Your knowledge.
Clear responsibilities.
This notice describes the data handling implemented in this beta.
Contact and scope
Contact Knowtiq through the Contact page. Before a public launch, the operator must add its verified legal entity, address, applicable jurisdiction, and any provider agreements required for that deployment.
Information the app stores
Account names and email addresses, password hashes, session and verification records, workspace membership, document contents and source URLs, search questions and answers, activity records, and contact or early-access submissions. When you sign in with Google, the application stores your Google account identifier and verified email. It does not retain Google access or refresh tokens. Stripe handles payment card details; Knowtiq stores customer and subscription identifiers, plan status, and billing event references, without storing card numbers.
Why information is used
To provide accounts, control workspace access, index and search documents, show supporting sources, deliver account emails, respond to requests, and limit abuse. Contact submissions require explicit consent in the form.
AI providers and email
In local search mode, document text is not sent to an AI service. When Bedrock or OpenAI is configured, document text is sent for embeddings and relevant excerpts plus questions are sent for answer generation. Provider regions, terms, retention, and processing arrangements must be reviewed by the deployment owner. OpenAI Responses requests set store=false; this does not by itself eliminate all provider retention.
Configured SMTP receives recipients and email bodies. Contact notifications include a request ID rather than your message contents.
Google sign-in and payments
Google receives authentication requests and provides your basic profile and verified email after your consent. Google Drive access is not requested. Stripe receives the checkout and billing details necessary for subscriptions and invoices. Active or pending subscriptions are cancelled before account deletion completes; provider retention of billing records follows its terms and applicable obligations.
Cookies and logs
We use an essential session cookie and a short-lived browser-binding cookie during Google sign-in. No advertising analytics are included. Application errors log a request ID and error type. Web server access logs are controlled by the hosting provider. Request bodies and passwords are not logged. IP addresses are hashed for temporary rate counters; infrastructure logs may have separate settings.
Retention and deletion
Sessions expire after seven days. Verification links expire after 24 hours, reset links after one hour, and invitations after seven days. Expired records are removed by the scheduled PHP maintenance task. Configure this cron task to enforce retention; without it, expired authentication links are unusable but old records may remain. Search history and activity records are kept for up to 90 days; email outbox records for up to seven days. Documents and submissions remain until deleted by an authorized user or operator.
You can clear your search history, export accessible workspace documents, or delete your account from Settings. Deletion removes owned workspaces and associated knowledge. Documents contributed to someone else's workspace remain under that owner's control. A deleted document clears workspace search history so retained answers cannot continue exposing its excerpts.
Backup retention is controlled by the deployment owner; deletion from backups follows that schedule. Contact us to request deletion of form submissions or discuss other privacy requests.
Keep sensitive data out of the beta
Only upload information you are authorized to share with workspace members and the configured providers. The beta has no document-level access controls.