The short version
- Our website sets no cookies and uses no analytics or advertising trackers.
- We use the information in our products only to provide those products to the organization that subscribes.
- We don't sell personal information, share it for advertising, or use it to train AI models.
- When an organization cancels, it has 30 days to export its data. Then we permanently delete it.
- Questions or requests go to support@underhillsystems.com, and a person answers.
Who we are
Underhill Systems LLC ("Underhill Systems", "we", "us") makes Keystone Desk, Waystone Learn and Waystone Studio, and runs underhillsystems.com.
Our products are used by organizations (our customers) for their own staff. For the information inside the products, the customer decides what goes in and who can see it, and we handle it on the customer's behalf. If you use one of our products through your employer, your employer's own privacy notice applies too, and they're usually the best first contact for questions about your data.
Visiting our website
- No cookies, analytics or tracking. We don't use Google Analytics, advertising pixels, session recording or anything like them.
- Fonts. The site loads its fonts from Google Fonts, so your browser sends your IP address to Google when the page loads. Google's privacy policy covers that.
- Hosting logs. Our hosting provider, Microsoft Azure, keeps standard request logs (such as IP address, page requested and time) to run and protect the service.
- The contact form. If you send it, we receive your name, work email, company (optional), the topics you pick, your timeline (optional) and your message. We use them only to reply to you and to follow up about what you asked. Your IP address is used briefly to limit spam and isn't stored with your message.
Using our products
To provide the products, we handle the following on our customers' behalf:
| Sign-in | People sign in with their Microsoft work account. We receive who they are from Microsoft; we never see or store passwords. |
|---|---|
| Directory details | From the customer's Microsoft Entra ID: name, work email and user name. Waystone also reads department, job title, office, hire date, manager and group membership, to build reports and assign training. The exact list. |
| Keystone Desk | Tickets, replies and notes, attachments, equipment records and help articles. If the customer connects a help desk mailbox, the email sent to that one mailbox (and only mail received after it's connected) becomes tickets. Keystone can't reach any other mailbox. Teams alerts go to the customer's own Microsoft Teams. |
| Waystone Learn | Courses and files the customer uploads, enrollments, progress, quiz answers, scores, certificates and compliance records. |
| Waystone Studio | For practice calls: the audio recording, the transcript and the coaching scorecard. The microphone is only used after the browser asks the person for permission. |
| Activity | Audit logs of administrative changes, and the emails our products send (such as reminders, replies and reports). |
We use this information only to run the products for the customer, keep them secure, and fix problems. To spot problems early, our own staff tools receive counts and dates from each customer's product (for example, how many people have signed in, and whether reminders are going out), never the content itself. If someone sends us a support request, we see what they choose to include.
Customer accounts and billing
For the organizations that subscribe, we keep account and billing contact details (names, work emails, company name and subscription history), and a record of who accepted our terms, when, from which IP address, and which version. Online card payments will be handled by Stripe when they open; until then we invoice customers directly. We never see or store full card numbers.
AI features
Keystone Desk's Underhill AI and Waystone Coach run on Microsoft Azure OpenAI in our own Azure account, in Microsoft's East US 2 region. When someone uses an AI feature, only what that feature needs is sent, for that one request: for example, the ticket being worked on and matching help articles, the description of a course to draft, or a practice call's audio and transcript.
Microsoft doesn't use this data to train its models (Microsoft's statement), and neither do we. Replies, courses and role-plays that the AI drafts are reviewed by a person before they're sent or published. During a practice call, the AI buyer answers live; that's the point of the practice.
Where data is stored
Product data is stored in Microsoft Azure in the United States (North Central US), encrypted at rest and sent over encrypted connections (HTTPS). AI requests are processed in Azure's East US 2 region. If you're outside the United States, your information is transferred to and processed in the United States.
How long we keep data
- While a customer subscribes, product data is kept until the customer's administrators delete it.
- When a customer cancels, they have 30 days after service ends to export what they need. Then we permanently delete all of that customer's product data: every record, file, call recording and transcript.
- Contact form messages are kept while we're talking with you and following up. Ask us and we'll delete yours.
After a customer's data is deleted, we keep only these records:
| Trial record | Your organization's Microsoft tenant ID, which product was trialed, and when. It has no personal information and stops the same organization starting a second free trial. |
|---|---|
| Cancellation feedback | The reasons given for cancelling, with the name of the person who gave them removed, so we can improve our products. |
| Deletion record | An internal ID for the customer and the date its data was deleted, so we can show that it happened. |
| Payment records | Invoices and payment history in our accounts (and at Stripe, for card payments), for as long as tax and accounting law requires. |
Your choices and rights
You can ask us what personal information we hold about you, ask us to correct it, or ask us to delete it. Email support@underhillsystems.com. We'll confirm who you are, then answer within 30 days. We won't treat you any differently for asking.
If the information is in one of our products, it belongs to your employer's account, so we'll pass your request to them and help them handle it. Depending on where you live, you may have further rights under local law, including complaining to your data protection authority.
Security
People sign in to our products with their Microsoft work account, each customer's data is kept separate from every other customer's, and our products ask for the least access to Microsoft 365 that each feature needs. The details are in our Trust Center. No system is perfectly secure; if a breach affects your information, we'll tell the affected customers promptly.
Children
Our website and products are for businesses and aren't meant for children under 16. We don't knowingly collect their information.
Changes to this policy
When we change this policy, we'll update the effective date at the top. If a change affects how we use customer data, we'll email our customers' administrators before it takes effect.
Contact us
Underhill Systems LLC
support@underhillsystems.com