Privacy Policy

Version 1.1.1 · Effective 2026-05-19

Knorra Privacy Policy

Effective date: 2026-05-19 Last updated: 2026-05-15

The short version

Knorra is a knowledge assistant for software teams. To do its job, we connect to the tools your team already uses (Jira, Confluence, Slack, Google Workspace, Microsoft 365) and read the content there to find duplicates, stale documents, and recurring questions. Here is what we want you to know up front:

If you want only the legal substance, the sections below are arranged so each one starts with what it actually means in practice.

1. Who we are

The data controller for Knorra is NEXTGEN SOFTWARE LTD, a company registered in England and Wales (company number 14613977), with its registered office at 85 Great Portland Street, London, England, W1W 7LT. We trade as Knorra.

Throughout this policy, "Knorra," "we," "us," and "our" refer to NEXTGEN SOFTWARE LTD.

If you have any privacy question, write to privacy@knorra.ai.

We are registered with the UK Information Commissioner's Office (ICO), registration ZC148593.

2. Who this policy applies to

This policy applies to:

If you are a Member of a customer organisation, your employer (the customer) is the data controller for the work data Knorra processes on their behalf. We are their processor. This policy explains what we do as their processor in addition to what we do as a controller for direct interactions (sign-up, billing, support).

3. What data we collect, and why

We group data into five categories.

3.1 Account and identity data

When someone signs up:

| What | Examples | Why | |---|---|---| | Identity | Name, work email, profile photo | Authentication, sending you product emails, identifying you in the product | | Authentication | Password hash (if email/password), OAuth identifiers (if Google or Microsoft SSO), session tokens | Logging you in and keeping you logged in | | Organisation | Company name, role, team size | Provisioning your workspace, billing, support | | Preferences | Notification settings, dashboard preferences | Making the product behave the way you asked | | Launch-notification email | Email address you provide on the coming-soon page | Sending you launch notification, with double opt-in confirmation; deleted within 7 days if you don't confirm |

Lawful basis: Contract (Art. 6(1)(b) UK GDPR) for the subscription service. Consent (Art. 6(1)(a)) for the launch-notification email — you opt in explicitly and can withdraw any time via the unsubscribe link in every email.

3.2 Source data (the content Knorra reads)

This is the largest category. When your administrator connects an integration, we receive access to read content from that source.

| Source type | What we read | What we do not read | |---|---|---| | Jira (Cloud and Service Desk) | Issues, comments, project metadata, assignees, statuses | Anything outside the projects your admin connected | | Confluence Cloud | Pages, blog posts, comments, version history, space metadata | Spaces your admin did not connect | | Slack | Messages from channels Knorra is invited to, channel metadata, threads, user identities | Direct messages, private channels Knorra is not in | | Google Workspace (Docs, Drive) | Document content, file metadata, comments, permissions | Files your admin did not authorise; Drive files outside the granted scope | | Microsoft 365 (where connected) | Equivalent to the above via Microsoft Graph | Content outside the granted scopes |

For each source we ingest, we store: the original content (encrypted at rest), a lightweight summary, a vector embedding (a mathematical representation used for similarity search), and structured metadata. We process this content to detect duplicate documents, stale documents, and recurring questions — the things Knorra is designed to surface.

Lawful basis: When we process source data, we are acting on the instructions of the customer organisation (the controller). The customer is responsible for ensuring its own lawful basis (typically legitimate interests or contract with its own staff and clients). Our basis as processor is the Data Processing Agreement we sign with the customer at sign-up.

3.3 Payment and billing data

| What | Why | |---|---| | Billing contact, billing address, VAT number | Issuing invoices, complying with tax law | | Payment card details (we do not store full card numbers — Stripe does, with PCI DSS Level 1 certification) | Charging your subscription | | Subscription history, invoice history | Account management, statutory record keeping |

Lawful basis: Contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c), for tax records).

3.4 Usage and product telemetry

| What | Why | |---|---| | Pages you visited inside the product, actions you took (clicked, confirmed, dismissed a Finding) | Improving the product, debugging | | Device and browser type, IP address (truncated to /24 for IPv4), session timestamps | Security (detecting unusual sign-ins), debugging | | Error reports (via Sentry) | Fixing problems | | Application logs (via Axiom) | Operating the service | | Aggregate, cookieless visit analytics on knorra.ai (via Plausible) | Understanding overall traffic patterns; no personal identifiers, no cross-site tracking |

Lawful basis: Legitimate interests (Art. 6(1)(f)) — keeping the product working, secure, and improving. You can object at any time by emailing privacy@knorra.ai. Aggregate analytics via Plausible do not use cookies and do not identify individuals; they fall under the strictly-necessary exemption for our legitimate interest in understanding overall site usage.

3.5 Support and communications data

When you email support, fill out a contact form, or talk to us, we keep that correspondence so we can help you and so we have a record if a dispute arises.

Lawful basis: Legitimate interests (Art. 6(1)(f)).

4. What Knorra does with source data, in plain English

Here is the actual processing flow, because we believe you should be able to see it:

  1. Your admin clicks "Connect Jira" (or whichever source). They authorise Knorra to read via OAuth.
  2. Knorra fetches the content of the projects/spaces/channels they authorised.
  3. For each document, Knorra:
    • Stores an encrypted copy of the content
    • Generates a short text summary using an AI model (so the model can later reason about the document without re-reading the full text every time)
    • Generates a vector embedding (used for similarity search)
    • Extracts entities (people, projects, customer names) mentioned in the content
  4. Background jobs compare documents against each other to find duplicates, stale items, recurring questions.
  5. When a potential issue is detected, an AI model evaluates whether it is genuinely a duplicate / stale / recurring. Only items the AI confirms above 70% confidence are shown to users.
  6. Users see a Finding in the dashboard. They can confirm, dismiss, or snooze it.

What we do not do:

5. Special disclosure for Google Workspace data

This section is required by Google's API Services User Data Policy and applies if you connect Google Docs or Google Drive to Knorra.

Knorra's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Concretely:

If you believe Knorra is using Google Workspace data in a way that violates this policy, please contact privacy@knorra.ai. We will investigate and respond within 14 days.

6. Microsoft 365 data

If you connect Microsoft 365 (including Outlook, Teams, SharePoint when available), our use of that data is governed by the same principles as Google data above: limited to the user-facing features you asked for, not used for advertising, not used to train AI models, not shared with third parties except as necessary to provide the service.

Microsoft 365 connection scopes are listed in our documentation and shown to you at the point of OAuth grant.

7. How Knorra handles personal sources (the privacy promise)

Knorra's architecture supports personal sources connected by individual members; none are offered at launch.

8. Who else processes your data (sub-processors)

We use a small set of trusted vendors to operate Knorra. The current list is here and at knorra.ai/legal/sub-processors:

| Sub-processor | What they do | Where data is processed | |---|---|---| | Vercel Inc. | Hosting (frontend + serverless functions); AI request routing via AI Gateway with team-wide Zero Data Retention | US/EU (auto) | | Neon Inc. | PostgreSQL database, including vector embeddings | EU (Frankfurt) by default; UK on request | | Anthropic PBC | AI inference (Claude models) — routed via Vercel AI Gateway with ZDR | US and EU | | OpenAI, LLC | AI embeddings (text-embedding-3-large) — routed via Vercel AI Gateway with ZDR | US | | Inngest, Inc. | Background job orchestration (running detection jobs) | US (multi-region) | | Resend Inc. | Transactional email (account, billing, notifications, launch-notification capture) | EU | | Stripe Payments Europe Ltd | Payment processing | UK and EU | | Functional Software, Inc. (Sentry) | Error tracking | EU | | Axiom Cloud Inc. | Logs and observability | EU | | Better Stack | Status page and critical incident alerting (SMS / on-call) | EU | | Cloudflare, Inc. | CDN, DNS, DDoS protection | Global edge | | Google LLC (Google Workspace) | Email aliases at @knorra.ai for our staff inboxes (support, privacy, security, etc.) | EU and US | | Plausible Insights OÜ | Cookieless aggregate website analytics on knorra.ai | EU (Estonia / Frankfurt) |

We will give you at least 30 days' notice before adding any new sub-processor. To get those notices, write to privacy@knorra.ai and ask to be added to the sub-processor change list (any Owner of a customer organisation can subscribe).

If a customer has a contractual right to object to a new sub-processor (under their negotiated Data Processing Agreement), they may terminate the service for that reason without penalty.

9. International transfers

Most of our processing happens in the UK and EU. Some processing happens in the US (specifically: OpenAI for embeddings, Anthropic for inference, parts of Vercel and Inngest infrastructure). These transfers rely on:

We maintain the relevant transfer documentation and can share specific transfer mechanisms on request to enterprise customers under NDA.

10. How long we keep your data

| Data | Default retention | Notes | |---|---|---| | Source content (documents, messages, emails ingested via connectors) | While your subscription is active, plus 30 days after disconnection or cancellation | You can purge immediately from settings at any time; per-source purge completes within 24 hours of your action | | Document summaries and embeddings | Same as source content | | | Findings (the duplicates, stale items, etc. Knorra surfaced) | Active subscription + 90 days | So you have time to export before final purge | | Account and identity data | Active subscription + 7 years after account closure | Statutory retention for accounting and tax | | Billing records | 7 years from invoice | UK statutory minimum | | Audit log (who connected what, when, what Knorra read) | 2 years | Security and breach investigation | | Application logs | 90 days | Then aggregated and anonymised | | Support correspondence | 3 years from last contact | | | Launch-notification email (pre-launch) | 7 days if double opt-in not confirmed; otherwise until launch + 1 year, then suppression list | Suppression list ensures we never re-contact someone who unsubscribed | | Marketing communications post-launch | Until you unsubscribe, plus 1 year | Then suppression list only |

If you delete your organisation, source content and findings are removed within 7 days. Identity and billing records are retained per the statutory minimums above, in a separate cold-storage system, and are not accessible to anyone other than authorised finance and compliance staff.

11. Your rights

Under UK GDPR and (where applicable) EU GDPR, you have the following rights. We do not charge for exercising them and we do not put unnecessary friction in the way.

| Right | What it means | How to exercise | |---|---|---| | Access | A copy of the personal data we hold about you | Email privacy@knorra.ai | | Rectification | Correction of inaccurate or incomplete data | Most data can be edited in your account settings; otherwise email privacy@knorra.ai | | Erasure ("right to be forgotten") | Deletion of personal data we hold | One-click in your settings for full account deletion; or email privacy@knorra.ai | | Restriction | Pause processing in certain situations | Email privacy@knorra.ai | | Data portability | Receive your data in a portable format | Settings → Export, or email privacy@knorra.ai | | Objection | Object to processing based on legitimate interests | Email privacy@knorra.ai | | Withdrawal of consent | Where consent is the lawful basis (e.g., launch-notification emails), withdraw it | Unsubscribe link in every email, or email privacy@knorra.ai | | Automated decision-making | Knorra does not make automated decisions with legal or similarly significant effects about you | n/a — but you can always ask for human review of any Finding |

We respond within 30 days of receiving a request. We may need to verify your identity first.

Important: if you are a Member of a customer organisation, requests about your work data should usually go to your employer first (they are the controller). We will help your employer fulfil the request. If you cannot reach your employer or the request concerns data outside the employment relationship, contact us directly.

Your right to complain

You can lodge a complaint with the UK Information Commissioner's Office: ico.org.uk or call 0303 123 1113. If you are in the EU, you can complain to your local data protection authority. We would prefer you raise the concern with us first so we can fix it, but you are not required to.

12. Security

We take security seriously because the trust customers place in us depends on it. A summary of what we do:

A more detailed security posture page is at knorra.ai/security.

No system is perfectly secure. If you believe you have found a security issue, please email security@knorra.ai. We will acknowledge within 24 hours and respond responsibly.

13. Cookies and similar technologies

We use cookies and similar technologies for authentication, security, and remembering your preferences. We do not use third-party advertising or tracking cookies. Our website analytics (Plausible) operates without cookies in its default mode.

Details, including the specific cookies and how to disable them, are in our Cookie Policy.

14. Children

Knorra is a business product. We do not knowingly collect personal data from anyone under 16. If you believe a child's data has ended up in Knorra (for example, in a connected source), contact privacy@knorra.ai and we will remove it.

15. Changes to this policy

We will update this policy as the product evolves or as the law changes. When we make a material change (one that affects your rights or how your data is processed), we will:

For minor changes (typos, clarifications, link updates), we just publish the new version. The version history of this policy is available on request.

16. How to contact us

For privacy questions, data subject requests, or anything else covered by this policy:

Email: privacy@knorra.ai Post: Privacy, NEXTGEN SOFTWARE LTD, 85 Great Portland Street, London, England, W1W 7LT Company number: 14613977 ICO registration: ZC148593

For security disclosures: security@knorra.ai

For general support: support@knorra.ai

This policy is published in English. If we publish translations in future, the English version is the authoritative one in case of inconsistency.