Privacy policy — KeyStone

1. Data controller

Data controller: A natural person. Their full identity — name, identity document and tax details — is not published on this site, for the reasons set out in the “Who I am” section of the home page: in a field where impersonation is the commonest fraud, a public name attached to a recovery service ends up used as a front by other people. It is provided in full to any client before engaging, on a video call with the document in view, and to any authority that requires it.
Contact and rights requests: keystonecontact@llimalabs.com

No data protection officer has been appointed, as none of the cases in article 37 GDPR applies.

2. What data is processed and where it comes from

All data comes from you, either by writing or by filling in the case study form. No lists are bought, browsing is not tracked and nothing is collected behind your back: no analytics, no profiling, no cookies.

From the case study form: your email — the only required field — and whatever you choose to tell me in the rest: wallet type, what you lost, what you remember, how you could prove ownership, approximate value and the file’s technical parameters. It is stored in a database hosted on the same server as this site, under my sole control, and only I have access. The form detects and refuses recovery phrases and private keys: if you type them by mistake, the submission fails and nothing is stored.
From your email: your email address, the name you sign with, the message content and any attachments you choose to send.
From the case description: technical data (wallet type, application, dates, public addresses) and whatever you tell me about how access was lost. It may include personal data if you include it.
From the proof of ownership: records, screenshots or documents you choose to provide. Only what is necessary, and kept no longer than strictly needed.
If there is a contract: full name, identity document and address, to identify the parties; and billing details where the case generates an invoice.
If there is a video call: your image and voice during the call. Nothing is recorded unless both parties agree in writing.

Your recovery phrase, your private keys and your passwords are not data I ask for or want to receive by email. If sensitive material has to be worked on, an encrypted procedure is agreed in writing beforehand, described in how I handle your material.

3. Purposes and legal bases

Answering your enquiry and assessing feasibility: Your consent, given when you write to me, and the legitimate interest in responding to your own request (art. 6(1)(a) and 6(1)(f) GDPR).
Performing the recovery contract, if there is one: Performance of a contract to which you are party (art. 6(1)(b)).
Invoicing and tax obligations: Compliance with legal obligations (art. 6(1)(c)).
Defence against claims: Legitimate interest, limited to what is necessary and to the limitation period (art. 6(1)(f)).

There is no automated decision-making or profiling. Your data is not used for advertising, nor shared with anyone for commercial purposes.

4. How long data is kept

Enquiries and form submissions that do not lead to a contract: deleted after six months, or as soon as you ask me to delete them, if you ask sooner. Deletion is real: the row disappears from the database.
Technical case material (files, fragments, copies): destroyed when the work ends or is abandoned, confirmed to you in writing with a date.
Contract and billing records: kept for as long as tax and commercial law requires (up to six years).
Proof of ownership: kept for the duration of the case and, where there was a contract, alongside the file, because it is what shows the work was legitimate.

5. Who else can see your data

Nobody I hand them to voluntarily, with two exceptions you should know about:

The email provider. The contact mailbox is a Gmail account, from Google, which acts as the email service provider and stores messages on its infrastructure, with international transfers covered by the applicable adequacy decision and standard contractual clauses. If you would rather not route through it, say so in your first message and we agree another channel, including encrypted email with a public key.
Authorities and courts, where there is a legal obligation to provide information. Nothing else is shared, with nobody else.

This site uses no analytics services, ad networks, tracking pixels, embedded maps or videos, and no third-party typefaces: everything — fonts included — is served from the same server, so opening the page makes no request to any outside domain.

6. Cookies and local storage

This site installs no cookies. The only thing it stores in your browser is your theme preference (light or dark), in localStorage, and only if you press the theme button. That value is never transmitted to any server, identifies nobody, and disappears when you clear the site’s data in your browser. That is why there is no consent banner: there is nothing to consent to.

7. Your rights

You may exercise at any time your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent without affecting the lawfulness of prior processing. Write to keystonecontact@llimalabs.com stating which right you are exercising; I will reply within one month at the latest.

If you believe the processing does not comply with the rules, you may complain to the Spanish Data Protection Agency (aepd.es). Before that, if you like, write to me: it is faster and usually enough.

8. Security and minors

The specific technical measures protecting a case’s material are set out in how I handle your material: encryption at rest, the minimum number of copies, work on controlled infrastructure and verified destruction at the end.

The service is not aimed at minors, and cases involving minors are not accepted without the involvement of their legal representatives.

9. Changes to this policy

If it changes, the update date above changes with it. Changes affecting processing already under way are communicated by email to anyone with an open case.