Privacy Policy

Last updated: 26 October 2026.

KEYNATE PRIVATE LIMITED (“Keynate”, “we”) sells and runs websites and apps for publishers. This policy explains what personal data we handle, why, and what choices you have. It follows India’s Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023, and gives the same core rights to people outside India.

Two kinds of data

Keynate Platform data. Your account, billing, licence and server records. Keynate is the data fiduciary (controller) for this.
Your website data. Articles, readers, comments, subscribers and settings of the site we install for you. This lives on your own server (VPS), including your images and files. If cloud media storage is switched on for your site, the images and files in it are kept by Keynate for you instead. You control it. For your readers’ data, you are the controller and Keynate acts for you as a processor, only to install, update, back up and run the software.

What we collect on keynate.com

Account: name, email address and profile picture (from Facebook, Apple, Google or LinkedIn sign-in, or when you sign up), and your password hash if you use a password. We never see your password for those services.
Sign-in with Facebook, Apple, Google or LinkedIn: we receive your name, email address, profile picture and the provider’s user id. We use them only for your Keynate account. To stop using a provider, choose Disconnect under Account, then Sign-in methods.
Billing: billing name, address, country, GST or tax number if you give one, invoices and payment status. Card, UPI and bank details are entered with our payment partner and are not stored by us.
Service records: your plan, licence, domain names, server details (IP address, provider order reference), release and update history, backup status and support messages.
Technical data: IP address, browser type and security logs, used to keep the service safe and to find faults.
Location from IP: we look up the country of your IP address to show prices in your currency (rupees in India, US dollars elsewhere). Only the country is used for this. IP geolocation by DB-IP (db-ip.com), CC BY 4.0.
Cookies: what is needed to keep you signed in and to protect forms from abuse, plus the attribution cookie and the statistics described below. We do not load advertising scripts from Google, Meta or anyone else on keynate.com; the only analytics script is PostHog’s, loaded from keynate.com itself.
Coupon and invite cookies (functional): if you open a keynate.com link with a coupon or an invite code, first-party cookies (kn_coupon, kn_ref, kept up to 30 days) remember the code so it is applied at checkout. They hold only the code.
Security device cookie (strictly necessary): a random identifier (kn_dev, kept up to 2 years) set when you sign up, sign in or check out, used only to protect coupons, the referral program and payments from abuse. It is never used for advertising.
Chat cookie (functional): if you start a chat with our team without signing in, a random code (kn_sc, kept up to 30 days, sent only to our chat service) lets this browser continue that chat. It holds no personal details.
Chat on keynate.com: if you type a question into the chat, it is answered by AI. The answers are generated by Google (Gemini API) while we use it, or by OpenRouter if we switch providers; both may process your question for us as processors. We store your typed questions (not Nia’s answers), with personal details such as email addresses, phone numbers and card numbers removed automatically, together with the page section, language and country, plus your helpful/not-helpful votes and the links you tap, for up to 180 days, to improve our answers and website. Our legal basis is our legitimate interest in improving our service. You can turn saving off in the chat (“Save my chats”), and “New chat” deletes the saved questions of that chat. Please do not type personal details into the chat. We also keep a usage record (a one-way code of the chat session, the page, language, AI model, size of the request and whether it worked) for 30 days, to limit abuse and costs.
Chat with the Keynate team: if you choose “Talk to a person” in the chat, a member of our team answers you there. We then store the whole conversation as a support request: your messages and ours, any files you attach (signed in only), the earlier chat with Nia if you leave “Share my chat with Nia” on, the page you started from, your language, your country, the type of device and browser (not the full browser details), your rating and, only if you chose “Allow” in the cookie choice, the last pages you visited on keynate.com in that browser tab (up to 10). These messages are not stripped of personal details, because our team needs the real text to help you; card numbers are masked automatically. Please never share passwords or card numbers. Without signing in you must give an email address: we use it only to send our replies and a link to continue the chat, and a cookie in your browser lets you continue the chat. The link works until we email you a newer one, and for 30 days at most. For guest chats we also store a hashed (one-way) code of your network address, which cannot be turned back into the address, only to prevent abuse; it is kept with the chat and deleted with it. Our legal basis is answering your request (contract) and our legitimate interest in giving support.
Keynate Wallet and referrals: your wallet balance and history, coupons you used, and who invited you or whom you invited (masked email and status).
Attribution cookie: a first-party cookie (kept up to 90 days) remembers which link or ad brought you to keynate.com; only if you choose “Allow”, we tell Google and Meta about your sign-up or purchase to measure our ads.
Statistics (PostHog, EU): to learn which pages and steps work and where people get stuck, keynate.com records the pages you open, the buttons and links you click, the steps of the launch and checkout (for example the template, plan and payment method you chose, or that a payment failed), your language, your country (from our own network, not your IP address), your browser and device type and the link or campaign tags (utm) that brought you. Page addresses in these statistics are sent without their query part, so codes and tokens in links are not sent. This data is processed for us by PostHog Inc. on PostHog Cloud in the European Union (Frankfurt).
- Without your “Statistics” choice (or after “No thanks”): no cookie and no stored identifier; every page load gets a new random code that is gone when you leave, and no screen replay is recorded. We rely on our legitimate interest in improving keynate.com.
- With “Statistics” allowed (consent): PostHog keeps a random identifier in a first-party cookie and your browser’s local storage (names starting with ph_, up to 1 year) so visits can be connected, and records screen replays of keynate.com. Replays show the layout, clicks and scrolling but hide all text on the page and everything you type, so card, password, code and chat text is never visible; payment windows of Razorpay and PayPal are never recorded, and no replay is recorded on sign-in links, password reset, email verification, team invitation and payment-return pages. When you are signed in we connect the statistics to your Keynate customer number (a random code), never to your email address or phone number. Your choice is kept in the kn_consent_stats cookie (180 days).
- From our server: when an order is paid, renewed or refunded, a site goes live or a domain connects, our server tells PostHog that event with your customer number, the site’s number, the payment gateway, the currency, a price band (not the exact amount) and the country, to understand how well Keynate works (legitimate interest). You can object by writing to us.
- How long: statistics events up to 12 months, screen replays up to 30 days, then deleted.
- Your choice: change it any time with ; choosing “No thanks” stops replays and removes the PostHog cookie and storage from your browser. Blocking cookies or analytics in your browser works too.

Why we use it

To create your account, sell and deliver your site, apps and server, and run them (contract).
To take payments, send invoices and meet tax and accounting law (contract and legal duty).
To send service emails: sign-in codes, receipts, renewal and update notices, security alerts (contract). We send marketing email only if you agree, and you can opt out at any time.
To protect the service against fraud and abuse, and to fix problems (legitimate interest and legal duty).
To keep coupons and the referral program fair (legitimate interest): we compare one-way codes (keyed hashes, not the raw values) of the email address, phone, address, GST/PAN number, payment method details our payment partner shares (for example a UPI ID or a card’s network, bank and last four digits), the security device cookie and part of the IP address, to spot one person using several accounts. A referral that looks unusual is reviewed by our staff; we don’t make decisions about you on this alone without a person checking it.
To answer support and grievance requests.

We do not sell your personal data. We do not use your website data for advertising or to train AI models.

AI error reports from your website

If your website uses the AI assistant, the site sends Keynate a small health report so we can spot a broken AI provider or a faulty release quickly. This is on by default and you can switch it off at any time.

What is sent: counts of AI attempts and failures, grouped by reason code and by the step that failed; the AI model name (if you typed a custom or fine-tuned model name, it is replaced by the label “owner-typed” and the name is not sent); the version of your website’s server and AI worker; and the hour the counts belong to. The report is linked to your installation, so our support team can help you. It is not anonymous.
What is never sent: your prompts, the AI’s answers, article or site content, API keys, web addresses of your own AI endpoints, file names, or personal data of you, your team or your readers.
Why: to notice broken AI providers or releases fast and to fix them (legitimate interest in running the service).
How long we keep it: hourly counts for 90 days, then only daily totals for up to 400 days.
How to turn it off: in your News admin, open Settings, then AI, then AI health, and switch off “Send AI error reports”. Nothing is sent after that and any reports still waiting on your server are deleted. Your own admin keeps its local AI counters.

Who we share it with

We use these service providers (sub-processors) and share only what each needs:

Our server hosting partner (servers): your server order and your own secure server your site runs on.
Razorpay (payments are processed by Razorpay: cards, UPI in India, international cards): payment and billing details.
Cloudflare (network, DNS, security and, if cloud media storage is switched on for your site, media storage): traffic to our sites, where you use it your domain’s DNS, and, if cloud media storage is switched on for your site, the images and files it keeps.
Amazon SES (email): if our email sending service is switched on for your site, the address and content of the emails your site sends through it (for example sign-in codes, receipts and notifications to your readers and team).
Firebase / Google (push notifications for apps): device tokens and notification text. If crash reporting is switched on for your apps, app crash details too.
Google (Gemini API) (AI answers in the chat on keynate.com): what you type into the chat and the earlier messages of that chat, with the page you are on, your language and your country, so the chat can answer (Google processes it to produce the answer). Google’s Gemini API terms and privacy policy apply. If we switch AI providers, OpenRouter may process this data in the same way.
OpenRouter and the AI model providers it routes to: only when you use the AI assistant. Requests go through your own OpenRouter account (free or paid models that you pick) to the model provider OpenRouter routes to. OpenRouter’s own terms and privacy policy apply, and your key is kept on your own server. Keynate does not run its own AI relay and sells no AI credits. They receive what you type and the site content needed for your request.
Apple (App Store) and Google (Google Play): only if you add apps, app store publishing is switched on for your site and you connect your own developer accounts. We send your app builds, store listing texts and screenshots, the answers to the stores’ privacy and content forms, and the reviewer sign-in details you give for app review, under your own accounts. We keep the access you give us (your App Store key and a copy of your app’s signing certificate, encrypted, and Keynate’s access in your Play Console) until you remove it.
Google, Meta and LinkedIn: only if you connect those accounts for publishing or sign-in. See below.
PostHog Inc. (product statistics, PostHog Cloud EU, Frankfurt): the statistics, replays (only with your “Statistics” choice) and server events described under Statistics. Sent through keynate.com; PostHog is set to discard IP addresses, so they are not stored.
Google (Analytics, Ads) and Meta (ad measurement): only if you chose “Allow” in the cookie choice — the event (sign-up, checkout started, purchase), its value and currency, the ad click id, your browser type and a hashed email where the platform requires it. Sent from our server; you can change your choice at any time.

Data you choose to send. Automations, webhooks, data feeds and custom functions that you (or your AI assistant, with your approval) set up on your site send the data you chose to the places you chose. Those places are your choice, not Keynate’s service providers, and you are responsible for them.

We may also disclose data if the law requires it, or to protect our rights, our customers or the public. If Keynate is sold or merged, your data may move to the new owner under this policy.

Social media connections

Social sharing (in the site admin) lets a publisher connect Facebook Pages, Instagram, Threads, LinkedIn (profile or company page), Telegram and X. We store the page or account id, display name and an encrypted access token. The token is kept on the publisher’s own server; for X, Keynate holds the encrypted token so it can post for the publisher. We use this data only to publish the publisher’s articles to their accounts. It is kept until the publisher clicks Remove on the connection or the site is closed, then deleted. To revoke access, you can also remove the Keynate app in the platform’s settings (Facebook/Instagram Business integrations, Threads Website permissions, LinkedIn Permitted services). To ask for deletion, follow the steps on how to delete your data or write to [email protected].

Requests from public authorities

KEYNATE PRIVATE LIMITED reviews the legality of every request from a public authority. We challenge requests that are unlawful, disclose only the minimum necessary, and document each request and our response.

Push notifications

Publishers’ apps deliver notifications through Firebase Cloud Messaging (Google) and Apple Push Notification service. Device tokens are stored on the publisher’s own server and used only to send that publisher’s notifications. Readers can turn notifications off in the app or device settings, which stops delivery.

Browser notifications from keynate.com. Your browser may ask whether keynate.com can show notifications. Only if you choose Allow, we store your browser’s push address and its encryption keys (encrypted), the language of the page, your country (from your IP address) and the page where you allowed it, and we send you occasional news and offers from Keynate. The message is encrypted and delivered by your browser maker’s push service (for example Google, Mozilla, Microsoft or Apple), which cannot read it. To stop, block notifications for keynate.com in your browser’s site settings: we delete the address the next time you visit, or when the push service tells us it no longer works. We keep it only until then.

Where data is processed

Our providers may process data outside your country, including outside India. Your website data stays on the server you chose. We take reasonable steps, such as contracts and encryption, so that data is treated with care wherever it is handled.

How long we keep it

Account and service records: while your account is open, and for a short time after to settle disputes.
Invoices and tax records: for the period Indian tax and company law requires (currently up to 8 years).
Backups of your site: encrypted, kept up to 90 days while your service is active.
After your service ends: we keep an encrypted final backup for up to 60 days so you can come back, then we delete it (except records we must keep by law, for example invoices).
If cloud media storage is switched on for your site, the images and files in it: while your service is active; after it ends, they are deleted when the final backup period above ends.
Security logs: a limited period, then deleted.
Chat on keynate.com: your questions (personal details removed automatically), votes and link taps are deleted after 180 days, or earlier when you tap “New chat”; the usage record is deleted after 30 days.
Chats with the Keynate team and other support requests: while you are signed in, as long as your account exists (they are deleted with it); without an account, 12 months after the last message, then deleted with their files. The link to continue a chat stops working when a newer link is emailed, and after 30 days at most.
Fraud-check codes for coupons and referrals: 24 months, and deleted with your account.
Keynate Wallet ledger: as long as your account is open and for the period accounting law requires.

After that we delete the data or remove what identifies you.

How we protect it

We use encryption in transit, encrypted backups, access controls, and separate records for each customer server. No system is perfectly safe. If a breach affects your personal data, we will tell you and the authorities as the law requires.

Your rights

You can ask us to:

give you a summary of the personal data we hold and a copy of it;
correct or complete it;
erase it (see data deletion), unless the law requires us to keep some of it;
withdraw consent you gave, which does not affect what we did before;
object to or limit some uses, and (if you are in the EU or UK) move your data to another service;
nominate someone to exercise these rights for you if you die or cannot act (DPDP Act).

Write to [email protected] from your account email. We may need to confirm it is you. If you are not happy with our answer, you can complain to the Data Protection Board of India, or to your local data protection authority.

If you are a reader of a publisher’s site, ask the publisher first. They hold that data. If you cannot reach them, write to us and we will pass your request on.

Children

Keynate is for adults and businesses. We do not knowingly collect data from children under 18 on keynate.com.

Grievance Officer

For complaints about how we handle your data, contact our Grievance Officer. We reply to every message within 24–48 hours.

Name: Kanhaiya Kumar (Director)
Email: [email protected]
Company: KEYNATE PRIVATE LIMITED (CIN U62011HR2026PTC149859)
Registered office: Plot No. B&B1, Enkay Tower, Industrial Complex Dundahera, Vanijya Nikunj, Gurugram, Haryana 122016, India

Changes

We may update this policy. We will change the date above, and tell you by email if a change is important.