Last updated: March 2026
This Privacy Policy (the “Privacy Policy”) describes how Blueprint X Labs Inc. (“Key,” the “Company,” “we,” “us,” or “our”) collects, receives, uses, processes, stores, discloses, transfers, retains, and otherwise handles personal data and related information in connection with the Key platform, including any websites, applications, software, services, features, and functionality made available by the Company (collectively, the “Platform”).
Last Updated: March 2026
This Privacy Policy forms part of, and should be read together with, the Terms of Use. Capitalized terms not defined in this Privacy Policy shall have the meanings assigned in the Terms of Use.
By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy.
This Privacy Policy applies to personal data and related information processed by the Company in connection with:
a. your access to and use of the Platform;
b. your account, profile, and User Content;
c. your interactions with the Company;
d. data obtained from third-party sources; and
e. data accessed or received through Connected Integrations.
This Privacy Policy does not apply to any third-party website, application, service, or system that is not controlled by the Company, even if accessible through or integrated with the Platform. Such third-party services are governed by their own terms and privacy policies.
We may collect the following categories of information:
We may collect information that you provide to us directly, including:
a. name, email address, username, account credentials, and contact details;
b. profile information, including professional background, work history, interests, expertise, biography, and related content;
c. Organization information, including community or workspace details, member information, settings, permissions, and administrative inputs;
d. prompts, messages, submissions, files, feedback, and other User Content; and
e. communications with the Company, including support requests and correspondence.
We may collect certain information automatically when you access or use the Platform, including:
a. device information, browser type, operating system, application version, and related technical identifiers;
b. IP address, approximate geolocation, language preferences, time zone, and session metadata;
c. usage information, log data, interaction events, clicks, navigation history within the Platform, search activity, and feature usage;
d. diagnostics, crash data, performance data, and security-related telemetry; and
e. cookie, local storage, and similar technology data, where applicable.
We may collect, receive, or infer information from publicly available sources and third-party providers, including professional and organizational information reasonably associated with you or your Organization. Such sources may include data partners, publicly accessible websites, public profiles, directories, and professional networking sources.
We do not independently verify all such data and do not guarantee its accuracy, completeness, or timeliness.
If you or your Organization enable a Connected Integration, we may access, import, receive, copy, store, and process data from such Connected Integration within the scope of the permissions granted and the functionality enabled.
For example, if Slack is enabled, the data we may access can include public channel messages, channel metadata, workspace metadata, member directory information, display names, profile images, titles, and roles. We do not access private messages, direct messages, or other restricted content unless the relevant permissions are explicitly granted during the authorization process and enabled by the applicable configuration.
Your use of Connected Integrations is subject to the Terms of Use, and you are responsible for ensuring that you and your Organization have the necessary rights, permissions, and consents to enable such integrations and make such data available through the Platform.
We may use the information we collect for the following purposes:
a. to provide, operate, maintain, host, support, secure, and improve the Platform;
b. to create, populate, update, display, and manage profiles and Organizations;
c. to enable Platform features, including community features, discovery, analytics, search, and recommendations;
d. to provide and improve AI Features, including generating summaries, insights, rankings, classifications, analytics, and other outputs;
e. to authenticate users, manage accounts, enforce access controls, and administer permissions;
f. to monitor usage, prevent abuse, detect fraud, investigate misconduct, protect the Platform, and enforce the Terms of Use;
g. to communicate with you about the Platform, updates, service notices, security notices, support matters, and administrative matters;
h. to comply with legal obligations, respond to lawful requests, protect rights and safety, and resolve disputes; and
i. to create de-identified, aggregated, statistical, and derived data for analytics, research, product development, and operational purposes.
j. to deliver, measure, and improve advertising and user experience through cookies, pixels, local storage, and similar tracking technologies.
Advertising: We do not currently use personal data for advertising purposes. In the future, we may use certain data, such as professional profile information and usage data, to show you relevant advertisements or sponsored content within the Platform. If we introduce advertising, we will update this Privacy Policy and, where required by law, provide you with notice and an opportunity to opt out.
For more information about how we use cookies and your choices regarding cookies, please refer to our Cookie Policy.
We use AI Features and automated systems to process data made available through the Platform, including User Content, profile data, Organization data, usage data, and data obtained through Connected Integrations, in order to generate summaries, recommendations, analytics, insights, rankings, classifications, and other outputs.
By using the Platform, you acknowledge and consent to the processing of your data by AI Features as described in this Privacy Policy and in the Terms of Use.
We may engage third-party service providers, including AI and infrastructure providers, to process data on our behalf in order to provide, operate, secure, maintain, and improve the Platform and its features.
Where we engage such providers to process personal data on our behalf, we do so subject to contractual protections that are intended to limit their use of such data to providing services to us and to prohibit use for their own independent purposes except as otherwise disclosed or required by law.
Such processing remains subject to the terms, limitations, disclaimers, and user responsibilities described in the Terms of Use.
AI-generated outputs may be inaccurate, incomplete, misleading, or outdated. Users are responsible for independently reviewing and validating AI-generated outputs before using, relying upon, sharing, or acting upon them.
We access only the data from a Connected Integration that is reasonably necessary to provide the enabled functionality of the Platform and that falls within the permissions granted during the applicable authorization and configuration process.
Data obtained from Connected Integrations may be used to support Organization features, profile features, activity and discovery features, analytics, search, recommendations, and AI Features, including the generation of summaries, insights, and derived outputs.
We do not currently use data obtained from Connected Integrations for advertising.
We generally cease collecting new data from a Connected Integration after it is disconnected. However, information previously collected from such Connected Integration will generally be retained for no longer than twenty-four (24) months following disconnection, unless retention is required by law, necessary for security or dispute resolution, or exists in the form of anonymized or derived data that does not identify you.
Derived data, de-identified data, logs, analytics, and AI-generated outputs based on integration data may persist independently of the disconnection of the Connected Integration.
Data retention practices, including retention following account deletion or integration disconnection, are also addressed in the Terms of Use.
Where required by applicable law, we rely on one or more of the following legal bases for processing personal data:
a. performance of a contract, including providing and operating the Platform and related services;
b. legitimate interests, including maintaining and improving the Platform, securing the Platform, preventing abuse, enforcing the Terms of Use, conducting analytics, and developing new features;
c. consent, where processing is based on permissions granted by you or your Organization, including in connection with certain Connected Integrations or certain AI-related functionality; and
d. compliance with legal obligations.
If you are located in a jurisdiction that affords you specific rights or requires a specific legal basis for processing, those rights and legal bases will apply to the extent required by applicable law.
We may disclose information to the following categories of recipients:
a. service providers, contractors, advisors, and vendors that provide hosting, cloud infrastructure, analytics, communications, security, support, AI, moderation, or other services on our behalf;
b. third-party providers of Connected Integrations, to the extent necessary to enable or maintain such integrations at your direction;
c. professional advisors, auditors, insurers, legal counsel, and financial institutions;
d. courts, regulators, law enforcement agencies, or other governmental authorities where required by law, legal process, or to protect rights, safety, and security;
e. actual or prospective acquirers, investors, lenders, or counterparties in connection with a merger, acquisition, financing, corporate reorganization, sale of assets, or similar transaction; and
f. other users or the public, when you intentionally publish or share information through public profile or community features.
We do not sell personal data for monetary consideration, and we do not currently use data obtained from Connected Integrations for advertising.
If you choose to publish a public profile or make content publicly available through the Platform, such information may be visible to the public, indexed by search engines, accessed by third parties, and further copied, cached, archived, or redistributed by parties outside our control.
If you later unpublish or delete such content from the Platform, third-party search engines, archives, caches, and downstream systems may continue to retain copies or references beyond our control.
These public visibility and indexing consequences are also described in the Terms of Use.
We retain personal data for as long as reasonably necessary to fulfill the purposes for which it was collected, including to provide and operate the Platform, maintain business and system records, support legitimate business needs, resolve disputes, enforce agreements, comply with legal obligations, and protect the Platform and its users.
Upon deletion of an account, we will take commercially reasonable steps to delete or anonymize personal data associated with that account, except to the extent retention is required or permitted by law, necessary for legitimate business purposes, or necessary to maintain security, integrity, logs, audit trails, dispute records, de-identified data, or derived outputs.
Anonymized, aggregated, statistical, and derived data that does not reasonably identify an individual may be retained and used indefinitely.
Your rights with respect to retention, deletion, correction, access, and portability are subject to applicable law and the limitations described in the Terms of Use.
As a general guide, we retain account data for the duration of your account plus twenty four (24) months following deletion, after which it is deleted or anonymized, except where longer retention is required by law or legitimate business necessity as described herein.
We are based in the United States and process data primarily in the United States. If you access the Platform from outside the United States, your data may be transferred to, stored, and processed in the United States or other jurisdictions where our service providers operate. Where required by applicable law (including GDPR), we implement appropriate safeguards for such transfers, which may include Standard Contractual Clauses approved by the European Commission or other lawful transfer mechanisms. By using the Platform, you consent to the transfer of your data to jurisdictions that may have different data protection standards than your home jurisdiction.
We implement reasonable technical, organizational, and administrative measures designed to protect personal data against unauthorized access, use, alteration, disclosure, or destruction. However, no security measure is perfect, and we do not guarantee absolute security of any information, system, or transmission.
In the event of a security breach affecting your personal data in a manner that triggers notification obligations under applicable law, we will notify affected users as required by such law.
Subject to applicable law, you may have the right to request access to personal data, correction of inaccurate personal data, deletion of personal data, portability of personal data, or restriction of or objection to certain processing activities.
You may also have the ability to manage certain profile settings, publication settings, integration settings, and certain AI-related settings through the Platform, where such controls are made available.
To exercise any legal rights request, you may contact us at support@key.ai. We may request information necessary to verify your identity and authority before acting on a request. We will respond in accordance with applicable law.
California Residents. If you are a California resident, you have the following rights under the California Consumer Privacy Act ("CCPA"): (i) the right to know what personal information we collect, use, disclose, and sell; (ii) the right to delete personal information we have collected from you, subject to certain exceptions; (iii) the right to opt-out of the sale or sharing of your personal information (note: we do not sell your personal information); and (iv) the right to non-discrimination for exercising your CCPA rights. To exercise these rights, contact us at support@key.ai.
The Platform is not directed to, and is not intended for use by, individuals under eighteen (18) years of age. We do not knowingly collect personal data directly from children under eighteen (18). If we become aware that we have collected personal data from such an individual in violation of applicable law, we may delete such information.
We may modify this Privacy Policy from time to time. If we make material changes, we may provide notice through the Platform, by email, or by other reasonable means. Your continued access to or use of the Platform after the effective date of the updated Privacy Policy constitutes your acknowledgment of the updated Privacy Policy.
If you have any questions regarding this Privacy Policy or our data practices, you may contact us at: support@key.ai
