Terms of Service

Agreement and eligibility

Keystone is operated by Tng Shao Bin Jayden in his personal capacity. “Keystone” is the name of the Service and is not a separate incorporated company. These Terms of Service (“Terms”) are an agreement between you and Tng Shao Bin Jayden (“we”, “us” or “our”) governing your access to the Keystone website, applications and related services (the “Service”).

By creating an account or using the Service, you agree to these Terms and acknowledge our Privacy Policy. If you use Keystone for an organisation, you confirm that you have authority to accept these Terms for that organisation.

You must be at least 18 years old and legally able to enter into this agreement. Do not use the Service if applicable law prohibits you from doing so.

What Keystone provides

Keystone helps users capture consented audio, create transcripts, identify and label speakers, organise client and meeting records, prepare for upcoming conversations, manage calendars and follow-ups, and generate AI-assisted meeting briefs and reviewed administrative drafts.

The Service may also provide client-data import and export tools and optional connections to third-party calendars, email, document, CRM, collaboration or other services. Connected-app availability depends on the provider and your plan or deployment.

Features may vary by plan, device, browser, location or development stage. Keystone is a conversation assistant, not an official recording authority, professional adviser, emergency service or guaranteed system of record.

Consent and lawful recording

You are responsible for every recording or audio file you create, upload or process through Keystone. Before recording, you must:

• clearly tell every participant that audio will be recorded and explain the purpose;
• explain that the recording may be transcribed, analysed by AI, stored and shared as you intend;
• obtain valid consent from every participant and keep any evidence required by applicable law, contract, employer policy or professional rule; and
• stop recording when consent is refused or withdrawn, unless you have another lawful basis and are permitted to continue.

Keystone’s consent confirmation is a product safeguard. It does not itself prove that consent was valid, informed or legally sufficient. Recording rules differ by location and context; you must check and follow the rules that apply to you and every participant.

You must not use Keystone for covert recording, secret surveillance, stalking, harassment, interception, or to evade a person’s reasonable expectation of privacy. Extra care and legally valid permission are required before recording children, vulnerable people, confidential proceedings or sensitive professional conversations.

Your content

“User Content” includes audio, transcripts, speaker labels, notes, meeting details, AI outputs and other material you submit to or create with the Service. As between you and Keystone, you retain your rights in User Content.

You confirm that you have the rights, permissions and lawful basis needed to provide User Content to Keystone. You grant us a limited, non-exclusive, worldwide and royalty-free licence to host, copy, transmit, process and display User Content only as reasonably necessary to provide, maintain, secure and troubleshoot the Service, comply with law, and follow your instructions.

You remain responsible for reviewing, correcting, exporting, sharing and deleting your User Content. Do not upload material that you are not authorised to process.

Privacy and personal data

Recordings, transcripts and client records can contain highly sensitive personal data. For account, billing, security and service-administration data, we determine why and how that data is handled. For User Content that you submit for your work, you or your organisation control the purpose and we generally process it on your behalf as a data intermediary. To the extent that relationship applies, these Terms document your core written processing instructions to us: we will process User Content only to provide, secure and support the Service, comply with law, or follow your documented feature instructions. Organisations that require additional processor terms, audit information or industry-specific commitments should contact us for a separate data processing agreement; if it conflicts with these Terms, that agreement controls for the covered processing.

What we handle. Depending on the features you use, we may handle your account and profile details; authentication information; client contact details and notes; recordings; transcripts; speaker labels; meeting details; AI Output; follow-up status; calendar events; imported records; export requests; plan and usage information; support messages; optional connected-app account details, permissions and encrypted access tokens; and limited technical, security and audit records. We do not need or store your password in readable form.

Why we handle it. We use personal data to create and secure accounts; store and organise your workspace; transcribe and analyse meetings through the product workflow; generate, review, import and export records; run connections you authorise; provide support and billing; prevent abuse; investigate failures; meet legal obligations; and improve reliability and safety using content-free or aggregated operational information where practicable. We do not sell or rent personal data, use User Content for targeted advertising, or make unrelated decisions about meeting participants. We do not use User Content to train models that we own. Unless we separately confirm otherwise in writing, we do not promise that every AI or transcription provider offers zero retention or excludes content from every provider model-improvement process; the provider terms and account settings applicable to our use govern those issues.

How we protect it. We use authenticated, owner-scoped access controls for user records and private files, keep service-provider secret API keys and connected-app access tokens out of the browser, encrypt stored connected-app tokens, limit provider calls through server-side checks, and avoid putting recordings, transcripts, briefs, raw IP addresses or secrets into application logs. Your browser stores a signed-in user session token, a last-activity timestamp and limited local preferences or upload identifiers so that the Service can work and sign the account out after eight hours without meaningful activity; these are not provider secret keys. No online service is risk-free, so you must also secure your account and devices. If a data breach is notifiable under applicable law, we will notify the relevant authority and affected people as required.

How long we keep it. Under the current lifecycle, raw meeting audio is automatically removed after 30 days, legacy benchmark and correction cases after 90 days, and remaining meeting records after five years. You can delete a meeting sooner. A deleted meeting’s content is removed from our active, Keystone-controlled systems, while minimal content-free consent, deletion, account-closure and legal-acceptance receipts are kept for five years and then purged. Content already transmitted to a provider may remain under that provider’s applicable retention terms or legal obligations. No fixed automatic deletion deadline currently applies to every class of account, client, calendar, integration, billing, support, audit and security record; those records are retained only while needed for the Service or a legitimate legal, accounting, fraud-prevention, dispute-resolution or security purpose, after which they are deleted or anonymised. Disconnected-app credentials are deleted. Deleted information may remain temporarily in provider-managed backup or recovery copies, where they exist, until the applicable provider lifecycle removes or overwrites them.

Your choices and requests. You can review and correct meeting and client records, export available workspace data, delete individual meetings, disconnect optional apps, and request access, correction, withdrawal of consent or account closure by contacting us. Before acting on a withdrawal request, we will explain the likely consequences of withdrawal, which may include losing features or closing the account where the data is necessary to provide the Service. We may need to verify your identity, and legal exceptions may apply. If your request concerns data placed in Keystone by another user or organisation, contact that user or organisation first because they control the relationship and context; we will provide reasonable assistance for a valid request.

Data incidents. If we become aware of a breach affecting User Content that we process for you, we will notify you without undue delay and provide information reasonably available to us so that you can assess and meet your own legal duties. We will assess and notify the Personal Data Protection Commission, affected individuals or other authorities where we are legally responsible to do so.

You must collect and use personal data only for appropriate, disclosed purposes; limit access and sharing; keep important information accurate; protect it against misuse; and delete or anonymise it when it is no longer needed or when lawfully required. If a participant withdraws consent or asks to access, correct or delete information that you control, you are responsible for responding and using Keystone’s available controls.

How data moves through Keystone

This describes the Service architecture currently reflected by Keystone. A provider receives data only when its function is used; optional connected apps do not receive data until you connect and authorise them.

Overseas processing. The primary Supabase project is configured for Singapore, but AI, transcription, payment, email, website-delivery, connected-app and support providers may process data in other countries. Singapore’s PDPA may require legally enforceable obligations or another permitted safeguard providing comparable protection. We have not independently verified every provider transfer arrangement, processing country, subprocessor or account setting. Do not treat these Terms as confirmation that Keystone is ready for regulated or location-restricted data; contact our Data Protection Officer for current details.

Provider boundaries. We select and configure providers to perform defined functions, but each provider operates its own systems. Their service terms, security measures and lawful retention requirements may apply. Disconnecting an app, deleting a meeting or closing a Keystone account does not delete copies already sent to Zoom, Notion, Google, Microsoft or another external service; use that provider’s controls to remove those copies. Deleting from Keystone also does not directly send a deletion request to ElevenLabs or OpenAI; their applicable API retention terms and account settings govern provider-side copies. We do not promise that any third-party system is risk-free or located only in Singapore unless we agree that with you in writing.

AI output and human review

Transcripts, speaker labels, summaries, commitments, follow-ups and other AI-generated material (“AI Output”) may be incomplete, inaccurate, misleading, or attributed to the wrong person. Audio quality, accents, overlapping speech and context can affect results.

You must review AI Output against the transcript and, where important, the original audio and other reliable sources. A “Reviewed” status records a user action; it is not a guarantee by Keystone that the content is true or complete.

Do not present unverified AI Output as a verbatim, legally binding or professionally certified record. Keystone does not provide legal, medical, financial, insurance, employment or other professional advice.

Acceptable use

You must not use the Service to:

• violate privacy, data protection, recording, intellectual-property or other laws;
• threaten, exploit, discriminate against, deceive, blackmail or harass another person;
• create or distribute unlawful sexual or exploitative material, especially involving minors;
• infer or claim a person’s honesty, emotions, health, protected traits or risk level in a way that may unfairly affect them;
• introduce malware, probe security, access another user’s data, bypass safeguards or usage limits, or interfere with the Service;
• resell or provide the Service to others without our written permission; or
• use the Service for any activity that could cause serious harm to a person or Keystone.

We may investigate suspected misuse and restrict content or access where reasonably necessary to protect people, the Service or comply with law.

Sensitive and professional use

If you use Keystone in insurance, finance, healthcare, legal services, employment, education, housing or another regulated or high-impact setting, you remain responsible for your professional duties, required notices, record-keeping, suitability assessments and decisions.

Never use AI Output as the sole basis for a decision about a person’s eligibility, coverage, credit, employment, housing, healthcare, legal rights or access to an essential service. A suitably qualified human must review the relevant evidence, apply professional judgement and give the affected person any process or explanation required by law.

Account security

Keep your login credentials and devices secure, provide accurate account information, and promptly notify us of suspected unauthorised access. You are responsible for activity through your account unless caused by Keystone’s breach of duty.

Keystone currently provides an individual, owner-scoped account rather than a shared team workspace. You may not share an individual account in a way that defeats access controls or impersonate another person.

Third-party services

Keystone relies on third-party infrastructure and AI providers for functions such as authentication, storage, transcription and meeting analysis. Their availability can affect the Service, and their own terms may apply when you connect an external product.

We select and configure providers with security and privacy in mind, but we do not control independent third-party products. Optional connections require your action, disclose the requested permissions, and can be revoked separately. You are responsible for reviewing the terms and data practices of services you choose to connect.

Availability, plans and changes

We may add, modify, limit or discontinue features to improve safety, comply with law or develop the Service. We do not guarantee uninterrupted or error-free availability. Keep independent copies of records you are legally or professionally required to retain.

If you buy a paid subscription, the price, billing period, included usage, taxes and any trial terms shown at checkout also apply. Monthly and annual subscriptions automatically renew for the same billing period until cancelled. You can cancel through the billing portal before the next renewal; cancellation normally takes effect at the end of the paid period. We will not charge you without the authorisation required by law, and nothing in these Terms removes any refund, cancellation or other consumer right that applicable law requires.

Founding Pro pricing is limited to the first 25 paid users and remains available only while the qualifying subscription stays continuously active. Cancelling that subscription ends the founder price, and a later subscription will use the price then available.

Where a paid plan includes unlimited meeting processing, it covers genuine professional meetings processed by each subscribed user. It does not permit shared individual accounts, resale, automated bulk archives, operating a transcription service for third parties, or attempts to evade technical safeguards. We may contact you to review unusual usage and may restrict abusive use, but we will not add usage-overage charges without your express agreement.

Suspension and termination

You may stop using Keystone at any time. You may delete meetings using available controls and may request account closure through our support contact. You must cancel an active paid subscription before account closure; support may ask you to complete that step through the billing portal so that paid access and billing records close correctly.

We may suspend or terminate access where you materially breach these Terms, create risk or harm, fail to pay applicable fees, or where required by law. Where reasonable, we will give notice and an opportunity to export User Content, unless doing so would create risk, violate law or undermine an investigation.

Some information may remain temporarily in provider-managed backup or recovery copies, where they exist, or be retained where required for security, fraud prevention, dispute resolution or legal compliance.

Keystone ownership

Tng Shao Bin Jayden and the Service’s licensors own the Service, including its software, interface, branding and documentation. These Terms give you a limited, revocable, non-exclusive and non-transferable right to use the Service in accordance with these Terms; they do not transfer ownership of the Service to you.

If you voluntarily provide feedback, you allow us to use it without restriction or payment, but we will not publicly identify you as its source without permission.

Disclaimers

To the extent permitted by law, the Service is provided on an “as available” basis. We do not promise that every recording will be captured, every speaker identified, every word transcribed, or every AI Output accurate. You are responsible for deciding whether Keystone is appropriate for a particular conversation and for maintaining alternative records where needed.

Nothing in these Terms excludes warranties, guarantees or rights that cannot lawfully be excluded.

Limits on liability

Nothing in these Terms excludes or limits liability where doing so would be unlawful, including for fraud or fraudulent misrepresentation, wilful misconduct, death or personal injury caused by negligence, or any liability that cannot be excluded or limited under applicable consumer, unfair-contract, confidentiality or data-protection law.

To the fullest extent permitted by law, we will not be liable for indirect, incidental, special or consequential loss, or loss of profits, business, goodwill or data, arising from use of the Service. Our total liability arising from the Service will not exceed the greater of S$100 or the fees you paid for the Service during the 12 months before the event giving rise to the claim.

You are responsible for reasonably foreseeable claims and costs caused by your unlawful recording, lack of required consent, misuse of User Content, or material breach of these Terms.

Changes to these Terms

We may update these Terms as Keystone evolves. We will post the revised version with a new effective date and provide additional notice for material changes where reasonably practicable. Changes will not apply retroactively unless required by law.

If you do not agree to updated Terms, stop using the Service before they take effect. Continuing to use the Service after the effective date means you accept the updated Terms.

Governing law

These Terms are governed by the laws of Singapore, without regard to conflict-of-laws principles. You and we agree to try to resolve disputes in good faith first. Subject to any mandatory rights you may have, the courts of Singapore will have exclusive jurisdiction.

Contact

Service operator: Tng Shao Bin Jayden. Questions about these Terms, account closure, safety concerns or legal requests may be sent to jcc.keystone@gmail.com.

Data Protection Officer: Tng Shao Bin Jayden. Privacy questions, complaints, withdrawal requests, and requests to access, correct or delete personal data may be sent to jcc.keystone@gmail.com. Please include enough information for us to identify the relevant account or record without emailing sensitive meeting content unnecessarily.