Keystone

Privacy Policy

Last updated: February 17, 2026

1. Information We Collect

We collect information in the following categories:

  • Account Information: Name, email address, and password when you register
  • Profile Information: Phone number, mailing address, date of birth, and other details you provide
  • Membership Data: Organization affiliations, degree status, officer positions, and related records
  • Financial Data: Dues invoices, payment history, and transaction records
  • Usage Data: Log-in timestamps, feature usage, and session information
  • Communications: Messages, announcements, and notifications sent through the platform

2. How We Use Your Information

We use collected information to:

  • Provide, maintain, and improve the Service
  • Authenticate your identity and manage your account security
  • Process membership records, dues, and financial transactions
  • Deliver notifications, announcements, and communications
  • Generate reports and analytics for organizational administration
  • Respond to support requests and communicate about the Service
  • Comply with legal obligations and enforce our Terms of Service

3. Data Security

We take the security of your data seriously and implement industry-standard measures to protect it:

  • Encryption at Rest: Personally identifiable information (PII) including phone numbers, addresses, and dates of birth is encrypted using AES-256-GCM encryption
  • Encryption in Transit: All communications between your browser and our servers are encrypted using TLS/HTTPS
  • Password Security: Passwords are hashed using bcrypt with appropriate work factors
  • Session Management: Sessions automatically expire after 30 minutes of inactivity
  • Multi-Factor Authentication: TOTP and WebAuthn/passkey support for enhanced account security
  • Tenant Isolation: Each organization's data is logically isolated within the platform

While we strive to protect your information, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

4. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. Membership records and financial data may be retained for the duration required by applicable laws and organizational bylaws. When you request account deletion, we will remove your personal data within a reasonable timeframe, except where retention is required by law or legitimate organizational recordkeeping obligations.

5. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

  • Right of Access: Request a copy of the personal data we hold about you
  • Right to Rectification: Request correction of inaccurate or incomplete personal data
  • Right to Erasure: Request deletion of your personal data, subject to legal retention requirements
  • Right to Data Portability: Request your data in a structured, machine-readable format
  • Right to Restrict Processing: Request limitation of how we process your data
  • Right to Object: Object to processing of your data for specific purposes

To exercise any of these rights, please contact [Organization Name] using the information provided below. We will respond to your request within 30 days.

6. Cookies

The Service uses cookies for the following purposes:

  • Session Cookies: Required for authentication and maintaining your logged-in state
  • Preference Cookies: Remember your settings such as theme preference (light/dark mode)
  • Security Cookies: Used for MFA verification and CSRF protection

We do not use tracking cookies or third-party advertising cookies. You can configure your browser to block cookies, but this may affect your ability to use the Service.

7. Third-Party Services

We integrate with the following third-party services that may process your data:

  • Stripe (Payment Processing): When you make payments through the platform, your payment information is processed directly by Stripe. We do not store your full credit card details. Stripe's privacy policy governs their handling of your payment data.
  • Email Services (SMTP): We use email delivery services to send notifications, receipts, and communications.

We carefully select third-party providers that maintain appropriate security and privacy standards.

8. Children's Privacy

The Service is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 18, we will take steps to delete that information promptly. If you believe a child has provided us with personal data, please contact [Organization Name].

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes by posting the updated policy on this page and updating the "Last updated" date. We encourage you to review this policy periodically. Your continued use of the Service after changes are posted constitutes your acceptance of the revised policy.

10. Contact Information

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us:

  • Email: [privacy@example.org]
  • Address: [Organization Address]