Privacy Policy

KeystoneIQ is provided by Intellibricks Inc. ("Intellibricks," "we," "us," or "our"). Intellibricks Inc. is a federal corporation incorporated under the Canada Business Corporations Act (Canada), located in Ontario, Canada; KeystoneIQ is our product.

This Privacy Policy describes how we collect, use, disclose, and protect personal information and personal data in connection with the KeystoneIQ service (the "Service") and our websites that link to this policy.

Product website: https://keystoneiq.ai

Effective date: March 20, 2026 Last updated: October 25, 2026 (revised: backup retention, see §9, and the public demo now reads the website you enter, see §3.5 and §9; earlier on October 22: the public demo's browser cookie, see §3.5, and demo data retention, see §9; earlier on October 17: one free trial per person, see §9; earlier on October 13: Notion and Confluence data use and Atlassian account reporting, see §3.3; earlier on October 7: Google sign-in, Drive and Analytics data use and the Google API Limited Use statement, see §3.3; October 5: retention after cancellation and account deletion, see §9; Data Processing Addendum, see §8))

At a glance

• Who we are: Intellibricks Inc., a federal Canadian corporation in Ontario, Canada, operating KeystoneIQ.
• What we collect: Account and profile data; competitive intelligence content you add; data from integrations you connect; optional documents for search and context; usage and device data; cookies as described in our Cookie Policy.
• Why: To provide and secure the Service, bill subscriptions, improve the product, and comply with law.
• Where: We process data in the United States; cross-border transfer safeguards are described in Section 6.
• AI: Features may send context to AI providers under terms that exclude using your content to train their models.
• Your choices: Rights vary by region (Canada, EEA/UK, U.S. states). Contact support@keystoneiq.ai for privacy requests.
• Terms of Service: Use of the Service is also governed by our Terms of Service.

1. Who we are

For personal information governed by Canadian privacy law, we are accountable as Intellibricks Inc. under the Personal Information Protection and Electronic Documents Act (PIPEDA), where applicable, and under substantially similar provincial laws.

If you are in the EEA or UK, Intellibricks is the controller of personal data described in this policy.

2. Scope

This policy applies when you:

• Visit our website or use the Service;
• Create an account or workspace;
• Connect integrations (e.g., CRM, messaging, documents);
• Interact with support or subscribe to communications.

It does not apply to third-party sites or services we do not control.

3. Information we collect

3.1 You provide

• Account: Name, email address, password (stored hashed).
• Workspace / company profile: Company name, product lines, ideal customer profile, and similar fields you enter.
• Competitive intelligence content: Competitors, briefs, deals, notes, uploaded content, and metadata you add.
• Billing: Payment processing is handled by our payment processor. Fees are billed in U.S. dollars (USD). We do not store full payment card numbers; we may receive billing contact details and subscription status.

3.2 Automatically collected

• Usage and device: Log data, IP address, browser type, approximate location derived from IP, timestamps, and diagnostic identifiers necessary to operate and secure the Service.
• Cookies and similar technologies: See our Cookie Policy.

3.3 From integrations you connect

When you authorize integrations (e.g., CRM, documents, analytics), we receive and store data needed to provide sync and brief features. Integration credentials are encrypted at rest.

Specific integration scopes worth calling out:

• Gong (when connected): We retrieve scheduled-call records, call metadata, transcript text, and Smart Tracker match results for the calls within scope of your Gong API package. We use this data to surface competitor mentions in your weekly brief and per-deal context blocks. We do not initiate calls, modify recordings, or write back to Gong.

• Slack (when connected): We use the OAuth scopes incoming-webhook (post weekly briefs and competitor alerts to a workspace channel you choose), commands (register the /keystone slash command), chat:write (deliver per-deal nudges as direct messages to the deal owner when a high-impact competitor signal lands on one of their active deals), users:read.email (resolve the deal owner's email (sourced from your CRM) to a Slack user ID for the DM), and users:read (Slack-required parent of users:read.email). We do not enumerate workspace members, persist any Slack user IDs beyond the per-nudge API call, post messages outside the deal-nudge and brief-delivery flows, or read messages, channels, or threads. The Slack bot token is encrypted at rest. You can disconnect Slack at any time from KeystoneIQ Settings or revoke from your Slack workspace admin.

• HubSpot / Salesforce deal owner data (when those CRMs are connected): For deal-nudge delivery and bi-directional CRM write-back, we additionally store the email address of each deal owner alongside the deal record (HubSpot owners API / Salesforce SOQL Owner.Email). The email is matched against the user list of the same KeystoneIQ workspace to resolve the owner to a KIQ member where applicable; emails of CRM owners who are not workspace members are stored alongside the deal but never used outside Slack DM lookup. CRM write-back is disabled by default and only operates after a workspace owner enables it in Settings. When enabled, it performs exactly two kinds of writes: (1) it PATCHes the KeystoneIQ-derived deal-risk score into custom fields on the deal/opportunity (keystoneiq_deal_risk / KeystoneIQ_Deal_Risk__c), and (2) when a user clicks "Add to deal" on a brief, it creates a note containing that brief summary on the selected deal/opportunity. We never modify any other CRM fields or records and never read any field except the ones documented here.

• Google (when connected): KeystoneIQ requests only the Google permissions a feature needs. Google sign-in uses your name and email address to create and sign in to your account. Google Drive uses the drive.file scope: we can read only the files and folders you pick in the Google file picker (and files later added to a picked folder), we download them to extract their text into your workspace's knowledge base for briefs and Ask KIQ answers, and we never modify, delete or share your Drive files. Google Analytics uses the analytics.readonly scope to read channel, traffic and conversion metrics for the property ID you enter; we never change your Analytics configuration. You can disconnect Google at any time in KeystoneIQ Settings or from your Google Account's third-party access page. Disconnecting Google Workspace in KeystoneIQ Settings revokes our token, stops syncing and deletes the Drive files synced into KeystoneIQ, along with their search copies; connect again to bring them back. KeystoneIQ's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to develop, improve or train generalized AI or machine-learning models, we do not sell it, and we do not use it for advertising.

• Notion and Confluence (when connected): These connections are read-only. We never create, edit, delete or share anything in Notion or Confluence.

  • Notion can read only the pages you share with KeystoneIQ in Notion (page menu, then Connections).
  • Confluence uses the scopes read:confluence-content.all, search:confluence and read:page:confluence to read the pages the connecting person can view on the connected Atlassian site (up to 500 pages per sync). It uses read:me to read that person's Atlassian account ID. We store only the account ID, never the name or email that Atlassian returns with it.
  • What we copy: for each page, its title, its text, its page ID and its version or last-edited time. We copy them into your workspace's knowledge base and index them for search, so briefs and Ask KIQ answers can use them.
  • Personal data in pages: page text may include personal information that your team wrote into those pages. You can turn on "Redact PII" in Settings to remove common personal identifiers (such as email addresses and phone numbers) before content is stored.
  • When syncs run: a sync runs when you connect and whenever you choose Sync now.
  • Atlassian account reporting: as Atlassian requires, we report the Atlassian account IDs we hold to Atlassian at least every 7 days. If Atlassian tells us an account has been closed, we delete that account's connection and every page synced through it.
  • Disconnecting: disconnecting deletes our stored token and the pages that connection synced, along with their search copies. To have them in KeystoneIQ again, connect again. Atlassian and Notion do not let apps revoke access themselves, so to remove access on their side too, remove KeystoneIQ under Connected apps in your Atlassian account settings (id.atlassian.com/manage-profile/apps) or under Settings, then Connections, in Notion.

• Document storage through StackOne (SharePoint, OneDrive, Dropbox, Box and Google Drive, when connected): These connections are read-only and go through StackOne, our integration broker (listed on our subprocessors page), which holds the access tokens. We copy the text and name of the files you authorize into your workspace's knowledge base and index them for search. Disconnecting a storage provider removes the linked account at StackOne and deletes the files synced from that provider, along with their search copies; connect again to bring them back.

• Hacker News (public-data search): For each tracked competitor we search public Hacker News discussions through Algolia's Hacker News search API, which receives the competitor name as the search query. No account or customer credentials are involved.

• Reddit (public-data sync, not currently enabled): When enabled, for each tracked competitor we read public Reddit posts via Reddit's official OAuth API. The pass includes a site-wide search for the competitor name (existing behavior), targeted reads of a curated list of business / GTM subreddits (r/SaaS, r/sales, r/SaaSSales, r/startups, r/Entrepreneur, r/marketing, r/BusinessIntelligence), and an automatic probe for a competitor brand subreddit (e.g. r/<CompetitorName>) when one exists and is public. We use a service-level Reddit OAuth client (no per-customer Reddit login). Stored as reddit_mention items with the originating subreddit in content_metadata.subreddit.

• Status pages (public-data sync): For competitors you tag with a status-page URL, KeystoneIQ polls that page weekly via the public Atlassian Statuspage v2 incidents API or generic RSS/Atom feeds (Instatus, etc.). Stored as status_incident items with structured impact + status + timestamps. No auth required; no customer credentials stored; we don't write or modify anything on the status page.

• GitHub (public-data sync): For competitors you tag with a GitHub URL, we read public GitHub data only: release notes, recent commit count and top contributors per repo, and open issue titles + labels. We use GitHub's public API without a token, which receives only the public organization and repository names of competitors you tag; no per-customer GitHub OAuth, no private repos, no write access. The data is stored as github_release / github_commit_velocity / github_issue items in your workspace's intel stream and surfaced in weekly briefs. We do not store GitHub user identifiers beyond the public commit-author logins that appear in release notes.

3.4 Document processing

When you upload documents or sync files from connected platforms, we may extract text and generate search indexes for retrieval when generating briefs. Extracted data is retained while the associated file or workspace exists, is not used to train any AI model, and is not shared across workspaces.

3.5 Public demo (/try)

When you use our free demo without an account, we collect the website address you submit (your company's or product's website, and a competitor's website if you add one), your IP address, your browser user-agent, a hashed anti-abuse (captcha) token, and any campaign (UTM) parameters, to generate a sample brief and to prevent abuse. To write the brief we read the public pages of the website you enter, summarize what the company offers and to whom, and identify its likely competitors from public sources; we store that summary and those competitors with the sample brief. If you ask us to email you the brief, we also collect your email address; that delivery is transactional. Only if you check the optional box do we use your email to send occasional competitive-intelligence tips (see §10). The demo uses Cloudflare Turnstile for bot protection, which processes your IP address (see §7). So that each visitor sees only their own sample and the demo stays at one brief per browser per day, we set a strictly necessary cookie, try_vid, holding a random identifier (see our Cookie Policy); we store only a one-way hash of it with the demo record.

3.6 AI-assistant connectors and API access

Workspace owners on paid plans can create an API key that lets AI assistants and agents you operate (for example Claude, Cursor, or an in-house agent) read your workspace through our Model Context Protocol endpoint (the "Context Layer"), and, on eligible plans, lets automations use our REST API. When a Connector is used we record, per call: the workspace, the tool or endpoint name, the HTTP status, and a timestamp in the workspace's API audit log; for keyless demo traffic we additionally hold the IP address transiently in memory for rate limiting; it is not written to the audit log. We do not log the arguments your assistant sent or the content we returned. Connector responses are delivered only to the client that made the request; we do not forward them to any AI provider. The assistant or model provider you connect processes that data under its own privacy terms. Connector audit records are retained per §9.

4. How we use information

Canada (PIPEDA / provincial laws)

EEA / UK (GDPR)

We do not sell your personal information as defined under the California Consumer Privacy Act (CCPA/CPRA).

AI features

Brief generation and intelligence features may send prompts and context to AI providers. Under their API terms, customer content is not used to train their models. Outputs may be inaccurate; see our Terms of Service, Section 2.

Specific AI features worth calling out:

• Competitor-mention classification (when Gong is connected): We send short excerpts of your sales-call transcripts (already received under §3.3) to our AI sub-processor for classification, labeling each excerpt as an assertion, question, or incidental mention so we can drop noise from your weekly brief. Excerpts are not used to train the provider's models.

• Context Layer searches (MCP): When your assistant calls the intelligence search tool, we send the search query text to our embedding provider to compute a semantic vector for retrieval, exactly as the in-app search does. The query is not stored by the provider or used to train its models. No other Connector tool sends data to an AI provider.

5. How we share information

We share personal information only as needed:

• Service providers who host, secure, or process data on our behalf under contractual terms.
• Payment processors to complete transactions.
• Professional advisers (lawyers, accountants) under confidentiality.
• Authorities when required by law, subpoena, or to protect rights, safety, and security.

We may share aggregated or de-identified information that cannot reasonably identify you.

6. International transfers

Intellibricks Inc. is a Canadian company. Personal information is processed and stored in the United States. Some service providers may process data in other countries.

Outside Canada. We implement safeguards appropriate under applicable Canadian law, including contractual terms with service providers.

EEA / UK / Switzerland. Transfers may use adequacy decisions, Standard Contractual Clauses, supplementary measures, or other approved mechanisms.

7. Service providers

We use third-party service providers in the following categories:

All service providers process data only as instructed under contractual terms. We may update the providers we use; changes are reflected in this policy with an updated "Last updated" date.

A current list of named sub-processors is published at keystoneiq.ai/subprocessors. Contact support@keystoneiq.ai to subscribe to change notifications.

When you connect optional integrations (e.g., CRM, documents, call recording), those third-party services process data under their terms. Your credentials are encrypted at rest in our database.

8. Data processing addendum

Our Data Processing Addendum forms part of our Terms of Service and describes how we handle personal data we process for customers. For personal data subject to the GDPR, the UK GDPR or the Swiss Federal Act on Data Protection, contact support@keystoneiq.ai; we agree transfer terms, including the EU Standard Contractual Clauses, case by case.

9. Retention

We retain personal information while your account is active. Cancelling a paid subscription does not delete your data: your workspace moves to the Free plan and your briefs, settings and other workspace data stay, subject to the Free plan's limits. On every plan except Pro, intelligence items older than six months are removed automatically.

If you delete your account, your user account is removed immediately. Workspaces where you were the only member are permanently deleted within 30 days, including briefs, intelligence items, deals, competitors, related records, file caches, audit logs, and notifications, so export anything you need before you delete your account (see Export below). The same data is purged from backups within 90 days. Workspaces where other members remain continue under their care, and ownership is transferred to the longest-tenured remaining member.

To keep free trials to one per person, after you delete your account we keep a one-way hash of your email address and your email's domain. The hash can't be turned back into your address, and we use it only to check whether an address has already had a trial.

Workspaces with no remaining members are permanently deleted within 30 days.

Free-plan workspaces that remain inactive after a trial expires are not deleted on a fixed schedule, although we may contact you about long-inactive workspaces before any cleanup.

Security-relevant audit logs (sign-ins, permission changes, admin actions) and API/Connector audit records (§3.6) are retained for up to 90 days and then deleted automatically. Database backups are encrypted and kept for up to 60 days, then deleted.

Demo data. Records from the public /try demo (including the submitted website addresses, the company summary and competitors read from them, IP address, the hashed browser identifier, and any email you provide) are retained for up to 90 days and then deleted, together with the temporary demo workspace that holds the sample brief, so the brief's link works for those 90 days. If you sign up and add the sample to your workspace, that copy, together with the company summary and competitors, becomes part of your workspace data, where you can change or delete them.

Export: Available to workspace owners from account settings or via API. Deletion: Available from your account settings or via API, subject to legal retention requirements.

10. Your rights and choices

All users

• Access / update: Available in the Service (Settings, workspace profile).
• Marketing: Opt out via unsubscribe links or by contacting support@keystoneiq.ai. For the public demo, marketing emails are sent only if you opt in; the brief copy you request is transactional and sent regardless.

EEA / UK (GDPR)

You may have rights including access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. You may lodge a complaint with a supervisory authority.

California (CCPA / CPRA)

You may have the right to know, delete, and correct personal information, and to opt out of certain sharing (we do not "sell" personal information).

Canada (PIPEDA and provincial laws)

Rights may include access, correction, and withdrawal of consent. You may complain to the Office of the Privacy Commissioner of Canada or your provincial commissioner.

Other U.S. states

We respond as required by applicable state privacy laws.

For all privacy requests, contact support@keystoneiq.ai.

11. Security

We use administrative, technical, and organizational measures appropriate to the risk, including encryption in transit and at rest for sensitive data, access controls, and multi-tenant data isolation.

No method of transmission or storage is 100% secure. We work to protect your information and notify you of material breaches as required by applicable law.

For more detail, see our Security overview.

12. Children

The Service is not intended for children under 16 (or the age required in your jurisdiction). We do not knowingly collect personal information from children. Contact support@keystoneiq.ai if you believe we have collected a child's data.

13. Changes to this policy

We may update this Privacy Policy and post the revised version with a new "Last updated" date. Continued use after the effective date constitutes acceptance where permitted by law.

14. Contact

For contractual limitations and dispute resolution, see our Terms of Service.