through Google Play or Apple follow the store’s rules).

An AI company or transcription company your Space connects with its own key is not our sub-processor: it works under your organization’s own account and terms with that company.

7. Helping you with requests

  • Your owners and admins can remove members and change roles and room settings; your owner can delete the Space.
  • Each person can download their own data and delete their account in the app.
  • If one of your people asks you to see, correct or delete their data and you can’t do it with those tools, email us and we help without delay.
  • If someone asks us directly about data in your Space, we point them to you, or answer them directly where the law requires us to.

8. When your Space is deleted

Canceling a plan deletes nothing (see the Terms). When your Space is deleted, its rooms, messages, clips and transcripts are deleted, not just hidden, and copies in backups are removed within 30 days. A few records are kept longer, as listed in the Privacy Policy (such as billing records and reports about child safety). Before deleting, each of your people can download their own data. If KeyUp ever shuts down, we give reasonable notice and a way to download your data.

9. Security incidents

If we confirm that Customer Data was accessed, lost or disclosed without permission, we email your Space owner without undue delay, and within 72 hours of confirming it. We tell you what happened, what data it affected, what we are doing about it, and how to reach us. We keep helping you until it is resolved, including with any notices you must give.

10. Information and questionnaires

Once a year, and again after an incident, we answer a reasonable written security questionnaire from you, and we tell you about anything material that changes in how we protect Customer Data.

11. Where the data is

Customer Data is hosted in the United States. Our providers and what they do are listed in the Privacy Policy. We do not yet offer the EU or UK data transfer terms (Standard Contractual Clauses). If your organization needs them, contact us before you start.

12. General

  • This addendum lasts as long as we process Customer Data for you.
  • The limits of liability in the Terms apply to this addendum too.
  • If we update this addendum, we post the new version here with its date, and tell Space owners of anything that reduces your protection at least 14 days ahead.
  • The law that governs the Terms (Pennsylvania, USA) also governs this addendum.

Questions: [email protected].