1. WHO WE ARE
Kiey is a software platform that allows real-estate brokerages and agents (organized into "Real Estate Teams") to manage communications, refer trusted home-services vendors to their homeowner clients, and use AI features to assist with diagnosis and matching. Kiey is the data processor or service provider acting on behalf of the Real Estate Team for client and homeowner data; Kiey is the data controller for its own business operations (billing, security, account administration, business analytics on de-identified data).
For questions about this Privacy Policy or to exercise any right described below, contact us at support@kiey.com or at:
Kiey Holdings, Ltd. 4112 Fieldstone Rd Champaign, IL 61822, USA Attn: Privacy
For Quebec residents, Kiey has appointed a person responsible for the protection of personal information; contact us at the address or email above.
2. WHAT INFORMATION WE COLLECT
2.1 Information You Provide
- Account information: name, email, phone number, postal address, role (Real Estate Team Owner, Agent, Vendor, Employee, Client / homeowner), real-estate license details (where applicable), profile photo, business name, business website.
- Authentication information: password (hashed), multi-factor codes, device tokens, session tokens.
- Payment information: for Real Estate Team Owners on a paid plan — payment-card details processed by Stripe (we receive only a tokenized identifier, not the full card number), billing address, tax-identification information where applicable.
- Communications: chat messages, files, photos, videos, voice and call recordings (where you participate in calls routed through the Service), reactions, contact lists, vendor invitations, market polygons drawn, AI prompts and responses.
- Support and feedback: information you submit to support@kiey.com or via in-app support, including problem descriptions and attachments.
- Marketing preferences and consents: SMS, email, and push-notification consent records, including timestamp and IP address at signup.
- Terms-of-Service acceptance: version accepted, date/time, IP address.
2.2 Information Collected Automatically
- Device and technical information: device type and identifiers, operating system, browser, IP address, language, time zone, screen size, mobile carrier, app version.
- Usage information: pages and screens viewed, features used, clicks, navigation paths, error logs, performance metrics, session duration.
- Location information: approximate location derived from IP address; precise device location only with your explicit permission (and only to support features that need it).
- Cookies and similar technologies: see Section 7.
- Push-notification tokens: APNs / FCM / web-push tokens.
- Communication metadata: for SMS, voice, and other messaging — sender, recipient, timestamp, channel, delivery status.
2.3 Information from Third Parties
- Authentication providers: if you sign in via Apple or Google, we receive your name, email, and a third-party-issued identifier.
- Stripe: payment status, last-four card digits, country of issue, dispute and chargeback events.
- Twilio: SMS and voice delivery status, error reasons.
- Real Estate Teams who invite you: an Agent who invites you (as a Vendor, Employee, or Client) provides your name, email, phone, and role to set up your invitation.
- Public sources: U.S. Census / ZCTA data, Statistics Canada data, postal-code data, and similar reference data used to compute Markets and pricing — this is not personal information.
2.4 Sensitive Information
We do not intentionally collect sensitive personal information (e.g., precise geolocation beyond what is needed to render mapping features, racial or ethnic origin, religious beliefs, health information, sexual orientation, biometric identifiers used for identification). Real Estate Teams and Users should not upload such information through chat or files. If you do, we process it only to provide the Service and do not use it to infer anything about you.
3. HOW WE USE INFORMATION
We use personal information to:
- Provide the Service: authenticate you; route messages, files, and calls; render maps; calculate Market Exclusivity pricing; match you with vendors; generate AI suggestions; record subscription status.
- Process payments: through Stripe; calculate, collect, and remit applicable taxes.
- Communicate with you: send transactional notices (account, billing, security), feature announcements, alerts, AI-generated suggestions, system messages, and (with consent) marketing communications.
- Improve the Service: analyze usage to identify bugs, performance issues, and product opportunities; train, evaluate, fine-tune, and improve Kiey AI and successor models (subject to the opt-out in Section 5.3 of the Terms of Service / Section 13.12 of the Terms).
- Secure the Service: detect, prevent, and respond to fraud, abuse, security incidents, account takeover, spam, and unauthorized access.
- Comply with law and enforce our Terms: including responding to legal process, defending claims, regulatory cooperation, and audit obligations.
- Operate our business: business analytics on de-identified data, financial reporting, vendor management, mergers and acquisitions due diligence (subject to confidentiality).
4. LEGAL BASES (EU/UK GDPR)
Where the EU or UK GDPR applies, we rely on the following legal bases:
- Performance of a contract — providing the Service to you under the Terms of Service.
- Legitimate interest — securing the Service, preventing fraud, improving features, training AI models on de-identified content, conducting business analytics. Our legitimate-interest assessment balances these against your privacy rights.
- Consent — for marketing communications, precise device location, optional features that require explicit opt-in, and certain cookies.
- Legal obligation — tax, anti-money-laundering, sanctions screening, breach notification, lawful disclosure to authorities.
- Vital interests — emergencies (e.g., 911 referrals from Kiey AI).
You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.
5. SHARING AND DISCLOSURE
5.1 With Other Users on Your Real Estate Team
The Service is multi-party by design. Information you share within a Real Estate Team workspace — chat messages, files, vendor invitations, polygons, AI conversations, profile information — is visible to other authorized members of that workspace, subject to role-based access controls.
5.2 With Subprocessors
We share personal information with the third-party subprocessors listed at https://kiey.com/subprocessors, including (without limitation) Stripe (payments), Twilio (SMS, voice), Anthropic, PBC (AI), Google Firebase / Google Cloud Platform (hosting, database, authentication, push notifications), Apple (iOS distribution, APNs), and Google Play / FCM (Android distribution, push notifications). Each subprocessor is contractually bound to protect personal information consistent with this Policy and the DPA.
5.3 With Real Estate Team Owners
If you are an Agent, Vendor, Employee, or Client invited to a Real Estate Team, the Real Estate Team Owner and the team's other authorized administrators may access information about your activity within the workspace, including your messages and files in workspace chats and your engagement with shared content.
5.4 For Legal and Safety Reasons
We may disclose personal information to:
- comply with valid legal process (subpoenas, court orders, warrants, regulatory requests);
- enforce the Terms of Service;
- protect the rights, property, or safety of Kiey, our users, or others (including in emergencies);
- detect, investigate, prevent, or respond to fraud, security incidents, or unlawful activity.
Where notice is permitted by law, we will attempt to notify you of legal-process requests directed at your account.
5.5 In Business Transfers
If Kiey is involved in a merger, acquisition, financing, restructuring, sale of assets, or similar transaction, personal information may be transferred to a successor or acquirer subject to appropriate confidentiality safeguards.
5.6 With Your Consent
We share personal information for any other purpose with your consent.
5.7 We Do Not Sell Your Personal Information
We do not sell personal information for monetary consideration. Some uses of personal information for analytics, advertising, or service-improvement may constitute "sharing" or "selling" under specific U.S. state laws (e.g., CCPA/CPRA's broad definition); see Section 8 for opt-out rights.
6. KIEY AI AND AUTOMATED PROCESSING
Kiey AI uses third-party machine-learning models (currently including Anthropic, PBC) to provide diagnostic, vendor-matching, summarization, and conversational features. AI processing of your inputs occurs as part of providing the Service to you.
- Training opt-out: You may opt out of having your content used to train, evaluate, or improve Kiey AI by emailing support@kiey.com. Opt-out is forward-looking and does not affect data already used.
- No consequential automated decisions: Kiey does not use AI to make consequential decisions about housing access, lending, insurance, employment, education, healthcare, or public benefits. See Section 13.10 of the Terms of Service for prohibited uses.
- AI may be wrong: AI output is informational and may be inaccurate. Verify with a qualified professional before acting on AI suggestions for safety-critical, code-compliance, or financially significant matters. In emergencies, call 911.
- Disclosure: Where AI is used, we disclose it in user-facing surfaces (chat headers, AI tags, onboarding notices).
7. COOKIES AND SIMILAR TECHNOLOGIES
We and our subprocessors use cookies, web-storage, mobile SDKs, and similar technologies to:
- keep you signed in;
- remember preferences;
- measure performance and usage;
- detect fraud;
- secure sessions.
We do not currently use third-party advertising cookies. If we add them in the future, we will update this Policy and provide a cookie-preferences mechanism. Browser-level "Do Not Track" / Global Privacy Control signals are honored where required by law (e.g., California, Colorado).
8. YOUR PRIVACY RIGHTS
Depending on where you live, you may have the rights described below. To exercise any right, contact support@kiey.com. We may verify your identity before fulfilling requests. We will respond within the timeframes required by applicable law.
8.1 California Residents (CCPA / CPRA)
- Right to know what personal information we collect, the sources, the purposes, and the categories of recipients.
- Right to delete personal information we hold about you (with exceptions for transactions, security, legal obligations).
- Right to correct inaccurate personal information.
- Right to opt out of sale or sharing of personal information for cross-context behavioral advertising. Submit via support@kiey.com or by emailing with "Do Not Sell or Share" in the subject. Browser GPC signals are honored.
- Right to limit use of sensitive personal information to the purposes specified by CCPA/CPRA.
- Right to opt out of automated decision-making technology (ADMT) for any future ADMT used in a manner subject to ADMT rules. Currently, Kiey does not use ADMT in a way that subjects it to formal opt-out (vendor matching is not a "consequential decision"); we will provide an opt-out if that changes.
- Right of non-discrimination for exercising rights — we will not deny service, change pricing, or reduce service quality because you exercised a right.
- Authorized agents may submit requests on your behalf with verifiable authorization.
- Shine the Light (Cal. Civ. Code §1798.83): we do not disclose personal information to third parties for direct marketing.
- Complaints: California Department of Consumer Affairs, Consumer Information Division, 1625 N. Market Blvd., Sacramento, CA 95834, (800) 952-5210.
8.2 Other U.S. States
If you are a resident of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), Tennessee (TIPA), Iowa, Indiana, Delaware, New Hampshire, Nebraska, New Jersey, Maryland (MODPA), Minnesota, or another U.S. state with a comprehensive privacy law, you may have rights to access, correct, delete, opt out of targeted advertising / sale / profiling, and obtain a copy of your data. Submit requests to support@kiey.com.
8.3 European Economic Area, United Kingdom, Switzerland (GDPR / UK GDPR / FADP)
You have rights to:
- access your personal information;
- rectify inaccurate information;
- erase information ("right to be forgotten");
- restrict processing;
- data portability;
- object to processing based on legitimate interests;
- not be subject to a decision based solely on automated processing producing legal or similarly significant effects (GDPR Article 22);
- withdraw consent at any time;
- lodge a complaint with your local supervisory authority (e.g., the ICO in the UK; the CNIL in France; the FDPIC in Switzerland).
International transfers from the EEA / UK / Switzerland to the U.S. are governed by the Standard Contractual Clauses incorporated into the DPA.
8.4 Canada (PIPEDA + Provincial)
Under PIPEDA and Alberta PIPA / British Columbia PIPA / Manitoba PIPA, you have rights to:
- access your personal information;
- correct inaccurate information;
- withdraw consent (subject to legal or contractual restrictions);
- file a complaint with the federal Privacy Commissioner of Canada or the relevant provincial authority.
8.5 Quebec (Law 25)
Quebec residents have additional rights:
- Access and rectification of personal information.
- Cease use or cease distribution of personal information that has lapsed in necessity.
- Reduced indexation by search engines of personal information that causes serious injury.
- Data portability in a structured, commonly used technological format.
- Information about ADMT (logic, factors, principal parameters) used for any decision based exclusively on automated processing of personal information producing legal or similarly significant effects.
- Right to be informed before being subject to such a decision and to submit observations to a person who reviews it.
- Withdraw consent at any time.
- Complaint to the Commission d'accès à l'information du Québec.
9. SENSITIVE PERSONAL INFORMATION
We do not use sensitive personal information (as defined by CCPA/CPRA, GDPR Article 9, or analogous laws) to infer characteristics about you. To the extent sensitive information is incidentally included in chats or files (e.g., a homeowner mentioning a medical condition relevant to a service request), we process it only to provide the Service and do not use it for marketing, advertising, profiling, or training Kiey AI on identifying characteristics.
10. CHILDREN
The Service is not directed to children under 13 (or under 14, 16, or higher age threshold required by your jurisdiction, including under COPPA, GDPR, and Quebec Law 25). We do not knowingly collect personal information from children under those ages. If you believe a child has provided personal information without verifiable parental consent, contact support@kiey.com and we will delete it. Real Estate Teams may not invite children as Clients or sub-users.
11. INTERNATIONAL TRANSFERS
The Service is operated primarily in the United States and Canada. By using the Service, you consent to processing of your personal information in the United States, Canada, and other countries where Kiey or its subprocessors operate. These countries may not have the same data-protection laws as your country. Where required by GDPR, UK GDPR, Quebec Law 25, or analogous law, transfers are governed by the Standard Contractual Clauses, the UK International Data Transfer Addendum, or analogous valid mechanism, as set forth in the DPA.
12. RETENTION
We retain personal information for as long as necessary to provide the Service, comply with legal obligations, resolve disputes, defend claims, and enforce our agreements. Specifically:
- Active accounts: for the life of the account.
- Cancelled accounts: Real Estate Teams have 30 days to export their data; we retain Tenant data for up to 90 days post-cancellation, except where required by law to retain longer or where needed to defend or pursue legal claims.
- Backups: routine backups are deleted in the ordinary course according to our retention schedule.
- Anonymized / aggregated data: retained indefinitely.
- Logs and audit records: typically 90 days to 24 months, depending on type.
- Tax and financial records: as required by tax law (typically 7 years).
- Communications consent records: as required by TCPA / CASL / state laws (typically 4–7 years).
13. SECURITY
We implement commercially reasonable administrative, technical, and physical safeguards to protect personal information, including encryption in transit (TLS 1.2+) and at rest (AES-256), role-based access controls, multi-factor authentication for administrative access, security logging and monitoring, vulnerability management, incident response, and personnel training. The full list of security measures is in Annex II of the Data Processing Addendum.
No security measure is perfect. We do not warrant that the Service or your information will be free of unauthorized access. In the event of a confirmed personal-data breach affecting your information, we will notify you consistent with applicable law (GDPR Article 33, CCPA/CPRA, U.S. state breach-notification statutes, PIPEDA, Quebec Law 25).
14. COMMUNICATIONS
By using the Service you consent to receive transactional and operational communications by email, SMS, mobile push notification, in-app message, voice/calling, desktop notification, and any successor channel. With your express marketing consent, we may also send marketing communications by the same channels.
You may opt out of:
- Marketing email: click "unsubscribe" in any marketing email.
- Marketing SMS: reply STOP.
- Marketing push: disable in your device settings or in-app preferences.
Transactional and operational communications cannot be opted out of without ceasing use of the Service.
Voice calls and chat communications may be recorded for quality, training, fraud prevention, and dispute resolution. By using calling or chat, you consent to recording. Where two-party consent is required, both parties using the Service consent.
15. THIRD-PARTY LINKS AND SERVICES
The Service may contain links to third-party websites, apps, and services. This Privacy Policy does not apply to those third parties. Review their privacy policies before providing them with personal information.
16. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy from time to time. Material changes take effect 30 days after notice (by email, in-Service banner, or update of the "Last Updated" date with notification). Non-material changes take effect immediately on posting. Your continued use of the Service after the effective date constitutes acceptance.
Prior versions are available on request to support@kiey.com.
17. CONTACT
For questions, requests, or to exercise any privacy right, contact:
Email: support@kiey.com
Mailing address: Kiey Holdings, Ltd. 4112 Fieldstone Rd Champaign, IL 61822, USA Attn: Privacy
For Quebec residents, the person responsible for the protection of personal information may be reached at the same address and email.
For service of process for Delaware-corporation matters: see the Terms of Service Section 38.
END OF DOCUMENT.