Privacy policy

Overview

This policy explains how KnowWhy handles personal data when you visit knowwhyy.com or use the app. For content that customers connect from their own tools, the customer's workspace decides what is indexed and we process it on their behalf. Contact: hello@knowwhyy.com.

What we collect

Account data: your name, email address and sign-in details (through email and password or Google sign-in).

Workspace content: the repositories, pull requests, issues, Slack messages in channels you select, and Notion pages your workspace chooses to index, plus the questions you ask and the answers KnowWhy returns. Slack direct messages are never read. Access tokens for connected tools are encrypted with AES-256-GCM.

Usage data: pages visited, approximate country, browser and device type, using a random identifier kept in your browser's local storage. We don't use advertising cookies or third-party trackers.

Billing data: Paddle, our merchant of record, collects your payment details, billing address and tax information. We receive the subscription status, plan, seat count and Paddle customer ID, never your full card number.

How we use it

To provide and secure the service (indexing, answering questions, access control), to bill subscriptions, to send account and invitation emails, to improve the product from aggregated usage, and, if you haven't opted out, to send occasional product news. Every marketing email has an unsubscribe link.

We don't sell personal data and don't use workspace content to train AI models.

Who processes it

We use these service providers, each only for the purpose listed: Supabase (database and authentication), Vercel (hosting), Google Firebase (Google sign-in), Cloudflare R2 (file storage), Resend (email delivery), Paddle (payments, invoicing and tax), and AI model providers such as Groq, OpenRouter and Google Gemini, or a KnowWhy-hosted model, to generate answers and search embeddings from the minimum excerpts needed for each question.

Some of these providers process data outside your country, including in the United States. We rely on their contractual and security commitments for those transfers.

How long we keep it

Workspace content is kept while the workspace exists and removed when sources are disconnected or the workspace is deleted. Owners can set chat history to be deleted automatically after a chosen period. Raw usage events are kept for up to 400 days. Billing records are kept as long as tax law requires.

Your choices and rights

You can view and update your profile in the app, delete workspaces you own, and opt out of product emails. Depending on where you live, you may also have the right to access, correct, delete or export your personal data, or object to some processing. Email hello@knowwhyy.com and we'll respond within 30 days.

Security

Each workspace is isolated with database row-level security, connections use read-only scopes where the provider allows it, credentials are encrypted, and all traffic uses HTTPS. No system is perfectly secure; if a breach affects your data we'll notify you as required by law.

Changes

We'll post any changes here with a new date, and tell you by email about material changes.