Privacy Policy

The controller for the processing described here is:

We are not required to appoint a data protection officer. Questions about privacy and requests to exercise your rights go to the contact above.

For personal data inside documents that owners upload to their knowledge bases, the owner is the controller and we process that data on the owner's behalf (see section 3.3 and the data processing terms in the Terms of Service). If you want to exercise your rights regarding such content, contact the owner of the knowledge base or tell us and we will forward your request.

• We collect what we need to run your account and your knowledge bases: your email, a public username, your documents, and records of how the API is used.
• We do not store raw IP addresses or the text of search queries in our database, and our application logs never contain document content, API keys or emails.
• We use no advertising or analytics cookies and do not track you across sites. We do not sell personal data.
• Document text is sent to an AI provider to be scanned and to an embedding provider to make it searchable. Search queries are sent to the embedding provider and then discarded.
• Our database and files are hosted in the EU (Ireland). Some providers are based in the US; transfers are covered by the safeguards in section 6.
• You can delete documents, knowledge bases and your whole account yourself at any time.

Legal bases refer to Art. 6(1) GDPR: (b) performance of a contract with you, (c) a legal obligation, (f) our legitimate interests, which we name in each case. Where we rely on (f) you may object (section 9).

3.1 Visiting the website and calling the API

Every request reaches our hosting providers (Vercel for the website and API, Supabase for the database). They process technical data needed to deliver it: IP address, date and time, URL, HTTP status, user agent and referrer, and keep it in their request logs for a short period (typically up to 30 days) to operate and secure their infrastructure. Purpose: delivering the Service, security and fault analysis. Basis: (f), our interest in a working, secure service; (b) for signed-in users.

3.2 Your account

• Email and password (stored only as a hash) for sign-in, or, when you sign in with Google, your email, name, profile picture URL and Google account id as Google provides them. Basis: (b).
• Username: generated at sign-up and changeable. It is public by design: it is part of every knowledge base address (owner/kb), and it is shown to the teams of knowledge bases you are a member of, request access to or hold keys for. Previous usernames are kept so old links keep working and nobody else can take them. Basis: (b).
• Display name (optional) and account type (individual or business). The display name is shown next to your public knowledge bases in the catalog, nowhere else. Basis: (b).
• Audit entries of important actions (for example creating a key, deleting a document, changing access rules) with your user id. Purpose: security and accountability. Basis: (f), our interest in tracing misuse and resolving disputes.

3.3 Knowledge bases and documents

We store the files you upload, their names, types and sizes, the extracted text split into passages, and numeric embeddings of the passages. Each new upload is scanned (see section 8); the scan report keeps short excerpts (up to 200 characters) of flagged passages and your review decisions. Settings of a knowledge base (name, description, visibility, access rules, sample queries) are stored with it.

For your own account data in this context the basis is (b). Personal data of other people inside your documents is processed on your behalf as your processor (GDPR Art. 28); you need your own legal basis to upload it.

3.4 Members, access requests and connected apps

• Members and invitations: which knowledge bases you belong to, your role, who invited you and when.
• Access requests to gated knowledge bases: your request, an optional message (up to 500 characters) and the owner's decision. The owner and admins of that knowledge base see your username and message.
• Connected apps (MCP clients you allow through OAuth): the app's self-declared name and redirect address, your consent with its time and last use, and hashes of the codes and tokens issued; and which knowledge bases you connected to your agents.

Basis: (b).

3.5 API usage records

For every call to the REST API or an MCP server we record: the knowledge base, the API key or user and app, the tool used, outcome, HTTP status, number of results, response time, a one-way hash of the normalised query, and a keyed hash of your IP address whose key changes every 30 days. We do not store the query text, the results or your IP address. Rate-limit counters use your key or user id, or a keyed hash of the IP address and email for sign-in and the contact form.

Purposes: enforcing rate limits, quotas and access rules, counting your plan's allowance, detecting abuse, and showing owners how their knowledge bases are used. Owners and admins of a knowledge base see the usage rows for it, including the username of the key holder or user and the app id, but not your query. Basis: (b) for limits and the plan allowance; (f) for abuse detection and owner statistics, our and the owners' interest in secure and transparent access to their content.

3.6 Plan and subscription

Card details are entered on Stripe's pages and never reach us. We store your plan (Free or Pro), your Stripe customer and subscription ids, the subscription's status and billing period, whether it is set to cancel, and when Stripe last reported a change. The units you used are counted from the usage records (section 3.5). When you first start an upgrade, we send Stripe your user id and email; invoices and payment records are kept in Stripe. Basis: (b); keeping accounting records is (c), § 132 of the Austrian Federal Fiscal Code (BAO) and § 212 of the Commercial Code (UGB).

3.7 Reports and contact requests

When you use the report and contact form we store the type and category of your request, what it is about, your email, your message and, if you are signed in, your user id. Purpose: handling your request, including notices under the Digital Services Act. Basis: (c) for notices we must process under the DSA, otherwise (f), our interest in answering you and keeping the Service lawful. We may share the substance of a notice, but not your identity unless you agree or the law requires it, with the user whose content it concerns.

3.8 Emails

We send emails needed for your account (sign-up confirmation, sign-in links, password resets) and important notices about the Service or these policies. Basis: (b). We do not send marketing emails.

We use only what is strictly necessary to provide the Service you request, which needs no consent under § 165(3) of the Austrian Telecommunications Act (TKG 2021). There are no analytics, advertising or third-party tracking cookies.

Stripe sets its own cookies on its checkout and billing portal pages, and Google on its sign-in page; their policies apply there.

Service providers (processors)

They process data only on our instructions under data processing agreements (GDPR Art. 28).

Independent controllers

• Stripe (Stripe Payments Europe, Ltd., Ireland) processes payments under its own privacy policy, including the checks required by anti-money laundering law.
• Google (Google Ireland Ltd.) when you choose to sign in with Google.
• MCP clients and AI assistants you connect receive the search results and documents of the knowledge bases you allow, under their providers' terms.

Other users

Your username is public. The display name of a public knowledge base's owner is shown in the catalog. Teams of a knowledge base see the usernames of members, of people who request access and of key holders, plus usage rows as described in section 3.5.

Authorities and advisers

We disclose data to courts, authorities or law enforcement only where the law requires it, and to our tax advisers and auditors as far as needed for accounting.

Where a provider processes data in the US or another country without an adequate level of protection, the transfer relies on the EU–U.S. Data Privacy Framework (adequacy decision of 10 July 2023) if the provider is certified, and otherwise on the EU Standard Contractual Clauses (Commission Decision 2021/914), with additional measures such as encryption in transit. You can ask us for a copy of the safeguards.

Deleting a document, knowledge base or account removes its files from storage first and then the database rows; search stops finding the content immediately. Backups kept by our database provider are overwritten within their retention cycle.

• Encryption in transit (HTTPS/TLS) everywhere and encryption at rest by our providers.
• Row-level security in the database: every query made for a user can only reach that user's data and the knowledge bases they belong to; cross-tenant access is covered by automated tests.
• Documents live in private storage; uploads use short-lived signed links.
• API keys and OAuth tokens are stored only as hashes; you see a key once when you create it.
• IP addresses are stored only as keyed hashes, and rate limiting uses keyed hashes of IP addresses and emails; application logs contain ids, counts and error codes only.
• Uploaded content is treated as untrusted data: it is parsed and stored, never executed, and is delivered to agents inside clear delimiters.
• Access to production systems is limited to the operator.

The content scan automatically decides whether a document is published, held for the owner's review or blocked, using rules and an AI classifier. It assesses the text of documents, not people, and we do not profile users. Rate limits and quotas also apply automatically. If an automated decision affects you, you can ask for a review by a person at legal@knowjack.io or the contact form. We do not make decisions based solely on automated processing that produce legal effects concerning you within the meaning of Art. 22 GDPR.

Under the GDPR you have the right to:

• access the data we hold about you and get a copy (Art. 15);
• have inaccurate data corrected (Art. 16);
• have data erased (Art. 17), which you can do yourself by deleting your account;
• restrict processing (Art. 18);
• receive data you gave us in a machine-readable format (Art. 20);
• object at any time to processing based on our legitimate interests, on grounds relating to your situation (Art. 21);
• withdraw consent with effect for the future, where we asked for it.

Write to legal@knowjack.io or the contact form. We answer within one month and may ask you to confirm your identity, for example by writing from your account's email.

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU country where you live or work. In Austria that is the Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, Austria.

An email address is required to create an account; without it we cannot provide the Service. Everything else (display name, documents, payments) is up to you. Technical data in section 3.1 is necessary to deliver any web page.

The Service is for adults (18+). We do not knowingly collect data of children; if you believe a child has created an account, tell us and we will delete it.

We update this policy when our processing changes. The effective date is at the top. We announce material changes, including new processors, at least 30 days in advance by email or in the dashboard.