KeyChange Technologies

Privacy Policy

Effective June 18, 2026

KeyChange Technologies, LLC ("KeyChange Technologies," "we," "our," "us") cares about your privacy. This policy explains what information we collect when you visit keychangetech.com or use our public tools (the AI Readiness Assessment, the contact and booking forms, our Google Calendar booking pages), how we use that information, who we share it with, and the choices you have.

1. The short version

  • We collect the information you give us through forms (your name, email, company, phone, and answers to assessment questions), plus a small amount of automatic information (your IP address, browser type, country) to keep the service running and prevent abuse.
  • We use that information to respond to you, deliver the assessment report, run your discovery call, and operate our business. We don't sell it. We don't run advertising trackers.
  • We share it only with service providers we need to run the site (email delivery, AI analysis, scheduling) and when required by law.
  • You can ask us to access, correct, or delete your information at any time by emailing privacy@keychangetech.com.
  • The AI Readiness Assessment and our online forms are currently available to U.S.-based businesses only.

2. Who this policy covers

This policy applies to information collected through:

  • The public marketing website at keychangetech.com
  • The AI Readiness Assessment at keychangetech.com/assessment
  • The contact and booking forms at keychangetech.com/contact
  • The Google Calendar booking pages we link to from the site
  • Email correspondence with info@keychangetech.com

The staff portal at portal.keychangetech.com is covered by a separate internal policy and is only used by authorized KeyChange Technologies employees and contractors. If you've interacted with us as a KeyChange Technologies customer, the data your assigned lead manages on your behalf inside the portal is also covered by this policy.

3. Information we collect

3.1 Information you give us

AI Readiness Assessment. The assessment is a multi-step form. When you complete it, we collect:

  • Contact details: your full name, email address, company name, and phone number (phone is optional).
  • Business context: your industry (selected from a list, with a free-text "Other" option), company size band, your role, and the U.S. state you operate from.
  • Technology landscape: where your business data lives, daily-use software, your team's technical comfort level on a 1–5 scale, your process documentation maturity on a 1–5 scale, and how IT is currently managed.
  • AI usage and posture: current AI usage level, AI tools your team has tried, whether you have a written AI use policy, your motivations for adopting AI, and your written answer to "What's your biggest concern about AI adoption?"
  • Goals and pain points: your written answer to "What's your biggest bottleneck or time-sink today, and if you could automate one thing magically what would it be?" along with your desired AI outcomes (multi-select) and timeline.
  • Data and risk: the kinds of sensitive or regulated data you handle (multi-select), data organization maturity on a 1–5 scale, and any free-text "anything else we should know" answer you choose to share.

Contact and booking forms. When you submit the contact form on /contact, we collect your name, email, company (optional when you message us, required when you book a discovery call), phone (booking only), and the content of your message. The booking form also captures the topic you want to discuss, your industry, business size, and your timeline for acting.

Email correspondence. When you email us, we keep the messages and any attachments in our Google Workspace mailbox.

NDA acceptance records. When you accept our Mutual Confidentiality Agreement during the App Review request flow, we record that acceptance with the NDA version, the timestamp, the IP address, the user-agent string, and a link to the customer and review records the acceptance is associated with. This is an immutable audit log we keep so we can prove, if ever needed, that you and we both agreed to the NDA in effect on a specific date.

3.2 Information collected automatically

  • IP address. When you submit the AI Readiness Assessment, the booking contact form, or the App Review request form, we capture and store your IP address. We use it to enforce per-IP submission rate limits (three per twenty-four hours on the AI Readiness Assessment, separately rate-limited on the App Review request form), to look up your country on the Assessment so we can honor the U.S.-only restriction, and as part of our abuse and security records across all three forms.
  • Country code. We send your IP address to ipapi.co to determine which country you're connecting from, and we store that country code alongside the assessment record.
  • Browser metadata. The User-Agent string your browser sends (which identifies your browser type and operating system) is captured with each assessment submission for security and diagnostic purposes.
  • Local browser storage. We use one localStorage key, techops:cookie-consent, to remember your cookie choice (accept all or necessary only) on your current device. Our own first-party site measurement uses a random session id in sessionStorage (it disappears when you close the tab) and a simple seen-before flag in localStorage; neither contains any personal information, and no cookies are set for it. Inside the staff portal we also set a sidebar:state cookie to remember whether the sidebar was last left open or closed; that cookie is only set for signed-in staff.

3.3 Information from third parties

When you book a Google Calendar slot from our site, Google collects information about you on its booking page (at minimum your name and email). Google shares booking confirmation details back with us. The discovery call is free, so there is no payment step. See Section 5 for the full list of service providers and what they handle.

4. How we use your information

We use the information we collect to:

  • Deliver the AI Readiness Assessment report. We send your structured form answers to Anthropic's Claude AI service, which generates the personalized report. Sanitized form data is the input; the structured analysis is the output. We then email the report to you and store it alongside your submission so you can be referenced if you re-engage with us.
  • Reply to your contact and booking submissions. Both forms email us a copy of the submission so we can respond. They also create or update a "lead" record in our internal portal so we keep a single view of every prospect who's reached out.
  • Schedule and run discovery calls and engagements. When you book through Google Calendar, the booking information lets us put the call on the calendar and prepare for it. The information you submitted on our form is reviewed by your assigned KeyChange Technologies lead before the call.
  • Manage ongoing customer relationships. If you become a KeyChange Technologies customer, we keep records of work performed (time entries, project notes, App Review checklists, attachments) inside our internal portal so your assigned lead can serve you well over time.
  • Run the site and prevent abuse. We use IP addresses, country codes, and User-Agent strings to enforce rate limits, restrict the public assessment to U.S. visitors, and investigate suspicious activity.
  • Comply with the law. We retain and disclose information when we're legally required to (e.g., a valid subpoena or court order).

Analytics. We measure site usage two ways. First, our own first-party measurement counts page views and the use of features like the contact form; it sets no cookies, stores no IP addresses (visitor identity is a one-way hash that changes daily), and honors your browser's Do-Not-Track setting. Second, if — and only if — you choose "Accept all" on our cookie banner, we load Google Analytics, which sets its own cookies to help us understand how visitors use the site. Choosing "Necessary only" means Google Analytics never loads for you. See Section 5 for what Google receives.

What we don't do: we don't sell your personal information. We don't share it with advertising networks. We don't run fingerprinting, retargeting pixels, or session-replay tools on the site as of this policy's effective date. If that ever changes, this policy will be updated before any new tracking is turned on.

5. Service providers (sub-processors)

We rely on a small number of third-party services to operate. Each receives only the information it needs to do its job, and each is contractually required (through their standard terms of service) to protect that information.

  • Anthropic, PBC, receives a sanitized version of your AI Readiness Assessment answers (including free-text answers about your business operations, goals, and concerns) so its Claude AI service can generate your personalized report. We do not include payment information or unrelated personal data. See Anthropic's privacy policy.
  • Resend, Inc., handles transactional outbound email: AI Readiness Assessment reports delivered to you, internal alert emails to the KeyChange Technologies team when someone submits a form, App Review request welcome emails, and customer-portal notifications. Resend signs the emails with DKIM keys we control on keychangetech.com so the messages authenticate as coming from us. See Resend's privacy policy.
  • Google LLC (Gmail / Google Workspace).receives and stores inbound email at info@keychangetech.com, privacy@keychangetech.com, and support@keychangetech.com, and is the platform we use for general business correspondence and calendar. Outbound transactional email moved off Google in April 2026 (now handled by Resend, above). See Google's privacy policy.
  • Google LLC (Google Analytics). Loads only if you choose "Accept all" on our cookie banner. Google Analytics receives standard usage data (pages viewed, approximate location, device and browser type) and sets cookies to distinguish visitors and sessions. We use it in aggregate to understand how the site is used; we don't use it for advertising or remarketing. If you chose "Necessary only," it never loads. See Google's privacy policy.
  • Google Calendar (Appointment Schedules).handles booking for the free 30-minute discovery call. The information you enter on Google's booking page (name, email, any custom fields) is governed by Google's policy linked above. The discovery call is free, so no payment information is collected.
  • Supabase, Inc., hosts our application database (where assessments, leads, customer records, and other portal data live) and our serverless edge functions (which receive form submissions and orchestrate the pipelines described above). All data is encrypted at rest and in transit. See Supabase's privacy policy.
  • Clerk, Inc., provides authentication for the staff portal at portal.keychangetech.com. It does not handle any data from public visitors to the marketing site. See Clerk's privacy policy.
  • ipapi.co, receives the IP address of visitors who submit the AI Readiness Assessment so we can determine which country the connection is coming from (used to enforce the U.S.-only restriction). No other personal data is sent. See ipapi.co's privacy policy.
  • Amazon Web Services (AWS), provides the EC2 server that hosts the static front-end of the marketing site. AWS does not see form contents or assessment answers; those are handled by Supabase Edge Functions directly. See AWS's privacy notice.

6. Cookies and similar technologies

The marketing site does not use third-party advertising cookies, third-party analytics cookies, fingerprinting, or session-replay tools. The only client-side storage we set is:

  • techops:cookie-consent in localStorage, used to remember whether you've dismissed the cookie notice banner so it doesn't reappear on every page.
  • sidebar:state as a first-party cookie, only ever set inside the signed-in staff portal, used to remember whether a staff user left the navigation sidebar open or closed.

Third-party services we link to (such as Google Calendar) may set their own cookies on their own pages when you interact with them. Those cookies are governed by the third party's own policy.

7. How we share your information

We share information in the limited situations described below.

  • With service providers as listed in Section 5, only as needed to operate the service.
  • With authorized KeyChange Technologies personnel, your assigned KeyChange Technologies lead and, where applicable, other authorized staff or contractors who need access to do their job (for example, to prepare for your discovery call or work on your engagement).
  • For legal and safety reasons, when we reasonably believe disclosure is required to comply with a valid legal process (subpoena, court order), to enforce our Terms of Service, or to protect the rights, property, or safety of KeyChange Technologies, our customers, or the public.
  • In a business transfer, if KeyChange Technologies is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We'll notify you (by email or by a prominent notice on the site) before your information becomes subject to a different privacy policy.

We do not sell your personal information and we do not share it for cross-context behavioral advertising.

8. How long we keep your information

We retain personal information only for as long as needed for the purposes described in this Privacy Policy, except where a longer period is required by law. Specific retention windows include:

  • AI Readiness Assessment results, lead records, and related inputs: three (3) years from collection.
  • Customer engagement records (including communications, deliverables, invoices, payment records, and supporting documentation) and accounting records: seven (7) years from the end of the engagement, consistent with applicable tax, accounting, and statute-of-limitations requirements.

When you submit a verified deletion request, we will purge the affected data from active production systems promptly, and from routine backup snapshots within thirty (30) days. Information retained for legal, accounting, or active-litigation-hold purposes is excluded from this deletion window for the period the retention obligation applies.

9. Your rights

Regardless of where you live, you can email privacy@keychangetech.com to ask us to:

  • Access the personal information we hold about you.
  • Correct any information that's inaccurate or out of date.
  • Delete your information from our records, subject to limited exceptions for legal, accounting, or security reasons.
  • Receive a copy of the information we hold about you in a portable electronic format.
  • Stop receiving marketing or follow-up communications. (We don't run a marketing list as of this policy's effective date; if that changes, we'll honor opt-outs.)

We'll respond within thirty (30) days. We may ask you to verify your identity by replying from the email address associated with the record before we act.

9.1 California residents (CCPA / CPRA)

If you are a California resident, the rights described above satisfy the access, correction, deletion, and portability rights granted by the California Consumer Privacy Act and its amendments. You also have the right not to receive discriminatory treatment for exercising your rights. We do not sell or share personal information for cross-context behavioral advertising, so the "right to opt out of sale or sharing" does not apply to anything we currently do.

9.2 Other U.S. state privacy laws

If you live in a state with its own consumer privacy law (Virginia, Colorado, Connecticut, Utah, Texas, and others that come into force over time), the rights described above substantially mirror the rights those laws grant. Email us and we'll handle your request.

9.3 Automated decision-making

Automated Analysis. Our AI Readiness Assessment uses automated analysis to generate results based on the answers you provide. These results are informational and educational in nature; they are not legally significant decisions about you or your business. We do not use the Assessment to deny services, set pricing, or take any action that produces legal effects.

Human Review. If you would like a KeyChange Technologies team member to review your Assessment results, explain the reasoning, or discuss them with you, contact us at info@keychangetech.com. We will respond within a reasonable time.

10. International users

The AI Readiness Assessment is currently restricted to U.S.-based businesses (we use the IP-to-country lookup described in Section 3.2 to enforce this). The contact and booking forms are not geo-restricted in code, but we primarily serve U.S. customers.

If you are located outside the United States and you reach us anyway, please be aware that the information you send will be processed and stored on servers in the United States, where data-protection laws may differ from those in your country. By contacting us, you consent to that transfer.

11. Children

KeyChange Technologies's services are intended for businesses and the adults who run them. We do not knowingly collect personal information from anyone under the age of eighteen. If you believe a minor has submitted information to us, please email privacy@keychangetech.com and we will delete it.

12. Security

We protect the information we hold with industry-standard measures, including TLS encryption in transit, encryption at rest in our hosted database, role-based access control inside our portal, and least-privilege secrets management for the third-party APIs we depend on. No system is perfectly secure; if we ever experience a security incident that affects your personal information, we'll notify you and the appropriate authorities as required by law.

13. AI-generated content

The AI Readiness Assessment report you receive is generated by an AI model (Anthropic's Claude). We've designed and tested the prompt that creates the report carefully, but AI output can occasionally include errors, omissions, or generalizations that don't fully fit your situation. The report is intended as a starting-point analysis, not a definitive professional opinion. Talk to a KeyChange Technologies team member before making important decisions based on it.

14. Changes to this policy

We may update this policy from time to time. When we do, we'll change the effective date at the top of the page and, for changes that meaningfully affect how we handle your information, post a more prominent notice on the site or email people who have engaged with us. Your continued use of the site after a change takes effect counts as acceptance of the updated policy.

15. Contact us

Questions, requests, or complaints about this policy or about how your personal information is handled go to:

KeyChange Technologies, LLC
privacy@keychangetech.com

For general inquiries (not specific to privacy or data rights), email info@keychangetech.com. For customer support if you're an active KeyChange Technologies customer, email support@keychangetech.com.

We don't publish a mailing address on this site. If you need to send us legal notice by post, email us first and we will provide a mailing address for the purpose.

This policy is paired with our Terms of Service. Together they govern your use of the KeyChange Technologies marketing site and online tools.