Legal

Privacy Policy

Effective Date: 15 May 2026 · Platform: KeydIn

Your privacy matters. This policy describes how KeydIn handles your personal data, email content, AI outputs, and cookies. Also see our Terms & Conditions.

1Introduction

KeydIn (“we”, “our”, or “the Platform”) respects your privacy and is committed to protecting personal data.

This Privacy Policy explains how we collect, use, process, and store information when users access or use the KeydIn platform.

By using KeydIn, you agree to the collection and use of information in accordance with this Privacy Policy.

2Information We Collect

We collect several types of information to operate and improve the platform.

Account Information

When users create an account, we may collect:

  • Name
  • Email address
  • Agency name
  • Phone number
  • Login credentials

This information is used to create and manage user accounts.

Buyer & Lead Information

KeydIn stores lead information submitted or captured through the platform, including:

  • Buyer names
  • Buyer email addresses
  • Phone numbers
  • Property enquiries
  • Conversation history
  • Lead status and pipeline stage

This information allows agents to manage buyer relationships.

Email Integration Data

If you connect an email account (Gmail or Outlook) to KeydIn:

  • KeydIn reads incoming emails to detect property enquiries from portals such as Domain, Trade Me, and REA Group.
  • Only relevant enquiry data is extracted and stored.
  • KeydIn may send emails on your behalf, either when you approve AI-drafted responses or automatically when AI Auto-Reply is enabled. Auto-Reply sends responses, schedules inspections, and books meetings autonomously without requiring manual approval.

KeydIn does not store full email inboxes or unrelated messages.

Parsed information may include:

  • Sender name
  • Email address
  • Phone number
  • Message content
  • Property address referenced in the enquiry
  • Portal source (e.g. Domain, Trade Me)

Calendar Integration Data

If you connect a calendar (Google Calendar or Outlook Calendar) to KeydIn:

  • KeydIn syncs calendar events to provide daily briefings and availability checking.
  • KeydIn may create calendar events on your behalf when booking inspections or meetings with buyers.

Stored calendar data may include:

  • Event titles, times, and locations
  • Attendee email addresses
  • Event type (inspection, meeting, appraisal)

Social Media Integration Data

If you connect a Facebook Page to KeydIn:

  • KeydIn stores an encrypted OAuth access token to publish posts to your connected Facebook Page on your behalf.
  • KeydIn stores your Facebook Page name and ID for display purposes.
  • KeydIn does not read your Facebook feed, messages, or personal profile data.

Posts are only published when you explicitly click “Publish to Facebook” on a social draft.

If your Facebook Page has a linked Instagram Business Account, KeydIn may also store your Instagram account ID to enable publishing to Instagram. The same OAuth connection and access token are used for both Facebook and Instagram publishing. Instagram posts are only published when you explicitly click “Post to Instagram” on a social draft that includes an image.

Free Trial Data

When you sign up for a free trial, KeydIn stores your trial start and end dates. During the trial, all platform features function identically to a paid subscription. If the trial expires without a paid subscription, AI features are disabled but your data (leads, conversations, listings) is retained and accessible in read-only mode. Your data is never deleted due to trial expiry.

Vendor & Seller Data

For properties listed through KeydIn, we may store vendor (seller) information including:

  • Vendor name and email address
  • Property listing details
  • AI-generated vendor reports (campaign performance, buyer feedback summaries, market insights)

Vendors may be invited to view a sanitised portal showing campaign data. Sensitive internal data such as commission rates is never exposed to vendors.

Subscription & Billing Data

Subscription payments are processed through Stripe. KeydIn stores your Stripe customer ID and subscription status but does not store credit card numbers or sensitive payment details on its own servers.

Newsletter Generation Data

KeydIn includes an AI Newsletter Generator that allows agents to upload market-report PDFs and produce branded email newsletters. When you use this feature:

  • The text content of any PDF you upload is extracted and sent to our AI provider (OpenAI GPT-4o) to generate the newsletter body and image alt text. PDF content is not used by the AI provider to train their models.
  • Suburb sections of the PDF are rendered as JPEG screenshots and stored on Cloudinary under listingflow/{agencyId}/newsletters/{newsletterId}/. These images are kept until the newsletter is deleted.
  • The generated newsletter is sent as inline HTML email via Resend to recipients you select. Recipients can be existing Contacts, Leads, or ad-hoc email addresses you type directly.
  • The email includes your profile photo (sourced from your KeydIn profile or your connected OAuth provider), an accent colour you choose, and a “Generated by KeydIn” footer linking to www.keydin.ai.
  • A per-recipient audit record (sent or failed status) is stored for your reference and to enforce sending caps. Ad-hoc typed recipients are recorded in the same way as Contacts and Leads.
  • Featured listings.You may pick up to six published listings from your agency to display as image-led cards in the email, and add up to six freeform “sold listing” entries (typed-in property address, sale price, sale method, sale date, days on market, and an optional cover image you upload). The cover images you upload for these entries are stored on Cloudinary under listingflow/{agencyId}/newsletters/{newsletterId}/manual/ and are kept until you delete the entry or the newsletter. You are responsible for ensuring you have the right to display and distribute any property photograph you upload — do not upload third-party images without permission.
  • PDF attachments.You may attach up to eight files (PDF, DOCX, etc., 10 MB each) to the outgoing newsletter email — e.g. a market report or open-home schedule. Attachments are stored on Cloudinary under listingflow/{agencyId}/newsletters/{newsletterId}/attachments/ and embedded into each outgoing email envelope by our email provider (Resend). Files persist until you remove the attachment or delete the newsletter.

Generation, regeneration, and sending are subject to per-user and per-agency rate limits to protect against abuse. See the Terms & Conditions for details.

Open Home Email Generation Data

KeydIn includes an AI Open Home Generator that allows agents to produce branded invitation emails for upcoming open homes. When you use this feature:

  • The property address, open-home start and end times, and any free-text highlights you enter (e.g. number of bedrooms, orientation, nearby schools) are sent to our AI provider (OpenAI GPT-4o) to draft the email subject line and body. This input is not used by the AI provider to train their models.
  • The generated invitation is rendered as inline HTML and sent via Resend to recipients you select. Recipients can be existing Contacts (optionally filtered by suburb or street) or ad-hoc email addresses you type directly.
  • An OpenHomeEmail record and per-recipient OpenHomeEmailSend audit rows (sent or failed status) are stored for your reference and to enforce sending caps. Ad-hoc typed recipients are recorded in the same way as Contacts.

Open home email generation and sending share a single per-agency and per-user budget with the AI Newsletter Generator. See the Terms & Conditions for details on send caps and rate limits.

Open Home Walk-In Data

KeydIn includes a walk-in registration flow that agents run from their mobile device during a live open home. When an agent registers an attendee at the door, the following data is captured:

  • Attendee name, mobile phone number, and email address
  • Optional intent flags — interested in similar properties, appraisal requested, or contract requested
  • Free-text notes the agent enters about the conversation
  • The open home that was being run (linked to a property listing or a typed ad-hoc address)
  • The date, time, and the agent who registered the attendee

At the agent's discretion (typically when the open home finishes), this attendee data may be used to:

  • Send each attendee an AI-drafted thank-you email via Resend (with a contract link if they requested one)
  • Save attendees as Contactsin the agency's address book for future follow-up; if the attendee's phone or email matches an existing Contact or Lead, the records are linked rather than duplicated
  • Generate a sanitised vendor summary email containing attendance count, signal counts, and high-level commentary — individual attendee details are not included in the vendor email
  • Compute an aggregate buyer momentum scoreper attendee — a 0–100 ranking signal that combines attendance recency, contract requests, appraisal signals, and repeat suburb visits (used internally to prioritise follow-up; never shared with vendors or buyers)

You are responsible for telling attendees their details are being collected and stored, and the purpose of the collection, at the time of registration. This is a requirement under the New Zealand Privacy Act 2020 (Information Privacy Principle 3) and the Australian Privacy Principles (APP 5).

REA Compliance & Agent Branding Data

New Zealand's Real Estate Agents Act 2008 requires every advertisement and communication a licensee sends to carry certain mandatory identification information. KeydIn stores the following fields on your agent profile so it can be embedded into every transactional email you send (re-engagement, agent reply, open-home invitations, open-home thank-yous and vendor recaps, appraisal proposals, weekly vendor reports, and newsletter blasts):

  • Licensee status(e.g. “Licensed Salesperson”, “Branch Manager”, “Licensee Agent”) — required to identify your role under the REA Act.
  • Licence number(optional) — the public REA register identifier rendered in the email's compliance footer when set.
  • Agency relationship statement(e.g. “Acting on behalf of Barfoot & Thompson Mission Bay”) — an explicit “acting on behalf of X” phrase rendered at the top and bottom of every email so the recipient cannot mistake it for a private-seller pitch.
  • Agency banner image.An image you upload (typically your office's brand banner, e.g. the Barfoot & Thompson logo) is stored on Cloudinary under keydin/banners/{agencyId}/{userId}/ and embedded inside the signature card of every transactional email. You are responsible for ensuring you have the right to use any image you upload — KeydIn does not verify trademarks or branding rights on your behalf.
  • Profile photo— an optional headshot you upload, also stored on Cloudinary, rendered to the left of your signature in every transactional email.

These fields are required before KeydIn will allow you to send transactional email through the platform. They are visible to every recipient of every email you send.

Appraisal Workflow Data

KeydIn includes an appraisal workflow used by agents on-site during a vendor property appraisal. When you run an appraisal:

  • The vendor's name and email address are linked to a SELLER Lead record (auto-created if the vendor isn't already in your address book).
  • Property attributes you capture — property type, land and floor area, year built, title type, council valuation, vendor sentiment, vendor's stated asking price, competing agencies mentioned, reason for selling, previous appraisals from other agents, recommended pre-listing prep, known issues, and your suggested commission rate — are stored against the appraisal row.
  • Photo capture. Photos you take of the property are uploaded to Cloudinary under listingflow/{agencyId}/appraisals/{appraisalId}/ and kept until the appraisal is deleted. You are responsible for obtaining the vendor's consent to take and store photos of their property.
  • Voice memo capture & transcription. Voice memos you record during the visit are uploaded to Cloudinary as audio files and automatically transcribed by OpenAI's Whisper API. Both the audio file and the resulting text transcript are stored against the appraisal row and used as input to the AI synthesis described below. OpenAI does not use audio submitted to Whisper to train their models. You are responsible for telling the vendor that voice notes may be recorded during the visit.
  • Quick notes & vendor objections. Free-text quick notes you type during the visit and structured objection chips you tap at the finish step (e.g. commission, price expectation, timing) are stored against the appraisal row.
  • AI proposal generation.The captured photos (count only, no image content), voice-memo transcripts, quick notes, structured fields, vendor objections, and the property & commercial details you record are sent to our AI provider (OpenAI GPT-4o) to produce a structured vendor proposal — greeting, property highlights, suggested asking-price range, marketing approach, fees note, and next steps. This output is rendered into an HTML email which you review and choose to send via Resend. The vendor never sees commission rates, vendor-minimum figures, or other internal data you classify as private.
  • Follow-up scheduling. When you set a next-follow-up date, that timestamp is stored against the appraisal row and used to surface overdue follow-ups on your dashboard. We do not send any automated notifications or messages to the vendor on the basis of these reminders.
  • SMS templates.When you tap “Send follow-up SMS” we render a personalised SMS body on the server and hand it to your phone's native Messages app pre-filled. KeydIn does not send SMS messages on your behalf and does not retain a copy of the message body once delivered to your phone.
  • Activity events. Every appraisal action (booked, started, completed, photo uploaded, voice memo added, proposal sent, follow-up scheduled / completed, outcome recorded, listing created) is logged as an ActivityEvent linked to the underlying Lead so the relationship history surfaces on the lead detail page.

You are responsible for telling the vendor at the start of the visit that photos, voice memos, and structured notes are being collected and used to prepare your proposal, and for obtaining any consent your local laws require for audio recording of in-person conversations.

Contact Import & Re-engagement Data

KeydIn allows agents to upload CSV files of past or prospective contacts in order to re-engage them. When you use this feature:

  • Contact data from the CSV (such as name, email, phone, address, and notes) is imported into the platform as Lead records with source set to “IMPORT”.
  • Imported contact data is sent to our AI provider (OpenAI) to compute opportunity scores and generate draft re-engagement emails. AI providers do not use this data to train their models.
  • You can review, edit, and approve drafts before sending. Re-engagement sends are subject to per-batch and per-day caps and are delivered via Resend.
  • KeydIn records whether a draft was edited before sending so you can audit AI versus agent-authored output.

You are responsible for ensuring you have the right to upload and contact the people in any CSV you import.

AI Processing Data

KeydIn uses artificial intelligence to provide features such as:

  • Email enquiry parsing and lead creation
  • Lead scoring, categorisation, and win-probability predictions
  • Draft email responses, autonomous auto-replies, and suggested follow-ups
  • Property-aware auto-replies — automatically responding to buyer enquiries about open home times, price guides, pest and building reports, contracts of sale, and private inspection availability using listing data stored in the platform
  • Vendor transparency reports (buyer feedback, market insights, recommendations)
  • Daily morning briefings and end-of-day evening prep briefs — the AI summarises today's schedule, hot leads, and tomorrow's calendar into a short prioritised action list
  • Buyer momentum scoring — a 0–100 ranking signal calculated deterministically from open-home attendance recency, contract / appraisal request flags, existing-contact bonuses, suburb-repeat patterns, and recent reply timestamps. The calculation runs locally on KeydIn's servers and does not send personal data to any AI provider for this specific feature.
  • Revenue intelligence and pipeline forecasting
  • Autonomous calendar scheduling, meeting booking, and rescheduling
  • AI-generated marketing and social media posts
  • AI-generated newsletters from agent-uploaded market-report PDFs
  • AI-generated open-home invitation emails from a property address, time window, and optional highlights
  • Opportunity scoring and re-engagement drafts for CSV-imported contacts
  • Audio transcription via OpenAI Whisper (e.g. for voice notes or meeting recordings)

To perform these features, relevant lead, property, and conversation data may be sent to our AI provider (OpenAI) for processing. This includes listing-specific fields such as open home schedules, price guides, contract and pest report availability, and inspection settings when generating property-aware auto-replies to buyers. Data is transmitted securely and is not used by the AI provider to train their models.

AI outputs are generated automatically and may not always be accurate.

Mobile App Data

KeydIn offers a native mobile application (iOS and Android). When using the mobile app, we may collect:

  • Device type, model, and operating system version
  • Push notification tokens (for new-lead, upcoming-meeting, and AI-suggestion alerts)
  • Notification preferences (which alert types you have enabled)
  • App usage and session data

The mobile app uses Bearer token authentication. Access tokens are stored securely on-device and are used only to authenticate requests to KeydIn's servers. We do not access contacts, camera, microphone, or other device features unless explicitly granted by you.

Push notification delivery

Push notifications are delivered through the Expo Push Notification service, which routes alerts via Apple Push Notification service (APNs) on iOS and Firebase Cloud Messaging (FCM) on Android. We store an Expo push token, your device platform (“ios” or “android”), an optional human-readable device name (e.g. “iPhone 17 Pro”) so you can identify your devices in Settings, and the timestamp the token was last seen. Tokens that fail delivery (because the app was uninstalled or signed out) are pruned automatically.

You can opt in or out of each notification category individually in Settings → Notifications inside the mobile app. The four categories are: new leads, upcoming meetings (with a configurable lead time of 5, 15, 30, or 60 minutes), morning suggestion, and evening suggestion. Disabling a category stops push delivery for that channel; the corresponding in-app notifications still appear in the bell on the web dashboard.

Notification content includes the buyer or vendor's name, the property address (where relevant), and a short context line (e.g. “78 Tihi Street — in 28 min”). The full message body is generated server-side from data you have already stored in KeydIn; we do not transmit additional personal data to Expo, Apple, or Google beyond the push token and the message payload itself, which is encrypted in transit.

Usage Analytics

KeydIn may collect platform usage data including:

  • Pages visited
  • Features used
  • Interaction timestamps
  • Device/browser information

This data is used to:

  • Improve product design
  • Understand feature usage
  • Identify errors and performance issues

3How We Use Information

We use collected data to:

  • Operate the KeydIn platform
  • Manage user accounts and subscriptions
  • Create and manage leads, conversations, and vendor reports
  • Provide AI-powered features (scoring, drafts, reports, briefings)
  • Sync and create calendar events for inspections and meetings
  • Send emails on behalf of agents (approved responses, confirmations)
  • Provide vendor portal access for campaign transparency
  • Process subscription payments via Stripe
  • Generate analytics and performance insights
  • Improve platform functionality
  • Provide optional two-factor authentication (MFA) for account security
  • Detect fraud or misuse

4Data Storage & Security

We take reasonable measures to protect user data.

Security practices include:

  • AES-256-GCM encryption for stored OAuth tokens and MFA secrets
  • Hashed passwords (never stored in plaintext)
  • SHA-256 hashed password reset tokens
  • Optional two-factor authentication (TOTP MFA) with encrypted secrets and bcrypt-hashed backup codes
  • JWT authentication with httpOnly, secure cookies
  • Secure databases with restricted access
  • Encrypted communications (HTTPS/TLS)
  • User-uploaded documents (e.g. LIM reports, pest reports, contracts) are stored on secure third-party cloud infrastructure with access controls. You are responsible for the content of any files you upload.

However, no system is completely secure and KeydIn cannot guarantee absolute security.

5Third-Party Services

KeydIn integrates with the following third-party services:

  • Google— Gmail API and Google Calendar API for email sync, calendar sync, and event creation (via OAuth 2.0)
  • Google Places API— used for address autocomplete in property and open-home forms (including the AI Open Home Generator and the AI Listing Builder). When you type into an address field, the partial address fragment is proxied server-side from KeydIn to Google’s Places API to retrieve up to five suggestions. Search queries are not stored beyond a short (5-minute) CDN cache used to improve performance and reduce duplicate calls. This is a separate Google service from the Gmail and Calendar OAuth integrations above.
  • Microsoft— Outlook Mail and Outlook Calendar via Microsoft Graph API (via OAuth 2.0)
  • OpenAI— GPT-4o and GPT-4o-mini for AI-powered lead scoring, email parsing, report generation, content drafting, newsletter generation, and open-home invitation drafting; Whisper for audio transcription. KeydIn does not authorise OpenAI to use your data to train their models.
  • Cloudinary— secure image hosting for listing photos, agent profile photos, and newsletter assets (including AI-rendered suburb section screenshots)
  • Stripe— secure subscription billing and payment processing (PCI-DSS compliant)
  • Resend— transactional and bulk email delivery for notifications, confirmations, vendor reports, re-engagement campaigns, AI-generated newsletters, and AI-generated open-home invitation emails
  • Expo Push Notifications— mobile push notification delivery on iOS and Android. Expo routes alerts through Apple’s APNs and Google’s FCM. KeydIn shares the device push token, your platform identifier, and the notification payload (title, body, deep-link route) with Expo. We do not share contact lists, conversation content, or pricing data with Expo beyond what appears in the visible notification text.
  • Vercel— hosting and serverless infrastructure for the KeydIn platform
  • Facebook & Instagram (Meta)— Facebook Graph API and Instagram Graph API for publishing social media posts to connected Facebook Pages and Instagram Business Accounts (via OAuth 2.0 / Facebook Login for Business)

These services operate independently and have their own privacy policies. KeydIn is not responsible for how third-party services collect or use data.

KeydIn also processes enquiry emails originating from property listing portals (e.g. Domain, Trade Me, REA Group). These portals are not directly integrated and have their own data practices.

6Data Retention

We retain user data for as long as necessary to:

  • Provide platform functionality
  • Maintain account records
  • Comply with legal obligations

Users may request account deletion via Settings → Account in the platform. Account deletion is permanent and removes all agency data including leads, conversations, listings, integrations, and user accounts. Active subscriptions are cancelled immediately upon deletion. This action cannot be undone.

Alternatively, users can contact support to request deletion.

Newsletter PDFs and the rendered suburb-section images stored on Cloudinary are retained until you delete the corresponding newsletter, after which the associated assets are removed. Audit records of recipient sends are retained as part of your agency history.

The Re-engage workspace includes a Delete all contactsaction that permanently removes every imported Contact (and their conversation history, draft messages, and activity events) from your agency. This is a hard delete — rows are not soft-deleted or sent to a recycle bin. Contacts that have been promoted to Leads are explicitly excluded from this action and are not affected. An audit log entry is written recording who triggered the deletion and how many records were removed; the audit log itself is retained as part of your agency history. Sent emails in your inbox are not affected.

Open home walk-in attendees and open home records can be deleted individually from the open-home detail page. Deleting an open home cascades to its attendees and walk-in events; if attendees were previously saved as Contacts, those Contact records persist independently and are not removed by deleting the open home.

7User Rights

Depending on jurisdiction, users may have rights to:

  • Access their personal data
  • Request corrections
  • Request deletion
  • Withdraw consent for data processing

Requests can be submitted through the KeydIn support system.

8Cookies & Tracking

KeydIn may use cookies or similar technologies to:

  • Maintain login sessions
  • Store preferences
  • Analyse platform usage

Users may disable cookies in their browser, although this may affect functionality.

9Children's Privacy

KeydIn is intended for professional real estate use and is not designed for individuals under 18 years of age.

We do not knowingly collect personal data from minors.

10Changes to This Privacy Policy

KeydIn may update this Privacy Policy periodically.

Updates will be posted on the platform, and continued use constitutes acceptance of the updated policy.

11Contact Information

For questions about this Privacy Policy or data handling practices, please contact:

KeydIn Support

support@keydin.com

Questions about this policy? Reach out to us.

Contact KeydIn →