Privacy Policy
1. Who we are
Key Factory Ltd (“Key Factory”, “we”, “us”) is the data controller for the personal data described in this policy.
- Company number: 15697073
- Registered office: 15 Park Avenue, Finchley, London, N3 2EJ
- Privacy contact: [email protected]
- ICO registration number: C2038791
2. What this policy covers
This policy applies when you use keyfactory.co.uk, the Key Factory apps for iPhone and Android, and our key scanning and cutting service, including when you contact us. It does not cover websites we link to but do not run.
3. The information we collect
| Category | What it is | Where it comes from |
|---|---|---|
| Key photographs | Photos of your key taken in the app or uploaded on the website, including the close-up of a mortice key’s bit. | You |
| The card in the photo | Our scanning method asks you to lay the key on a bank-card-sized card so we know the scale. We use only the card’s outline and size. We do not read, extract or store card numbers. We recommend using the back of the card, or a Key Factory scan card, so that no card details appear in the photo. | You |
| Key measurements | What our software works out from the photo: the type of key, the matching key blank, the cut code (bitting) and an outline used by the cutting machine. | Created by us from your photo |
| Account and contact details | Name, email address, phone number and password (stored as a secure hash) if you create an account. | You |
| Order and delivery details | What you ordered, delivery and billing address, order history and correspondence about the order. | You |
| Payment details | Payments are taken by Stripe. We receive confirmation of payment and the last four digits and type of card. We never see or store your full card number. | Stripe |
| Proof of identity and entitlement | Before your first scan we check your identity once, using a photo of your passport or driving licence. The name on the document is read automatically and compared with your account name. We do not keep a copy of your identity document: it is processed only for the check and then discarded, by both our website and our scanning platform. We keep only the outcome: that you were verified, the type of document and the date. For restricted and security keys we must also confirm you are entitled to a copy, so we ask for a photo of the key and of its ownership certificate or security card. Those two images are stored, encrypted, with your request so our team can review it. | You |
| Saved keys (“key wallet”) | If you choose to save a key for re-ordering, we keep its measurements under a label you choose. | You / created by us |
| App device identifier | When the app is first used it creates a cryptographic key inside your phone’s secure hardware and registers the public half with us. It identifies the app installation, not you, and lets us reject forged requests. We also use Apple App Attest and Google Play Integrity to confirm a request comes from a genuine copy of our app. | Your device, Apple, Google |
| Technical data | IP address, browser or device type, app version, and server logs of requests and errors. Cookies on the website are covered by our Cookie Policy. | Your device |
What we do not collect
- The apps ask for camera permission only. They do not access your location, contacts, microphone, photo library or advertising identifier.
- The apps do not track you across other companies’ apps or websites, and we do not sell personal data.
- We do not use your photos to train third-party AI models.
4. How we use your information and our lawful basis
| Purpose | Data used | Lawful basis (UK GDPR) |
|---|---|---|
| Identify your key, measure it and cut a duplicate | Key photographs, measurements | Performance of a contract (Art. 6(1)(b)) |
| Take payment, deliver your order, provide customer service | Account, order, delivery and payment details | Performance of a contract |
| Confirm you are entitled to a copy of a restricted or security key | Proof of identity and entitlement | Legitimate interests in preventing unauthorised key duplication; legal obligation where the key system requires it |
| Prevent fraud and misuse of the service, keep the platform secure | Device identifier, technical data, account details | Legitimate interests (Art. 6(1)(f)) |
| Improve the accuracy of our measuring software | Key photographs and measurements, with staff corrections. Not linked to your name or address for this purpose. | Legitimate interests |
| Keep accounting and tax records | Order and payment records | Legal obligation (Art. 6(1)(c)) |
| Send service messages about your order | Contact details | Performance of a contract |
| Send marketing, if you have opted in | Contact details | Consent (Art. 6(1)(a)). We only send marketing to customers who have agreed to receive it, and you can withdraw your consent at any time. |
5. Automated measuring and human review
Your key photo is measured by software, including machine-learning image analysis, to identify the blank and read the cuts. This is an aid to our staff, not a decision about you. A member of our team reviews each order before a key is cut and can correct the measurements. If we cannot read your key reliably we will ask you for another photo or contact you.
6. Who we share information with
We share personal data only with the suppliers who help us provide the service, under contracts that require them to protect it, and where the law requires.
| Recipient | What and why | Location |
|---|---|---|
| Stripe | Payment processing and fraud screening. | UK / EEA / USA |
| ANS Group | Hosts our servers and encrypted storage. | United Kingdom |
| OpenAI (API) | Some key photos are sent for image processing (removing shadows and producing a clean outline for the cutting machine). Images of identity documents are sent so the printed name can be read and compared. These are sent without your name, address or order details. Under OpenAI’s API terms this data is not used to train their models. Key Factory has accepted OpenAI’s Data Processing Addendum and has requested zero data retention. | USA |
| Google (Analytics) | Website usage statistics, only if you accept analytics cookies. | UK / EEA / USA |
| Google Ads and Meta | Measuring our advertising on the website, only if you accept marketing cookies. See our Cookie Policy. | UK / EEA / USA |
| Apple and Google | App attestation checks (App Attest, Play Integrity) and app distribution. They receive no key photos from us. | UK / EEA / USA |
| DPD | Name and delivery address, to deliver your order. | United Kingdom |
| Our email service provider | Sending order and account emails. | United Kingdom |
| Professional advisers, regulators, police | Where needed for legal advice, to meet a legal obligation, or to prevent or detect crime. | United Kingdom |
7. Transfers outside the UK
Some suppliers above process data in the United States or the EEA. Where personal data leaves the UK we rely on UK adequacy regulations (including the UK-US Data Bridge for certified companies) or the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses. You can ask us for details of the safeguard used for a particular supplier.
8. How long we keep information
| Information | How long | Why |
|---|---|---|
| Key photographs | Deleted automatically 30 days after the scan has been processed. | Long enough to cut, check and resolve any problem with the order. |
| Key measurements linked to an order | 12 months after the order, then deleted or anonymised. | To handle re-cuts, returns and complaints. |
| Saved keys (key wallet) | 12 months from when the key was last saved or refreshed, or until you delete it. | So you can re-order without scanning again. |
| Identity documents | Not kept. The document is discarded as soon as the check is done. A record that you were verified (document type and date) is kept with your account. | Evidence that the check was carried out. |
| Proof of ownership for security keys | The key photo and ownership certificate or security card are kept, encrypted, with your request and order record. | Evidence of entitlement, and to deal with any dispute about it. |
| Measurements used to improve accuracy | Kept without your name, address or order details. | Improving the software. |
| Account details | Until you close your account. Deletion requests are completed 30 days after the request, to allow for mistakes and open orders, after which the account is anonymised. | Providing your account. |
| Order, invoice and payment records | 6 years after the end of the financial year. | UK tax and accounting law. |
| App device identifier | Removed after 24 months without use, or when access is revoked. | Security of the service. |
| Server logs | 90 days. | Security and troubleshooting. |
| One-time login codes and security tokens | 7 days after expiry. | Security. |
9. How we protect your information
- Key photographs are encrypted when stored and are only decrypted for authorised staff and the measuring software.
- All traffic between the apps, the website and our servers is encrypted in transit (TLS).
- The apps contain no shared passwords or secret keys. Each installation proves itself with a key held in the phone’s secure hardware.
- Staff access to scans and orders is limited by role and protected by two-step sign-in.
- Key photographs and measurements are stored separately from customer names and delivery addresses, so a key image alone cannot be matched to an address.
No system is perfectly secure. If a breach is likely to put you at risk we will tell you and the Information Commissioner’s Office without undue delay.
10. Your rights
Under UK data protection law you have the right to:
- be told how your data is used (this policy) and get a copy of it;
- have inaccurate data corrected;
- have your data deleted, or its use restricted, in certain circumstances;
- object to processing based on our legitimate interests, and to direct marketing at any time;
- receive data you gave us in a portable format;
- withdraw consent where we rely on it.
How to use your rights
- If you have an account, you can download your data and request deletion from your account settings.
- If you used the app without an account, email us with the scan reference shown in the app, or the date and time of the scan, and we will find and delete it.
- Otherwise email [email protected]. We reply within one month. There is no charge.
11. Children
Our service is for adults. We do not knowingly collect data from anyone under 18. If you believe a child has used the service, contact us and we will delete the data.
12. Cookies
Our website uses cookies. See our Cookie Policy for what they are and how to control them. The apps do not use cookies or advertising trackers.
13. Changes to this policy
We will update this page when the way we handle data changes, and show the date below. If a change is significant we will tell account holders by email.
Last updated: 23 September 2026
14. Contact and complaints
Questions or requests: [email protected], or write to Key Factory Ltd, 15 Park Avenue, Finchley, London, N3 2EJ.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113. We would appreciate the chance to put things right first.
