Privacy Policy

1. Who this policy is from

This Privacy Policy describes how the business identified below (“we,” “us,” or “Keystone Apostille”) handles your information when you use our website and service.

2. Information we collect

We collect only what we need to process your order. In plain language, that includes:

• Your name, so we know whose documents we are handling.
• Contact information, such as your email address and phone number, so we can send order updates and reach you if there is a question.
• Shipping addresses, both the address you are sending from and the address we return your documents to, so we can create shipping labels.
• Order details, such as the documents in your order, the number of signatures, the destination country, and any options you choose.
• Payment information. Your payment is processed by our payment provider, Stripe. We do not store your full card number. Full card details are handled directly by Stripe and never touch our servers. We may keep limited references such as a confirmation that payment succeeded.
• Document images you choose to upload. Uploading a photo of your document is optional. If you do upload one, we store it securely and use it only as a record for your order.
• Basic website and device data, such as your general usage of the site, which may be collected through cookies or analytics tools (see the cookies section below).

3. Why we collect it

We use your information only to process your order and to run our service. Specifically, we use it to:

• Create and manage your order.
• Process your payment.
• Create shipping labels and track your documents both ways.
• Send you order related emails, such as your confirmation, a prepaid shipping label, status updates, and any action needed messages.
• Respond to your questions and provide customer support.
• Keep records for accounting, disputes, and legal compliance.

We do not use your information for unrelated marketing without your consent.

4. Who we share it with

We do not sell your personal information. We share it only with the service providers we use to run our business, and only so they can perform their function for your order. These providers act as our processors:

• Stripe processes payments.
• Shippo creates shipping labels, validates addresses, and provides tracking.
• Resend sends our transactional and order related emails.
• Supabase stores our order data and any document images you upload.

Each of these providers has its own privacy and security practices. We may also disclose information if required by law, such as in response to a valid legal request, or to protect our rights, our customers, or the public.

5. How long we keep your information

We keep order and account records for as long as we need them to run our business, to meet legal, tax, and accounting requirements, and to handle any disputes or chargebacks. After that, we delete or anonymize them.

Optional document images

Document images are treated with extra care. Any photo you choose to upload is stored in a private, access controlled location, never made public, and is reachable only by authorized staff through short lived, secure links. We automatically delete uploaded document images [X days] after your order is completed. That window is long enough to cover any dispute or chargeback, and short enough to limit how long sensitive images exist.

Placeholder to set: replace [X days] with your chosen retention window (for example, 90 days) and confirm it matches your internal settings.

6. How we protect your information

We use reasonable technical and organizational measures to protect your information. These include encrypted connections (HTTPS) across the site, access controls so that only authorized staff can view customer data, private storage for any uploaded document images, and reliance on established providers such as Stripe for payment handling so that sensitive card data stays out of our systems.

No method of transmission or storage is completely secure, so while we work hard to protect your information, we cannot guarantee absolute security.

7. Your privacy rights

Depending on where you live, you may have the right to ask us to:

• Access the personal information we hold about you.
• Correct information that is inaccurate or incomplete.
• Delete your personal information, subject to legal exceptions.

To make a request, contact us at the email address below. We may need to verify your identity before acting on your request. We will not discriminate against you for exercising these rights.

8. Cookies and analytics

Our website may use cookies and similar technologies to keep the site working properly and to understand how visitors use it. We may use an analytics tool such as Google Analytics to see general, aggregated information like which pages are visited and where visitors come from. Analytics data helps us improve the site and is not used to identify you personally.

You can usually control or block cookies through your browser settings, though some parts of the site may not work as well if you do.

Placeholder to confirm: confirm whether you use Google Analytics or another analytics tool, and update this section (and add a cookie banner if your jurisdiction requires consent).

9. Children

Our service is meant for adults and is not directed at children. We do not knowingly collect personal information from children. If you believe a child has provided us information, please contact us so we can remove it.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page. We encourage you to review it periodically.

11. Contact us

If you have questions about this Privacy Policy or about how we handle your information, please contact us using the details below.