Privacy policy

The short version

• No database of our own: your account is created and kept by Privy, our login provider.
• No analytics, no tracking, no ads. Keysfirst itself sets no cookies; Privy sets cookies to keep you logged in.
• Your password, card details and account keys never reach us.
• Deals are written to a public blockchain, where nobody (not even us) can change or delete them. Keep personal details out of them.

Who is responsible

The controller under the GDPR is Guido Andreini, [Street and house number], [Postcode and city], Germany. Email: info@keysfirst.io. See also the legal notice.

Visiting the website

The site is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you open a page, Vercel's servers process your IP address, the date and time, the page requested, and your browser and operating system, and keep them in server logs for security and error-finding. We don't combine these logs with other data.

Legal basis: our legitimate interest in running a secure, working website (Art. 6(1)(f) GDPR). Vercel processes the data on our behalf under a data processing agreement (Art. 28 GDPR) and is certified under the EU-U.S. Data Privacy Framework, which the EU Commission recognises as adequate protection (Art. 45 GDPR). More: Vercel's privacy notice (opens in a new tab).

Fonts are served from our own server. Your browser does not contact Google or any other font service.

Cookies and browser storage

Keysfirst itself sets no cookies. Our login provider Privy sets two cookies (“privy-token”, “privy-session”) and several local-storage entries starting with “privy:” to keep you logged in. Keysfirst also uses your browser's storage to remember an unfinished card payment for a deal (“keysfirst:card:…”) and that your account's network costs were covered this session (“keysfirst:gas:…”). This is strictly necessary for the service you asked for, so it needs no consent (§ 25(2) no. 2 TDDDG). It stays on your device; clearing this site's data in your browser removes it.

Logging in

You log in with your email address or Google, or with your own Solana wallet such as Phantom. Login is provided by Privy (Privy, Inc., USA), which receives your email address or the account you log in with, creates your Solana wallet and keeps its keys protected. Keysfirst never sees your keys, and the site only signs the steps you confirm with a button. Keysfirst receives your email address from Privy only to show it in the header, and your public account number.

Legal basis: Art. 6(1)(b) GDPR (providing the service you asked for). Privy is based in the USA, so your login data is processed there. How Privy protects transfers from the EU is described in Privy's privacy policy (opens in a new tab).

Card payments

Card payments are processed by Stripe (Stripe Payments Europe, Ltd., Ireland) in test mode. You enter your card details on Stripe's own page; Keysfirst never sees them. Stripe tells us whether the payment succeeded, the amount, and the deal and account number the payment belongs to.

Legal basis: Art. 6(1)(b) GDPR (providing the service you asked for). More: Stripe's privacy policy (opens in a new tab).

Reading and sending deals

To show deals and send the payments you approve, your browser talks directly to a Solana access service (an “RPC provider”): Helius Labs, Inc., USA. Helius receives your IP address, your wallet address and the requests your browser makes. Legal basis: providing the service you use (Art. 6(1)(b) GDPR). More: Helius's privacy policy (opens in a new tab).

When you log in, pay by card or approve the handover by scanning the landlord's code, your account number is sent to our server so it can cover network costs, prepare your deposit or build the handover request.

What is public on Solana

Each deal is recorded on Solana's test network (devnet), a public blockchain: the landlord's and tenant's wallet addresses, the amount, the dates, the room title the landlord typed and every status change. Anyone can read these records, they are copied to computers worldwide, and nobody (including us) can change or delete them. Your rights to correction and deletion therefore can't be carried out for data on the blockchain. Wallet addresses don't show your name, but they become personal data if someone can link them to you.

That's why the room title must never contain names, street addresses, phone numbers or other personal details. A title like “Room in Vallendar, 14 m²” is enough. Legal basis: carrying out the deal you start (Art. 6(1)(b) GDPR).

Links to other sites

Links to Solana Explorer, LinkedIn and other sites open those sites only when you click them. From then on their own privacy policies apply. Keysfirst embeds no content from them.

Your rights

You have the right to:

• access to your data (Art. 15 GDPR)
• correction (Art. 16)
• deletion (Art. 17)
• restriction of processing (Art. 18)
• data portability (Art. 20)
• objection to processing based on legitimate interests (Art. 21)

To use them, email info@keysfirst.io. You can also complain to a data protection supervisory authority, for example the one in the German state or EU country where you live (Art. 77 GDPR).

You don't have to give us any data. Without logging in you can read the site, but you can't create or pay a deal.

Changes

If Keysfirst changes what it processes, this page changes too. The date at the top shows the latest version.