This notice explains what personal information Key-Warden collects, why, and how it is handled. Key-Warden is a product of MYITANDAPPS PTY LTD (ABN 82 659 633 888), PO Box 7570, Redland Bay QLD 4165, Australia ("Key-Warden", "we", "us"). We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). If anything is unclear, email welcometo@key-warden.com.
On request, we provide vendors with a data processing agreement covering our processing on their behalf.
To provide, secure and support the service; enforce the licence rules a vendor sets; deliver licence keys and transactional messages; process payments you start; meet legal, tax and accounting obligations; prevent fraud and abuse; and improve the service using aggregated or de-identified data. We do not build advertising profiles.
Service emails. We send licence keys, invoices and receipts, renewal reminders, revocation notices, team invitations and platform notices. Renewal reminders go 30 days before an annual licence lapses, 5 days before a monthly one, and on expiry. They carry the vendor's branding, a renew link and a one-click unsubscribe; licences that auto-renew or are already renewed are not reminded. You can manage categories under Messages & email preferences in the customer portal. Opt-outs are always honoured.
Direct marketing. We send product news only to vendors, and every message includes a way to opt out. Transactional messages, such as licence keys and billing notices, are not marketing.
Legal bases (GDPR and UK GDPR). Where these laws apply, we rely on:
For vendors' customers, the vendor determines the legal basis, and we process on its instructions.
We use a small number of providers, acting on our instructions:
Our own records are stored in Microsoft data centres in Australia. Stripe, PayPal, Twilio and Microsoft's sign-in and email services operate globally, so limited information such as a checkout email, mobile number or sign-in details may be processed outside Australia, including in the United States and other countries where those providers operate. We take reasonable steps under APP 8, including contractual safeguards, for those disclosures.
Personal data is hosted in Microsoft Azure (Australia East). Where personal data of individuals in the EEA or UK is processed, international transfers rely on the applicable Standard Contractual Clauses, including those incorporated in Microsoft's, Stripe's and PayPal's data protection addenda. We enter into Standard Contractual Clauses with vendors and customers where required, as part of the data processing agreement referred to in section 1.
Pages on key-warden.com load scripts and assets from our own domain, with no third-party trackers, analytics or advertising. Checkout and payment pages run by Stripe or PayPal, and Microsoft's sign-in pages, are operated by those providers and may set their own cookies under their policies. Signing in to the dashboard sets a session cookie strictly to keep you signed in; it expires when the session ends. Open-source components are listed in our Open-source notices.
We use encryption in transit and at rest, per-vendor data segregation, Azure Key Vault for signing keys, server-side proxying so API keys are never exposed in the browser, and access limited to people who need it.
Vendor payment credentials (Stripe and PayPal API keys and webhook secrets) are never stored in plaintext. Each credential is encrypted with AES-256-GCM using a per-vendor key derived (HKDF) from a root key held in a dedicated, isolated Azure Key Vault. The encrypted blob is stored in Azure Table Storage, one row per vendor. Because the key is bound to the vendor, a blob cannot be decrypted under another vendor's context. The raw credential is used once to encrypt it and is never logged or stored in the clear.
No system is completely secure, and we cannot guarantee that information will never be accessed without authorisation.
Every data store, what it holds, how long it is kept, how erasure is handled and its legal basis are listed in our Data Retention & Erasure Register, available on request.
Erasure removes personal identifiers while keeping the de-identified records we are legally required to retain.
You can view and correct your details in the customer portal, manage your email preferences there, and request erasure yourself under Account & privacy. Erasure anonymises your personal information across the platform; financial records we must keep by law are retained in de-identified form. You can also ask for a copy of your data by emailing welcometo@key-warden.com. We will respond within 30 days. We may need to verify your identity, and may decline a request where the law allows. If you are a vendor's customer, we may refer your request to the vendor.
Where the GDPR or UK GDPR applies, you also have the right to restrict or object to processing, to data portability, and to withdraw consent, and you may complain to your local data protection authority.
Complaints. Email us first and we will respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).
If we become aware of a data breach, we will assess it promptly. Where it is an eligible data breach under the Notifiable Data Breaches scheme, we will notify affected people and the OAIC as the law requires, and tell affected vendors without undue delay so they can meet their own obligations. Where other laws apply, we will follow their notification requirements.
Key-Warden is a business service and is not directed at children. We do not knowingly collect personal information from children.
If we make material changes to this notice, we will update the date above and notify vendors by email or in the portal before they take effect.
MYITANDAPPS PTY LTD · ABN 82 659 633 888 · PO Box 7570, Redland Bay QLD 4165, Australia Email: welcometo@key-warden.com