This policy explains what personal information Knowpoint collects, why, who we share it with and the choices you have. It covers our website (knowpoint.io), the Knowpoint service (your workspace at <name>.knowpoint.io), the Knowpoint browser extension and our emails.
We've written it in plain language. If anything is unclear, email us at info@knowpoint.io.
1. Who we are, and our two roles
"Knowpoint", "we" and "us" mean the company that provides the Knowpoint service.
We handle personal information in two different roles:
- For your workspace's content, we act for you. The documentation your team puts in Knowpoint belongs to your organization, which decides what goes in it and who can see it. This includes clients, contacts, assets, passwords, documents, notes and anything synced from other tools. Your organization is the "controller" of that information and we are its "processor": we only use it to provide the service to you, as your organization instructs.
- For everything else, we're responsible. This covers account details, billing contacts, website visits, support emails and service logs. For these we are the controller, and this policy tells you how we use them.
If you're a client or contact whose details an MSP has documented in Knowpoint, that MSP is responsible for your information. Please contact them first. We'll help them respond.
2. What we collect
Account and sign-up information. When you start a trial or are invited: your name, work email address, company and workspace name, and, for the person who signs up, a phone number. When you sign in with Microsoft, we receive your name, email address and your account's ID from Microsoft Entra ID. We never receive your Microsoft password. We store your Knowpoint password only as a secure one-way hash, and two-factor secrets encrypted.
Workspace content. Whatever your team adds or syncs, as described above. Passwords, one-time code secrets and integration keys are encrypted with AES-256-GCM before they're stored, with a separate key for every workspace.
Activity and security records. To keep your workspace secure and give your admins an audit trail, we record sign-ins (including failed attempts), changes, password reveals and copies, shares and exports. Each record has the time, the person and the IP address. We also record each person's last sign-in time.
Information from tools you connect. If an admin connects ConnectWise, HaloPSA, NinjaOne, Microsoft 365, Slack, Microsoft Teams or a webhook, data flows between that tool and your workspace as the admin sets it up. For example, companies, contacts and devices are synced in, and alerts are sent out. Domain monitoring looks up your domains in public WHOIS, DNS and certificate records.
The browser extension. The extension only works after you connect it to your workspace. While its side panel is open, it sends your workspace:
- the host name of the site you're on, such as
admin.microsoft.com, to find passwords saved for that site - on your own connected PSA and RMM sites only, the page address and title, to find the client a ticket or device belongs to
- what you type into its search and Ask Knowa boxes
It doesn't collect your browsing history or page content, doesn't use analytics, and sends nothing to anyone but your own workspace. It stores your workspace address and a sign-in token on your device, and never stores password values.
Support and contact. If you email us, we keep the conversation and your contact details.
The website. Our website uses no analytics, advertising or tracking tools. Like any web server, ours and our providers' (see section 4) briefly process your IP address and browser details to deliver pages and protect against abuse. The website loads its font from Google Fonts, so your browser connects to Google when you view it.
3. How we use it
We use personal information to:
- provide, maintain and secure the service, including signing you in, enforcing your admins' access rules and keeping the audit log
- send service emails: invitations, password resets, security notices, alerts your admins have set up, and messages about your trial or subscription
- respond to support requests
- prevent fraud and abuse, for example by checking sign-ups and limiting repeated sign-in attempts
- run our business: billing, keeping records and meeting our legal obligations
We don't sell personal information, we don't share it for advertising, and we don't use your workspace content to train AI models.
AI features. Ask Knowa, the AI writer and AI import only work after a workspace admin adds their own Anthropic or OpenAI API key. When someone uses them, the relevant documentation they're allowed to see, along with their question, is sent to that provider under the workspace's own agreement with it. Password values are never sent. The MCP server works the same way: it sends documentation to the AI tool your team connects, never password values.
Legal bases (EU and UK). We rely on:
- performance of our contract with you, to provide the service
- our legitimate interests, for security, abuse prevention, support and improving the service, where these aren't overridden by your rights
- legal obligation, for tax and accounting records
- consent, where we ask for it
4. Who we share it with
We use a small number of service providers (subprocessors) to run Knowpoint. Each one only gets the information it needs to provide its service to us, and is bound by a contract to protect it:
| Provider | What they do for us | Information involved | Location |
|---|---|---|---|
| Render | Hosts the application and its database | All workspace and account data | United States (Oregon) |
| Cloudflare | DNS, encryption in transit and protection from attacks | Traffic to the website and workspaces | Global network |
| Resend | Sends our emails | Email addresses and email content | United States |
| Microsoft 365 | Our company email, for support and sales conversations | Emails you send us | United States |
| Google Fonts | Serves the website's font | Your IP address and browser details when you view the website | Global |
We also share information:
- with services your organization chooses to connect, such as your PSA, RMM, Microsoft 365 tenant, chat tools, webhooks or AI provider, as your admins set up
- within your organization, according to the roles and access your admins give
- if the law requires it, for example a valid court order. Where we're allowed to, we'll tell the affected organization first.
- in a business transfer, such as a merger or acquisition, in which case this policy continues to apply to your information
5. Where your information is stored
Knowpoint's application and database are hosted in the United States (Oregon). If you're outside the United States, your information will be transferred there. Where the law requires it, for example for transfers from the EU or UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
6. How long we keep it
- Workspace content stays for as long as your organization uses Knowpoint. Your admins can delete items at any time and export everything whenever they want. When a workspace is closed and we delete it, its content is removed from our live systems. It's removed from our backups within 7 days, when those backups expire.
- Audit and activity records stay with the workspace, so your admins have a complete history, and are deleted with it.
- People removed from a workspace lose access immediately. Their name stays on the changes they made, so the audit history remains accurate.
- Browser extension sessions expire after 30 days without use, and after 6 months at most.
- Support emails and business records are kept for as long as we need them for the purpose they were collected for, and as the law requires, for example for tax.
7. How we protect it
Security is at the heart of Knowpoint. Its protections include:
- encryption in transit and an encryption key for every workspace
- workspaces isolated from each other
- two-factor authentication and single sign-on
- IP allowlists
- detailed access controls and a full audit log
Our security page and security whitepaper explain these protections in detail. To report a vulnerability, email security@knowpoint.io.
8. Your rights
Depending on where you live, you may have the right to:
- access the personal information we hold about you, and get a copy of it
- correct it
- delete it
- object to or restrict how we use it
- receive it in a portable format
- withdraw consent you've given
For information in a workspace, the quickest route is your workspace admin, who can view, correct, export and delete it directly. Otherwise, email info@knowpoint.io and we'll respond within one month. We may need to confirm your identity first.
If you're in the EU or UK, you can also complain to your local data protection authority.
California residents. You have the right to know what personal information we collect and why, to ask us to delete it or correct it, and not to be treated differently for using these rights. We don't sell or "share" personal information as California law defines those terms.
9. Cookies and local storage
Knowpoint uses one cookie, to keep you signed in. It's essential for the service to work. We don't use advertising or analytics cookies.
The app also saves a few preferences in your browser, such as light or dark theme, so they stay as you set them. These never leave your device.
10. Children
Knowpoint is a business tool and isn't meant for anyone under 16. We don't knowingly collect information from children.
11. Changes to this policy
If we make important changes, we'll update the date at the top of this page and tell workspace owners by email or in the app before the changes take effect.
12. Contact us
Questions or requests about privacy: info@knowpoint.io Security reports: security@knowpoint.io