Privacy Policy

Keepstone is deployed per Customer. For the personal data Customer's staff put into the service (tickets, directory, devices, audit logs), Customer is the controller and Odyssey Developments LLC acts as a processor on Customer's instructions. For the account and billing details of Customer's contacts, Odyssey Developments LLC is the controller.

Effective date: [Effective date — set when counsel approves].

Tickets: requester name and email, subject, message text, site, category, status, assignee and replies.

Staff directory: names and work email addresses used to match requesters.

Devices: computer name, operating system, last signed-in user, network address, installed programs and security posture, from the customer's directory or an installed endpoint agent.

Remoat (if enabled): the administrator who requested or approved a session, the target computer, times and outcomes, in an audit log. Session content is not recorded by the service.

Remoat Remote Assist (if enabled on a computer): an administrator can view, and if the request says so control, the screen of the person signed in at that computer, only after that person clicks Allow on a prompt that shows the administrator's name and reason. While it runs, a red border and a notice with an End button are shown on the screen, and the person can end it at any time. The screen image travels from the computer to the customer's own gateway and on to the administrator's browser; it is not stored and does not pass through Keepstone's servers. The service keeps an audit record of the request: administrator, computer, signed-in user, view or control, reason, the person's decision, start and end times and who ended it. Clipboard, files and audio are not shared.

Sign-in: handled by Clerk. The service stores each administrator's work email, role and permissions. Theme choice is stored in the browser.

To run the service for Customer: answer requests, assign work, report on the desk, manage devices, and secure remote access. Aggregate page-view analytics may be collected through Vercel Analytics. Personal data is not sold and is not used for advertising.

Data is shared only with the subprocessors listed on the Subprocessors page, and when law requires it. Odyssey staff access Customer data only to provide support Customer requests or to resolve a security incident.

Customer sets retention for its records. On termination Odyssey deletes Customer's deployment and database within [30] days, after the export window in the agreement. See docs/compliance/PRIVACY-AND-DATA.md for the per-feature inventory.

People who want access, correction or deletion of their data should contact their organization's IT department first. Odyssey assists Customer with such requests. Privacy contact: [privacy@ placeholder — set the real address on odysseydevelopments.dev].