Data processing terms

Roles

The processor is SMCI Media LLC, a Florida limited liability company, trading as KiwiOrange Solutions. Where any of the limited data below is personal data, your school is the controller and SMCI Media LLC is the processor, acting only on your instructions as set out here and in the privacy policy.

What we process, and why

Only: your account business-contact email (to bill and support you); email domains you enter as access rules (text, not a person); and one-way hashes of your administrators and of any specific addresses you choose to allow. Usage reporting counts opens per link and carries no identifier at all, so it is not personal data. We hold no student or staff roster.

Our duties

• We process the above only to provide Keystone and only on your instructions.
• We keep it confidential and secured, and we do not sell it or use it for advertising.
• Our sub-processors are Cloudflare (hosting, database, storage) and Google (outbound email). We will tell you before adding another.
• We assist you with any access, correction or deletion request, though because we hold hashes and no roster there is rarely anything to act on.
• We will tell you without undue delay if we become aware of a breach affecting your data.
• On the end of your subscription we destroy the one-way hashes of your administrators and allowed addresses. Your links and settings are kept so you can return without rebuilding; ask us at any point and we delete everything permanently instead. Export first either way.

International transfer

Data is processed on Cloudflare's network with a primary region in North America. As we hold no roster, no student or staff record leaves your own systems.

Signing

If your institution needs this as a countersigned document, ask via the contact form and we will provide one.

This is a plain-language draft provided in good faith and is not legal advice. For a binding agreement in your jurisdiction, have your own counsel review it.