Privacy Policy
This policy explains what personal data Knowyx collects, why, who we share it with, how long we keep it and what rights you have. It applies to knowyx.com and other sites and apps we operate under the Knowyx name (the "Service").
1. Who we are
The controller of your personal data is HONGKONG WEBETOP GROUP LIMITED, RM 701, UNIT 127, 7/F, TOWER B, NEW MANDARIN PLAZA, 14 SCIENCE MUSEUM ROAD, TSIM SHA TSUI, HONG KONG ("we", "us").
Privacy contact: privacy@knowyx.com
- EU representative (GDPR Art. 27): [[EU_REPRESENTATIVE_NAME_AND_ADDRESS]]
- UK representative (UK GDPR Art. 27): [[UK_REPRESENTATIVE_NAME_AND_ADDRESS]]
2. Summary
- We collect what we need to run the tools you use, keep your account and payments working, and keep the Service safe.
- We do not sell your personal data, and we do not use your inputs or results to train AI models. We only use AI model providers that commit not to train on what we send them.
- Uploads and results are deleted automatically after a set period (usually 30 days; shown on each tool page), unless you choose to save them.
- If you are in the EU, EEA, UK or Switzerland, your runs are processed only by AI providers we have verified for that region.
- You can download, correct or delete your data from your account, or by emailing us.
3. What we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Email address, name and profile picture from Google (if you sign in with Google), hashed password (if you set one), language and output-language preferences | You; Google |
| Inputs | Text you type, images and audio you upload, options you choose in a tool. Images and audio are re-encoded and their metadata (such as GPS location in photos) is removed on upload | You |
| Outputs | Results produced by tools for you, including generated images, audio and text | Generated by the Service |
| Saved content | Runs you save, records you keep in a tool's record book, and profiles you create (we ask you not to enter real names or photos in profiles) | You |
| Usage and history | Which tools you ran, when, status, credits charged, share links you create, results you relay to another tool | The Service |
| Payment data | Subscription status, plan, purchase history, credit balance and transactions. We do not receive or store your full card details; payments are handled by our payment provider | You; payment provider |
| Device and technical data | IP address, approximate country (from our network provider), browser and device information, a random device identifier and a device fingerprint derived from browser characteristics, cookies (see section 9) | Your device; our network provider |
| Communications | Emails you send us, support requests, reports and appeals | You |
We do not intentionally collect special categories of data (such as health, religion or biometric data). Some tools let you submit content that may reveal such information (for example, a photo of a meal or a voice recording). We process it only to produce the result you asked for. Tools that create new content from a person's photo or voice ask you to confirm you have that person's permission, and we record that confirmation (time, IP address and terms version).
The Service is not intended for anyone under 18.
4. Why we use it and our legal bases
| Purpose | Data | Legal basis (EU/UK GDPR) |
|---|---|---|
| Run the tools you use, show your history, save what you choose to save, create share links you request | Inputs, outputs, saved content, usage | Contract |
| Create and secure your account; sign-in emails and security notifications | Account, device and technical data | Contract; legitimate interests (security) |
| Process payments, grant credits, keep financial records | Payment data, usage | Contract; legal obligation |
| Prevent abuse, fraud and misuse of free credits and trials; enforce our Acceptable Use Policy; rate-limiting and bot checks | Device and technical data, usage, inputs and outputs (automated safety checks) | Legitimate interests (keeping the Service safe and fair); legal obligation where content must be reported |
| Product analytics to understand how the Service is used and improve it | Usage, device and technical data | Consent where required (EU/EEA/UK/CH — see section 9); otherwise legitimate interests |
| Service emails (for example, a long-running result is ready) | Account data, usage | Contract; you can turn these off |
| Marketing emails | Email address | Consent (opt-in only; unsubscribe in every email) |
| Respond to requests, complaints and legal claims | Communications and relevant account data | Legitimate interests; legal obligation |
Where we rely on legitimate interests, you can object (see section 11).
Automated checks. Inputs and outputs are checked automatically for prohibited content, and we use automated signals to detect abuse. A check can block a run or limit an account. These checks do not produce legal effects about you without a route to human review; you can appeal at support@knowyx.com.
5. AI processing and training
- Tools send your inputs to third-party AI model providers to produce results. A provider receives only what the tool needs for that run.
- We do not use your inputs or outputs to train or fine-tune AI models. We only use providers and configurations that, under their terms, do not use the data we send to train their models. Some providers may keep data for a short period for abuse monitoring, as described in their terms; see [[SUBPROCESSORS_URL]].
- If you are in the EU, EEA, UK or Switzerland, your runs are processed only by providers we have verified for that region (data processing agreement, a lawful transfer mechanism, no training on API data, and known retention and processing locations). Tools that rely on a provider without that verification are not available in that region.
- Our staff do not look at your inputs or results as a matter of course. Access is limited to cases where you ask us to help with a specific run, where we must investigate a report or a suspected violation, or where the law requires it; such access is logged.
6. Who we share it with
We share personal data only as described here. We do not sell it or share it for cross-context behavioural advertising.
- Service providers (processors) that work on our behalf under contracts that limit their use of the data:
- AI model providers that run the tools (see [[SUBPROCESSORS_URL]] for the current list and their processing locations)
- Content moderation provider: [[MODERATION_PROVIDER]]
- Hosting, database and cache: [[HOSTING_PROVIDER]]
- Network, security, bot checks and file storage: Cloudflare (CDN, Turnstile, R2 storage)
- Email delivery: Resend
- Product analytics: PostHog ([[POSTHOG_REGION: US / EU cloud]])
- Error monitoring: Sentry
- Google, if you choose to sign in with Google (Google shares your basic profile with us; Google's own privacy policy applies to your Google account).
- Payment provider. Purchases are processed through Stripe's Managed Payments service. The seller of record named at checkout processes your payment details and billing address as an independent controller under its own privacy policy, and shares with us the purchase information we need to deliver what you bought.
- People you share with. If you create a share link, anyone with the link can see the shared result.
- Legal and safety. We may disclose data where required by law, to respond to valid legal requests, or to protect the rights, safety and property of users, the public or us, including reporting child sexual abuse material to the relevant authorities.
- Business transfers. If our business is reorganised or sold, data may transfer to the new operator, who must continue to protect it as described here.
7. Where data is processed
We are based in Hong Kong. Our hosting and storage are located in [[PRIMARY_REGION, e.g. United States]], and our service providers may process data in other countries. When we transfer personal data from the EU, EEA, UK or Switzerland to a country without an adequacy decision, we use the European Commission's Standard Contractual Clauses (with the UK Addendum and Swiss amendments as applicable) or rely on the provider's certification under the EU-US Data Privacy Framework and its UK and Swiss extensions. You can request a copy of the relevant safeguards at privacy@knowyx.com.
8. How long we keep it
| Data | How long |
|---|---|
| Uploaded files and results of a run (signed-in users) | For the period shown on the tool page, usually 30 days from the run, then deleted automatically. Some tools keep uploaded files for a shorter period than results |
| Runs and files from use without an account that are not moved into an account | 7 days |
| Runs you save, record books and profiles | Until you delete them or your account |
| Share links | Until you revoke the link, delete the result or delete your account |
| Account data | While your account is open; deleted within [[30]] days after you delete your account, except as below |
| Purchase, refund and credit transaction records | [[7]] years after the transaction, to meet accounting and tax obligations; after account deletion they are kept in a form not linked to your profile where possible |
| Safety records (moderation results, enforcement actions, abuse reports) | [[12 months]], or longer if needed for an ongoing investigation or legal claim |
| Security and access logs | [[90 days]] |
| Device identifier cookie and device fingerprint | Up to 1 year from your last visit |
| Analytics data | [[ANALYTICS_RETENTION]] |
| Backups | Overwritten within [[30]] days; deleted data is not restored from backups into the live Service |
When you delete a result or a file, it stops being accessible immediately and is removed from our live storage within [[24 hours]].
9. Cookies and similar technologies
We use a small number of cookies and browser storage. See the Cookie Policy for the full list.
- Strictly necessary (always on): sign-in session, device identifier for trial limits and abuse prevention, device fingerprint for abuse prevention, bot checks (Cloudflare Turnstile), your language preferences.
- Analytics (PostHog): to understand how tools are used. In the EU, EEA, UK and Switzerland, analytics only run if you accept them in the cookie banner, and you can change your choice at any time from the "Cookie settings" link in the footer. Rejecting them does not affect any feature.
- Referral: if you open someone's share link, we remember the link for [[30]] days so we can attribute sign-ups to it.
We do not use advertising cookies.
10. Security
We use encryption in transit, encrypted storage for credentials and keys, access controls with two-factor authentication for staff, signed and expiring links for files, and regular review of access. No system is perfectly secure; if a breach affects your personal data we will notify you and the relevant authorities as the law requires.
11. Your rights
Depending on where you live, you may have the right to:
- access your data and get a copy in a portable format — you can download your data from your account settings;
- correct inaccurate data;
- delete your data — delete individual results from your history, or delete your account from your account settings;
- object to processing based on legitimate interests, and to direct marketing at any time;
- restrict processing in certain cases;
- withdraw consent at any time (for example, analytics cookies or marketing emails), without affecting earlier processing;
- not be discriminated against for exercising your rights.
To exercise a right you cannot exercise in the product, email privacy@knowyx.com from the email address on your account. We will verify your identity and respond within the time the law requires (one month under GDPR, 45 days under US state laws), and tell you if we need longer. You can authorize an agent to make a request for you where the law allows.
Complaints. You can complain to a data protection authority, for example the authority where you live or work in the EU/EEA, the UK Information Commissioner's Office, the Swiss FDPIC, or the Hong Kong Office of the Privacy Commissioner for Personal Data. We would appreciate the chance to address your concern first.
California and other US states. In the last 12 months we have collected the categories listed in section 3 for the purposes in section 4 and disclosed them to the service providers in section 6. We do not sell or share personal information as those terms are defined under California law, and we do not use sensitive personal information to infer characteristics about you.
12. Changes
We may update this policy. If changes are material, we will notify you by email or in the Service before they take effect. The "Last updated" date shows the current version.
13. Contact
HONGKONG WEBETOP GROUP LIMITED RM 701, UNIT 127, 7/F, TOWER B, NEW MANDARIN PLAZA, 14 SCIENCE MUSEUM ROAD, TSIM SHA TSUI, HONG KONG Privacy: privacy@knowyx.com · General: support@knowyx.com