Privacy Policy

1.1 Account information

When you create a Knowra account we collect your name, email address, and any other information you provide during registration. If you sign up using a third-party authentication provider, we receive the information that provider shares with us, typically your name and email address.

1.2 Workspace and billing information

We collect your workspace name and organisation details. Payment processing is handled entirely by Paddle, our Merchant of Record. We do not collect or store your credit card number or other payment card details. Paddle provides us with limited transaction information including your subscription plan, payment status, and billing country.

1.3 Document content

When you connect a cloud storage source (Google Drive, Microsoft OneDrive, or Dropbox), Knowra accesses and processes the files in the folders you select. We extract text content from your documents, split it into chunks, and store those chunks alongside their vector embeddings in our database. We also store the original files temporarily for processing purposes.

Your document content is used solely to provide the knowledge base search functionality. It is never used to train any AI model, shared with third parties, or used for any purpose other than responding to your team's queries through the MCP endpoint.

1.4 Query logs

We log MCP search queries made by your team members, including the query text, which document chunks were returned, response latency, and the timestamp. These logs are used to provide your analytics dashboard and to improve search quality within your workspace.

1.5 Usage data

We collect information about how you use the Service, including pages visited, features used, actions taken in the dashboard, and session duration. This information is collected using Google Analytics.

1.6 Communications

If you contact us by email we retain the content of that communication and your email address to respond to your enquiry and maintain records of our correspondence.

We use the information we collect to:

• Provide, operate, and maintain the Service
• Process and manage your subscription and billing through Paddle
• Send transactional emails including account verification, invitation emails, MCP token delivery, trial expiry notifications, and billing receipts
• Send marketing and product update emails where you have consented or where we have a legitimate interest — you may unsubscribe at any time using the link in any marketing email
• Provide your analytics dashboard showing query usage and team activity
• Respond to your support requests and enquiries
• Monitor and improve the performance and security of the Service
• Comply with our legal obligations

3.1 Google Analytics

We use Google Analytics on our marketing site at www.knowra.io to understand how visitors find and use our site. Google Analytics collects information such as your IP address, browser type, pages visited, and time spent on pages. This data is processed by Google in accordance with Google's Privacy Policy.

You can opt out of Google Analytics tracking by installing the Google Analytics opt-out browser add-on available at https://tools.google.com/dlpage/gaoptout.

3.2 Essential cookies

The Service uses essential cookies required for authentication and session management. These cookies are strictly necessary for the Service to function and cannot be disabled.

3.3 Cookie consent

On your first visit to www.knowra.io you will be shown a cookie consent banner. You may accept or decline non-essential cookies. Declining does not affect your ability to use the Service.

4.1 Where your data is stored

Your data is stored on servers provided by Railway (database and application hosting). If you upload a file as a "retained" manual upload source, the original file is additionally stored in Cloudflare R2 as the durable copy for that document; documents indexed from a connected cloud provider (Google Drive, OneDrive, Dropbox) or from an "ephemeral" manual upload source are not stored as files — only their extracted text and embeddings are retained in our database. These services are located primarily in the United States. By using the Service you consent to your data being transferred to and processed in the United States.

4.2 Security measures

We implement the following security measures to protect your data:

• OAuth access tokens for your cloud storage connections are encrypted at rest using AES-256-GCM encryption before being written to our database. Raw tokens are never stored.
• All data transmitted between your browser and our servers is encrypted using TLS.
• Each workspace is completely isolated — no data from your workspace is accessible to any other Knowra customer.
• MCP tokens are unique per user and access is scoped to the workspace of the issuing member.
• Access to production systems is restricted to authorised personnel only.

4.3 Data retention

We retain your account data and document content for as long as your account is active. If you cancel your subscription and close your account, we will delete your workspace data including all indexed documents and chunks within 30 days of account closure, unless we are required to retain it by law.

Query logs are retained for 12 months from the date of the query and then deleted.

Each Knowra workspace is completely isolated. We do not share your documents, query logs, or any workspace data with any other Knowra customer or with any third party except as described in this policy.

We do not sell your personal information or your document content to any third party under any circumstances.

We share limited information with the following third-party service providers to operate the Service:

• Paddle — Payment processing and subscription management. Paddle is our Merchant of Record and processes all payments on our behalf. Paddle's privacy policy is available at paddle.com.
• Clerk — User authentication and identity management. Clerk processes your login credentials and session tokens. Clerk's privacy policy is available at clerk.com.
• Railway — Application and database hosting.
• Cloudflare — Original file storage via Cloudflare R2, for "retained"-mode manual upload sources only.
• Google — Embedding model (Google text-embedding-004) used to convert your document text into vector representations for semantic search. Document text sent to Google's API for embedding is not retained by Google for training purposes under the terms of the Google Cloud API.
• Resend — Transactional email delivery.
• Mailchimp — Marketing email delivery where you have consented to receive marketing communications.
• Google Analytics — Website analytics on www.knowra.io.

We do not permit these service providers to use your information for any purpose other than providing services to us.

7.1 Australian Privacy Act

As an Australian company we comply with the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs). You have the right to:

• Request access to the personal information we hold about you
• Request correction of inaccurate personal information
• Make a complaint about our handling of your personal information

To exercise these rights, contact us at privacy@knowra.io.

7.2 GDPR rights (European users)

If you are located in the European Economic Area, you have the following additional rights under the General Data Protection Regulation (GDPR):

• The right to erasure ("right to be forgotten")
• The right to data portability
• The right to restrict processing
• The right to object to processing
• The right to withdraw consent at any time where processing is based on consent

To exercise any of these rights, contact us at privacy@knowra.io. We will respond to your request within 30 days.

7.3 Data deletion

You may delete your workspace, documents, and account at any time from within the Knowra dashboard. Upon deletion, your data is removed from our active systems within 30 days. You may also request deletion by contacting privacy@knowra.io.

The Service is intended for use by individuals aged 18 years and over. We do not knowingly collect personal information from anyone under 18. If you become aware that a minor has provided us with personal information, please contact us at privacy@knowra.io and we will delete that information promptly.

Where you have provided consent or where we have a legitimate interest, we may send you emails about product updates, new features, tips for using Knowra, and relevant industry content.

Every marketing email we send includes an unsubscribe link. You may unsubscribe at any time and your request will be processed within 10 business days. Unsubscribing from marketing emails does not affect transactional emails which are necessary for the operation of your account.

We may update this Privacy Policy from time to time. When we make material changes we will notify you by email to the address associated with your account and update the "Last updated" date at the top of this page. Your continued use of the Service after notification of changes constitutes your acceptance of the updated policy.

For privacy enquiries, data access requests, or complaints:

Email:

privacy@knowra.io

Post:

Concentric Digital, 43A Wandana Ave, Gilles Plains, SA 5086, Australia

If you are not satisfied with our response to a privacy complaint, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.