Skip to main content
KeyStoneSign in

Your data

Last updated 28 October 2026

You hand KeyStone your story: a CV, plans, where you are from. This page says, tool by tool, what is kept, where it goes, and how to remove it. It is the short version of the privacy policy, which has the full legal detail.

What is kept, and where it goes

Your account

What we keep
Your email address, and your name if you sign in with Google. No password is stored.
Where it goes
Google (Firebase) for sign-in. Resend for sign-in codes and welcome email.

CV tailoring

What we keep
The text of your CV, the job descriptions you use, and the tailored versions and cover letters you save. The original file is discarded.
Where it goes
The text you submit goes to an AI provider (through OpenRouter) to produce the result.

Job matches

What we keep
Your countries, regions and roles, the CV you chose for each role, and your saved and dismissed matches.
Where it goes
Nothing leaves our servers. Matching is ordinary code and does not send your CV to an AI model. If you turn on the daily email, Resend delivers it.

Grant applications

What we keep
Your drafts, with the CV text and grant call they were written from.
Where it goes
Your CV, brief and the grant call go to an AI provider to produce the draft.

Grants and fellowships

What we keep
Your citizenship, where you are based, and whether you apply as an individual or an organisation.
Where it goes
Nothing. The checks run in code. If you choose "Apply with KeyStone", the programme's public page is read by the grant tool.

Visa checklists

What we keep
Which checklist items you have ticked, for each visa.
Where it goes
Nothing.

What we never do

  • We do not sell your data, and there are no ads.
  • We do not train or fine-tune any AI model on your CV or your drafts.
  • We do not share your citizenship, location or documents with an employer, a funder or a government.
  • We do not write your CV text or model output to our server logs.
  • We do not store a password, because there isn't one.

Who handles it

A small set of providers process data for us: hosting, sign-in and database, AI, email, and the network in front of the site. Each is listed with what it receives on the subprocessors page.

Your controls

  • Delete everything. In Settings, "Delete your account" removes your account and all its data straight away.
  • Turn off the email. The daily matches email is off until you turn it on, and you can switch it off in your match settings.
  • Remove one thing. You can delete a saved CV, a draft or a match from its page.
  • Ask us. For a copy of your data, a correction, or anything else, email [email protected]. We reply within one month.

How long we keep it

Until you delete it. Usage counters used for rate limiting are tied to your account or network address and are deleted after 7 days.

Your rights

Under the EU and UK GDPR and Nigerian data protection law you can ask for a copy of your data, a correction, erasure, a restriction, to object, or to take your data elsewhere. The privacy policy sets these out in full, along with how to complain to a regulator.

Your rights in the privacy policy · How AI is used · Data questions