Privacy Policy

How Knacto handles personal data. The Service at https://knacto.com is operated by NAVORETA UAB, and NAVORETA UAB is the data controller for the personal data described below. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and Lithuanian data protection law.

1. Who to contact

Reach us on privacy matters at [email protected]. If you are not happy with our response, you can complain to Lithuania’s State Data Protection Inspectorate (VDAI, https://vdai.lrv.lt) or to the supervisory authority of the EU country you live or work in.

2. What we collect and why

Account data — name, email, password hash, workspace name — because we need an account to give you a login and a place to hold your tokens.

Billing data — the transaction reference, currency, amount, VAT identifier where you provide one, and the last four digits of the card. We keep this to issue receipts and invoices, to reconcile against the ledger and to comply with tax and accounting law. Full card numbers never reach our servers.

Crew and Run data — the definitions of your Crews, the Inputs you send in, the Outputs the models return, the tool calls made, the tokens drawn, and the timestamps on the ledger. We keep this so the Service works, so the ledger stays trustworthy, and so we can investigate incidents.

Technical data — IP address, browser and device information, log timestamps and cookie identifiers. Needed to serve the Service, secure it and improve reliability.

Support data — the tickets, messages and attachments you send us and our replies. Kept so we can help.

3. Legal bases

We rely on: performance of the contract with you to run the Service, legitimate interests to keep the Service secure and to improve it, legal obligations to keep tax and accounting records and to answer lawful requests from authorities, and consent for optional cookies and any marketing you actively opt in to.

4. Who we share it with

We use vetted providers to run the Service — cloud hosting, email delivery, payment processing, error monitoring, product analytics. Each acts as our processor under a written agreement. Where a Crew calls a third-party AI model or a built-in tool, only what the request needs is passed to that provider; those providers act as separate controllers for the request under their own terms. Where you connect external services yourself (a CRM, a webhook target), we share only what those integrations require. We may disclose personal data to comply with the law, respond to lawful requests, protect the Service and its users, and in connection with a corporate transaction. We do not sell personal data.

5. Model training

We do not use your Input or Output to train our own models. Where you use a third-party model through Knacto, that provider’s policy governs whether they might process the request for their own training purposes; where the provider offers a no-training setting through their API we enable it by default.

6. Retention

Account data lives while the account is open and up to twelve months after closure for legitimate follow-up. Billing records are kept for the period required by Lithuanian and EU accounting and tax law (currently ten years). Crew definitions, Runs and ledger entries stay for the life of the account and are deleted on closure, except where retention is required by law or to defend a legal claim. Support tickets are kept for up to three years. Technical logs and security data are kept for up to twelve months.

7. International transfers

If data moves outside the European Economic Area — for example because a model provider or a support tool is hosted there — we cover the transfer with recognised safeguards, typically the EU Standard Contractual Clauses paired with technical measures such as encryption in transit and at rest, or an adequacy decision where one applies.

8. Your rights

Access, rectification, erasure, restriction, portability, objection to processing based on legitimate interests, and withdrawal of consent for anything you consented to. Write to [email protected]. We answer within thirty days and may ask for information to verify identity before we act.

9. Security

Encryption in transit and at rest, isolated tenancy per workspace, least-privilege access, monitoring, staff training and vendor reviews. We do not promise perfect security — no online service can — but we treat protection of your data as a first-class concern.