Privacy Policy
keya.studio is operated by IDYeah Studio ("we", "us", "our"). This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and the rights you have over it.
By using keya.studio — including signing up for the waitlist, accessing the platform, or communicating with us — you acknowledge this policy.
We do not sell your personal data. We do not share it with advertisers. We collect only what we need to operate the service.
1. Who we are
IDYeah Studio is the data controller responsible for your personal data collected through keya.studio.
2. What data we collect and why
| Data | Why we collect it | Legal basis (GDPR) |
|---|---|---|
| Email address (waitlist) | To notify you when early access is available and send the confirmation email | Consent |
| Email address (account) | To create and manage your account and send transactional emails | Contract performance |
| Name | To personalise your account and communications | Contract performance |
| Billing information | To process payments via Stripe — we do not store card details | Contract performance |
| Content submitted to agents | To process your requests through Mine, Frame, Plot, Crit, and Tone and return outputs | Contract performance |
| Agent outputs and artifacts | To store your work in project and workspace memory across sessions | Contract performance |
| Usage data | To understand how the product is used, improve features, and detect errors | Legitimate interests |
| Technical data | IP address, browser, device type — for security and diagnostics | Legitimate interests |
We do not collect sensitive personal data and we ask that you do not submit such information through the platform.
3. How your content is processed by AI
When you submit content to keya agents — research transcripts, briefs, copy, URLs, or any other input — that content is sent to Anthropic's API to generate responses. This is the core function of the service.
- Anthropic does not use content submitted via the API to train their models, per their API usage policy.
- We do not use your content to train any models.
- Content is stored in your project and workspace memory for continuity. You can delete this at any time from account settings.
- You own the content you submit and the outputs the agents produce.
We recommend not submitting personally identifiable information about third parties (e.g. research participants) in identifiable form. Use anonymised or aggregated data where possible.
4. Third-party services
| Service | Purpose | Data processed |
|---|---|---|
| Anthropic | AI model API — powers all five agents | Content you submit to agents |
| Clerk | Authentication and user accounts | Email, name, session tokens |
| Stripe | Payment processing | Billing details, payment history |
| Neon | Database — projects, memory, artifacts | All structured user data |
| Vercel | Hosting and infrastructure | IP address, request logs |
| EmailJS | Transactional email | Email address |
| PostHog | Product analytics | Usage events, device type, country |
| Sentry | Error tracking | Technical error data, device info |
| Upstash | Caching and rate limiting | Temporary session data |
| Cloudflare R2 | File storage for uploaded documents | Files you upload to agents |
All providers are contractually bound to process data only for the purposes we specify. Where required by GDPR, we have signed Data Processing Agreements with each provider.
5. Cookies and tracking
The keya.studio waitlist page uses no tracking cookies. When you create an account, we use strictly necessary cookies for session management via Clerk. We do not use advertising cookies or cross-site tracking.
We use PostHog for analytics in a privacy-preserving configuration, avoiding cookies where possible. You can control cookies in your browser settings at any time.
6. Data retention
- Waitlist emails — retained until you request removal or we close the waitlist.
- Account data — retained for the duration of your account. Deleted within 30 days of account closure.
- Project memory and artifacts — retained for the lifetime of the project. Deletable at any time from your account.
- Billing records — retained for 7 years as required by financial regulations.
- Usage and error logs — retained for 90 days, then automatically purged.
7. Your rights (GDPR)
If you are in the European Economic Area, United Kingdom, or Switzerland, you have the following rights:
- Access — request a copy of the personal data we hold about you.
- Rectification — request correction of inaccurate data.
- Erasure — request deletion of your personal data.
- Restriction — request that we limit processing while a dispute is resolved.
- Portability — request your data in a machine-readable format.
- Objection — object to processing based on legitimate interests.
- Withdraw consent — where processing is based on consent, you can withdraw at any time.
To exercise any of these rights, email keya@idyeah.studio. We respond within 30 days at no charge.
You may lodge a complaint with your local data protection authority. In the EU: edpb.europa.eu. In the UK: ico.org.uk.
8. International data transfers
keya is operated from India with infrastructure based primarily in the United States. Where your data is transferred outside the EEA or UK, we rely on Standard Contractual Clauses and Data Processing Agreements that include appropriate transfer safeguards.
9. Security
- All data in transit is encrypted via TLS 1.2 or higher.
- Database data is encrypted at rest.
- Access to production systems is restricted to authorised personnel only.
- Authentication is managed via Clerk with multi-factor authentication support.
If you believe you have found a security vulnerability, please disclose it responsibly to keya@idyeah.studio before making it public.
10. Children
keya is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it promptly.
11. Changes to this policy
We may update this policy as the product evolves or legal requirements change. We will notify account holders by email of material changes and update the date at the top of this page.
12. Contact
IDYeah Studio — keya.studio
Attn: Privacy
We aim to respond to all privacy requests within 5 business days.