Privacy Policy - How KnowDesk Protects Your Data

1. Who We Are

KnowDesk is operated by KnowDesk Inc., a corporation incorporated in the State of Delaware, United States, with its principal mailing address at 1908 Thomes Avenue, Cheyenne, WY 82001, United States. References to "KnowDesk", "we", "us", or "our" in this policy refer to KnowDesk Inc.

We are the data controller for personal data collected through our website (knowdesk.io) and platform. For questions about this policy, contact us at [email protected].

2. What Data We Collect

2.1 Account data

• Email address and password (hashed, never stored in plain text)
• Company name and website URL
• Billing name and address (via Stripe - we never store card numbers)

2.2 Usage data

• Conversation logs - messages sent to and received from your AI widget
• Knowledge source metadata (file names, sync status, character count)
• Widget configuration settings (brand name, colour, tone)
• Dashboard activity (pages visited, features used)
• Session recordings and heatmaps (only if you allow analytics cookies): clicks, scrolls, mouse movements and the pages you visit on knowdesk.io, your dashboard and the partner portal, collected with Microsoft Clarity. Passwords and form entries are hidden, and so is the content of dashboard and partner pages (such as conversations, knowledge and earnings)
• Website statistics (only if you allow analytics cookies): pages viewed, how you arrived, approximate location from your IP address and device type, collected with Google Analytics
• Product analytics (only if you allow analytics cookies): the pages you view and the buttons and links you click on knowdesk.io and in your dashboard, how you arrived (including campaign links), your browser, device and IP address, and - once you sign in - your account id, email address, name, plan and workspace name, collected with HeyCatch. Text you type into forms is not collected
• Account milestones: when you sign up, start or cancel a subscription, change plan or make a payment, our servers send HeyCatch a short record of it (your account id, email address, plan and the amount paid), so we can understand how customers move from trial to paid plans. You can object to this at any time by contacting us
• Advertising measurement (only if you allow marketing cookies): the pages you view on knowdesk.io and whether you sign up, start a trial or buy a plan, sent to Meta through the Meta Pixel and the Meta Conversions API
• Page speed measurements (only if you allow analytics cookies): how quickly pages load and respond, the type of page (for example "blog article", never the full address), whether you use a phone or a computer, and your connection type. Stored without any identifier and kept for 90 days. Combined figures are shown on our public status page
• Message counts used against your monthly plan limit

2.3 Technical data

• IP address (collected by Cloudflare for security and rate limiting)
• Browser type and version
• Device type and operating system
• Referring URL and pages visited on knowdesk.io
• Cookie identifiers (see our Cookie Policy for details)

2.4 Data you upload

When you connect knowledge sources, the content of those documents (Google Docs, PDFs, pasted text) is stored encrypted in our database and used solely to generate responses in your AI widget. We do not read, analyse, or use this content for any other purpose.

2.5 Calls (Huddle)

Businesses using KnowDesk can talk to their team and to their own customers by voice: free calls in the browser (from a secure link or the website widget) and calls to phone numbers. For a business's customers, KnowDesk processes this data on the business's behalf, as its processor.

• Call audio is carried live between the people on the call and is not stored, unless the business records calls and the customer agrees
• Recordings and transcripts: made only when the business switches them on and the customer agrees first (a question on the call page, or a spoken notice on phone calls). If the customer says no, the call goes ahead without them
• From transcripts, AI writes suggested answers for the agent during the call, and a summary and quality score saved to the conversation afterwards
• Call details: who took part, when, for how long, the phone number dialled and the minutes charged to the business's voice wallet
• The customer's call page sets no cookies. It keeps one key in that browser tab so a dropped call can reconnect; it is gone when the tab closes
• Browser calls are encrypted in transit (WebRTC with DTLS-SRTP). Calls can't reach emergency services

3. How We Use Your Data

4. Data Sharing

We do not sell, rent, or trade your personal data. We share data only with the following trusted sub-processors, each operating under GDPR-compliant data processing agreements:

If a business chooses LiveKit for its calls, call audio goes through the LiveKit server that business set up (its own, or LiveKit Cloud under its own agreement with LiveKit).

4.1 Advertising partner

If you allow marketing cookies, we use the Meta Pixel and the Meta Conversions API (Meta Platforms Ireland Ltd. / Meta Platforms, Inc.) to measure which of our Facebook and Instagram ads lead to visits, sign-ups and purchases, and so Meta can show our ads to people who have visited our website. Meta receives the pages you view, these events, your IP address, browser details and Meta cookie identifiers. For this, Meta acts as a joint or independent controller under its own terms and privacy policy (facebook.com/privacy/policy). Nothing is sent to Meta unless you allow marketing cookies, and you can withdraw that choice at any time in Cookie Settings. We do not send Meta your conversations, the content of your dashboard or your knowledge sources.

4.2 Requests from public authorities

We do not give public authorities access to personal data unless the law requires it. When we receive a request from a government, regulator, court or law enforcement agency, including for data we receive from Meta (Facebook, Instagram and WhatsApp):

• We review every request, with legal advice, to check that it is valid, lawful and made by an authority with the power to make it.
• We challenge any request we consider unlawful, too broad or not properly made, and we use the legal remedies available to us.
• We disclose only the minimum data the request legally requires, and nothing more.
• Unless the law forbids it, we tell the affected business or person before we disclose their data, so they can object.
• We keep a record of each request, our response, the legal reasoning and the people involved.

5. Data Retention

• Account data: retained for the lifetime of your account, plus 30 days after deletion
• Conversation logs: retained while your account is active so your team can review past conversations and analytics; deleted when your account is deleted, or earlier on request
• Knowledge source content: deleted immediately when you remove a source
• Call recordings: deleted automatically after the period the business sets (1 to 365 days; 30 days unless changed)
• Call transcripts, summaries and call details: kept with the conversation they belong to, and deleted with it
• Secure call links: work once and stop working after they expire (30 minutes unless the business changes it)
• Billing records: retained for 7 years (legal requirement under Portuguese/EU tax law)
• Technical logs: retained for 90 days
• Session recordings (Microsoft Clarity): kept for up to 30 days; aggregated heatmaps and usage statistics for up to 13 months
• Google Analytics data: kept for 14 months
• HeyCatch product analytics: kept while we use HeyCatch, and deleted or irreversibly anonymised within 2 months after we stop
• Meta Pixel and Conversions API data: kept by Meta under its own retention rules (see Meta's privacy policy)

6. Your Privacy Rights

KnowDesk Inc. is incorporated in Delaware, United States, and complies with applicable US federal and state privacy laws, including the California Consumer Privacy Act (CCPA) where applicable. Regardless of your location, we extend the following rights to all users of our platform:

• Right of access - request a copy of all personal data we hold about you
• Right to rectification - correct inaccurate or incomplete data
• Right to erasure - request deletion of your account and all associated data
• Right to restriction - ask us to limit how we process your data
• Right to data portability - receive your data in a machine-readable format
• Right to object - object to processing based on legitimate interest
• Right to withdraw consent - for any processing based on consent (e.g. marketing emails)
• Right to non-discrimination - we will not discriminate against you for exercising any of these rights

California residents may also have additional rights under the CCPA, including the right to know about the sale of personal data (we do not sell personal data for money) and the right to opt out of any future sale. If you allow marketing cookies, the Meta Pixel may count as "sharing" personal data for cross-context behavioural advertising under California law. You can opt out at any time by turning off Marketing in Cookie Settings, and we treat a Global Privacy Control or Do Not Track signal from your browser as an opt-out.

If you are a resident of the EU/EEA, we acknowledge your rights under GDPR as a matter of good practice. You may also lodge a complaint with your local data protection authority.

To exercise any of these rights, email [email protected] or contact us via WhatsApp. We will respond within 45 days as permitted under US law, with a possible 45-day extension where reasonably necessary.

7. Security

We implement industry-standard security measures including: encrypted data at rest (AES-256), encrypted data in transit (TLS), API key authentication for all widget requests, row-level security policies on database tables that hold customer data, and regular security reviews. More detail is on our Security page. No system is 100% secure - if you discover a vulnerability, please report it to [email protected].

8. International Transfers

KnowDesk Inc. is incorporated and primarily operates in the United States. Your data is stored and processed in the USA and, where applicable, in the EU (via our cloud infrastructure in EU - Central). Most of our sub-processors - including Stripe, Cloudflare, our AI providers (Anthropic, OpenAI), our voice providers (Telnyx, Deepgram), our email provider (Resend) and our cloud hosting provider - are US-based companies that operate globally under their own privacy and security standards.

If you are located in the EU/EEA, please be aware that your data may be transferred to and processed in the United States, which may not provide the same level of data protection as your home jurisdiction. We take reasonable steps to ensure your data remains protected in accordance with this policy, regardless of where it is processed.

9. Children

KnowDesk is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with their data, contact [email protected] and we will delete it promptly.

10. Changes to This Policy

We may update this policy from time to time. We'll notify registered users by email for material changes. The "Last updated" date at the top of this page always reflects the current version. Continued use of KnowDesk after changes constitutes acceptance of the updated policy.

11. Contact

For privacy-related questions or to exercise your rights:

• Email: [email protected]
• Contact: +1 (307) 316-8960
• Post: KnowDesk Inc. · 1908 Thomes Avenue, Cheyenne, WY 82001, United States