Privacy policy

The rest of this page is the detail behind those answers.

KnowWho holds two things that are worth keeping apart, because the law treats them differently.

Your account data. Your name, email address, sign-in details, organisation, plan, and billing records. We decide how this is used, so for this data we are the "controller" under UK data protection law.

Your book. Everything you put into KnowWho about other people: names, contact details, employers, notes, what was said, what you agreed, when you met. You decide what goes in, what it says, and how long it stays. We only hold it and act on your instructions. For this data you are the controller and we are your "processor".

That distinction matters if you use KnowWho for work. It means you are responsible for what you record about people, and we are responsible for keeping it safe, private, and available to you.

Our data processing agreement, at knowwhocrm.com/dpa, sets out how we process your book on your behalf. It is part of our terms of service, so it applies automatically and there is nothing to sign.

When you create an account

• Name and email address
• Your sign-in: a one-time code sent to your email address, or a password if one is set for you
• Your organisation's name, and your role in it
• The plan you are on

If someone invites you to their workspace, we receive your email address from them so we can send the invitation.

Sign-in, and the sign-in and invitation emails, are handled for us by Clerk. See section 5.

When you subscribe

• Subscription status, seats, renewal dates, and invoice history
• Your organisation's billing details, if you add them: legal and trading name, company and VAT numbers, registered and billing addresses, and a billing email address

Card details go straight to Stripe. We never see or store your card number.

To show and charge prices in your currency, we look up which country your IP address is in. See section 5.

When you use KnowWho

Whatever you choose to record. In practice that is:

• People: names, email addresses, phone numbers, dates of birth, LinkedIn profiles, employers and roles, tags, and anything you say about them
• Companies and organisations, their tags, and how they relate to each other
• Notes and interactions: meetings, calls, messages, and what happened in them
• Tasks and commitments
• Opportunities and deals
• Events: where you met someone, who was there, a description and a link
• Connections between all of the above

Some of this is personal data about people who are not KnowWho users. Section 9 deals with them.

When you send us feedback

If you ask your assistant to send feedback about KnowWho, we store what it sends: your message, what kind of feedback it is, which tool it concerns if any, and which assistant sent it, together with your user and organisation identifiers. We email a copy to you and to us. Your assistant may also send us a note of its own when a KnowWho tool fails or behaves confusingly; that is stored the same way, without the copy to you. We use feedback to improve KnowWho and to reply to you, and for nothing else.

Automatically, while the service runs

This section is deliberately specific, because "we collect usage data" can mean almost anything and you deserve to know which.

What we log

• That a tool ran, and which one. For example, that search was called, or that record_encounter was called.
• Who ran it: your user identifier and your organisation identifier.
• When it ran, whether it succeeded or failed, and how long it took.
• Which assistant app connected, and its version and browser details, as the assistant reports them when it connects.
• When something fails, the error itself: the type of error, where in our code it happened, the shape of what was sent (the names and types of its fields, not their values), and a reference number.
• When a page in our app or on our website fails in your browser, the address of the page without its query string, the error message, and where in our code it happened.

Your IP address is used to apply rate limits and to block abuse. We do not store it in our own databases. Cloudflare, which runs our network, processes it to deliver the service and may keep it briefly in its own logs.

What we do not log

• What you sent, when it worked. We do not log the contents of a successful tool call. If you record a meeting, our logs show that a capture happened. They do not show who you met or what was said.
• What we sent back. Answers to your questions are not logged.

The exception, which we would rather tell you about than hide

When a request fails, we log the error itself. An error sometimes carries the value that caused it, so a failure while saving a contact may leave that contact's name or email address in the error text. We keep the error as it arrives, because a stripped one often does not say enough to fix the problem.

That means fragments of your data can appear in our error logs. Never a whole record and never your book, but fragments. They are visible only to the small number of people who maintain the service, they are used for nothing except diagnosing the fault, and they are deleted after 90 days. Cloudflare's copy of our service logs is deleted after 7 days.

Why we log anything at all

Two reasons, and only two.

First, to understand how the product is used. Which tools people rely on, which ones fail, how often. That tells us what to fix and what to build, and it works without knowing what anyone wrote.

Second, to help you when something breaks. Every failure carries a reference number that is shown to you. Quote it to support and it takes us to the exact event.

Our lawful basis for this is our legitimate interest in running and improving a reliable service. Error details and connection records are deleted after 90 days. The bare record that a tool ran, with no content and no error text, stays for as long as your account is open, so that we can see how the product is used over time.

On the website

We use only the cookies needed to sign you in and keep the service running. No analytics, no tracking, no advertising, and nothing that follows you to another site.

That is also why you will not meet a cookie banner here. There is nothing to ask you about. Details are in the cookie policy.

The pricing section asks Geoapify which country your IP address is in, so it can show prices in your currency. Your browser asks Geoapify directly, so Geoapify receives your IP address and the standard details your browser sends with any web request, and nothing about your account or your book. Geoapify's own policy says it keeps such requests for no longer than 24 hours, and we do not store the answer.

If you subscribe to Marginalia

We store your email address so that we can send you new posts. We use it for nothing else and never share it. Every email will carry a link to unsubscribe, and you can also ask us at privacy@khiliad.com to remove you at any time.

We do not use your book to train AI models. We do not build or operate AI models of our own, and we do not license your data to anyone who does. The suppliers that hold your book may use it only to provide their service to us. We do not profile you. We do not make automated decisions that have a legal or similarly significant effect on you.

This part is specific to how KnowWho works, and it is worth reading.

KnowWho is not an AI assistant. It is a connector that your assistant calls. When you say "I met Sarah at the conference" to your assistant, the following happens:

1. Your words go to your assistant provider, under their terms and their privacy policy.
2. Your assistant decides to call KnowWho and sends us a request containing the details it extracted.
3. We store those details in your book and send back a confirmation of what we recorded.
4. Your assistant shows you that confirmation.

Two consequences:

Your assistant provider sees your words. They are your first point of contact, not us. What they keep, for how long, and whether they use it, is set by their privacy policy, not this one. If you use KnowWho through Claude, ChatGPT, Gemini, or any other assistant, read theirs alongside this one.

We see only what is in the request. We receive the content of a single tool call and nothing else. We cannot read your conversation history, your assistant's memory, your uploaded files, or anything you did in a different chat. We do not ask for that access and we would not be permitted to have it.

We use a small number of suppliers to run KnowWho. Each is bound by written terms to protect your data and to use it only to provide their service to us.

Stripe also uses payment data for its own fraud prevention and to meet its legal obligations, as its own privacy policy explains.

Cloudflare also routes inbound email for our addresses before it reaches Microsoft 365.

We do not use a third-party support desk. Support email arrives in the same Microsoft 365 mailboxes and is handled by us.

Planned: search by meaning. Search in KnowWho matches words today. We plan to add search by meaning, so that "who do I know in legal tech" finds someone whose note never uses that phrase. That will mean sending the text you record to an embedding provider, Voyage AI (MongoDB, Inc.) in the United States, to be converted into numbers that represent what it means. It is not live, and no text is sent to Voyage AI today. Before any is, we will update this policy and tell you at least 30 days in advance.

We do not sell personal data, and we do not share it for advertising. We will disclose data if we are legally required to, and we will tell you unless we are prohibited from doing so.

If we are ever acquired or merged, your data may transfer as part of the business. We will tell you before that happens and you will be able to export and delete first.

Your book is held in two places and nowhere else. The graph database, which holds the substance of it, is at Neo4j Aura in the United Kingdom. Our own storage at Cloudflare is in Western Europe.

One honest qualification. The code that answers your requests runs on Cloudflare's network, which places it close to whoever is making the request. So if you use KnowWho from outside Europe, your request is processed near you before it reaches the databases above. It is processed there, not stored there. Cloudflare also keeps its own copy of our service logs for 7 days, as part of running its platform.

Our other suppliers do not hold your book. Clerk holds account and identity data. Stripe holds billing data. Microsoft 365 holds email between you and us, and nothing from your book. Geoapify receives an IP address and standard request details, and nothing about your account or your book.

Where data reaches a supplier outside the United Kingdom or the European Economic Area, it is protected by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or by the EU Standard Contractual Clauses, or by an adequacy decision where one applies.

Enterprise customers can have a dedicated database instance, including in a region of their choosing. Contact us if that matters to you.

If your subscription lapses and you drop to the Free plan, your data stays where it is. Everything you recorded remains in place and fully searchable. You simply cannot add new people or companies until you are back under the Free limit or back on a paid plan. We do not delete a book because someone stopped paying.

Under UK data protection law you can ask us to:

• Give you a copy of what we hold about you
• Correct it if it is wrong
• Delete it
• Restrict what we do with it, or object to it
• Export it in a portable format. On every plan, including Free, owners and admins can download the whole book as one file from Settings in the app. If you are not an owner or admin, ask one, or email us and we will provide it free of charge.
• Stop marketing to you, at any time

Much of this you can do yourself: your assistant can show, correct and delete anything in your book, and owners and admins can export it from Settings. For anything else, email privacy@khiliad.com. We will respond within one month.

If you are not happy with how we have handled something, you can complain to the Information Commissioner's Office at ico.org.uk, or call 0303 123 1113. We would rather you came to us first, but it is your right either way.

Khiliad Limited is registered with the Information Commissioner's Office under reference ZB500202.

KnowWho holds information that our users record about the people they know. You may be one of those people without having a KnowWho account.

The user who recorded that information decides what it says and how long it is kept. They are responsible for it under data protection law, in the same way they would be for a notebook, a contacts app, or a spreadsheet. We hold it on their behalf.

If you want to know what someone has recorded about you, or want it corrected or removed, ask them. If you do not know who to ask, or you would rather come to us, write to privacy@khiliad.com. We will pass your request to the relevant user, help them action it, and tell you what happened. Where the law puts the obligation on us directly, we will act on it ourselves.

• Everything is encrypted in transit, and at rest by our infrastructure providers
• Each account's data is isolated from every other account, and that isolation is enforced on every single request rather than trusted from a token
• Access to production systems is limited to the people who need it, and requires multi-factor authentication
• We review what our suppliers do and hold them to written terms

No system is perfect. If there is ever a breach affecting your data, we will tell the ICO within 72 hours where the law requires it, and we will tell you directly where there is a real risk to you.

KnowWho is a business tool and is not for anyone under 18. We do not knowingly collect data from children. If you think a child has created an account, tell us and we will remove it.

We will update this page when the product changes. If a change materially affects your rights or what we do with your data, we will email you before it takes effect. The date at the top always tells you which version you are reading. Previous versions are available on request.

Email: privacy@khiliad.com Post: Khiliad Limited, 86-90 Paul Street, London EC2A 4NE, United Kingdom

We have not appointed a Data Protection Officer. Privacy questions, requests and complaints go to privacy@khiliad.com and reach the people who can act on them.