Privacy Policy

1. Scope and roles

This Policy applies to personal information processed through the Knockwell websites, web application, customer support, billing, sales, and related business operations. It does not apply to a third party website, application, or service that has its own privacy policy.

When a business customer places information about its sales representatives, buyers, contacts, prospects, or accounts into Knockwell, that customer decides why and how the information is used. For that Customer Data, the customer generally acts as the business or controller and Knockwell acts as its service provider or processor. The customer is responsible for providing required notices, obtaining required permissions, responding to rights requests, and ensuring that its instructions comply with law.

When we process account registration, billing, website, support, security, and direct business relationship information for our own operational purposes, Knockwell acts as the business or controller.

2. Information we collect

Information you provide directly

• Account information. Name, work email address, password credentials handled by our authentication provider, company name, role, seat count, invitation information, and account preferences.
• Customer Data. Account and prospect names, business addresses, contact names, roles, business phone numbers, email addresses, social profiles, websites, public business profile links, notes, account history, sales activities, calls, texts, visits, tasks, follow ups, samples, orders, objections, outcomes, photos, and other content users choose to enter.
• Voice and AI inputs. Microphone audio you choose to record, speech transcripts, typed notes, corrections, prompts, and limited context submitted to create an editable activity or account draft. Recorded audio is sent through Knockwell to Google's Gemini API for transcription or drafting. Knockwell does not save raw microphone audio as a customer recording or CRM attachment. A browser or device speech service may also process audio for the live transcript preview. See Section 5 for details.
• Billing and transaction information. Subscription plan, licensed seat quantity, Stripe customer and subscription identifiers, billing status, invoice details, and limited payment method details such as brand and last four digits. Full payment card numbers are collected and processed by Stripe, not Knockwell.
• Resource requests. When you request a downloadable resource, we collect your email address, optional company name and processing consent. We store these in HubSpot to handle your request. Downloading does not subscribe you to marketing emails. Prices you enter in the resource comparison tool stay in your browser.
• Communications. Messages, demo requests, support requests, feedback, and any attachments or information you send us.

Information collected automatically

• Device and usage information. IP address, browser type, device type, operating system, language, referring page, pages or features used, timestamps, error information, and security events.
• Location and route information. With device permission, approximate or precise device location used to rank nearby accounts, calculate distance, and help plan a route. Account locations, selected destinations, mileage limits, and route preferences may also be processed.
• Storage and session information. Authentication tokens, session state, offline activity queues, route planning preferences, and interface settings stored in cookies, browser storage, or similar technologies.

Information from other sources

• Information supplied by a customer's owner, administrator, or another authorized user.
• Business and account information from public websites, maps, directories, social profiles, Google business listings, or other third party sources.
• Subscription, payment status, fraud, and transaction information from Stripe.
• Authentication and security information from Supabase and other infrastructure providers.

Please do not place Social Security numbers, payment card numbers, medical records, biometric identifiers, government identification numbers, or other highly sensitive personal information in free text fields, notes, photos, or uploads unless Knockwell has expressly agreed in writing to support that information.

3. How we use information

We use personal information to:

• create and administer accounts, organizations, roles, invitations, and subscriptions;
• provide daily planning, account prioritization, route tools, account preparation, activity capture, voice transcription, AI assisted drafting, reporting, and team management;
• process payments, maintain subscription records, prevent fraud, and provide billing support;
• authenticate users, maintain organization separation, monitor service integrity, investigate abuse, and protect users and the service;
• respond to questions, provide support, send service messages, and communicate about features or changes;
• diagnose errors, measure performance, improve usability, develop features, and conduct internal research using aggregated or deidentified information where practical;
• enforce agreements, comply with law, establish or defend legal claims, and protect rights, safety, and property; and
• send marketing communications where permitted by law. You may opt out of marketing email at any time. You will still receive necessary service, billing, security, and legal notices.

We do not use Customer Data to advertise to a customer's buyers or contacts. We do not make eligibility, credit, employment, housing, insurance, healthcare, or other legally significant decisions about individuals using Customer Data.

4. How we disclose information

We may disclose personal information in the following circumstances:

• Within the customer's organization. Owners, administrators, managers, and authorized users may see information based on their role and organization settings. Customers control who they invite and are responsible for removing access when it is no longer appropriate.
• Service providers. Vendors help us host, authenticate, secure, support, bill for, analyze, and operate Knockwell. Current categories include cloud hosting, database, authentication, payment, product analytics, mapping, geocoding, business information, speech, AI processing, email, support, and security providers. Providers used by the current service include Supabase, Stripe, PostHog, Google services (including Gemini and Maps), Resend for email delivery, Vercel, HubSpot for our own business contacts and resource requests, and OpenAI hosting infrastructure. Their role and the information sent to them depend on the feature used.
• Customer directed integrations. We disclose information when a customer enables an integration, opens a third party link, sends information to another service, or otherwise directs us to do so.
• Legal and safety reasons. We may disclose information if we reasonably believe it is necessary to comply with law or legal process, respond to lawful requests, protect a person from harm, investigate fraud or abuse, enforce our agreements, or protect rights, property, and security.
• Business transactions. Information may be disclosed in connection with financing, due diligence, a merger, acquisition, reorganization, sale of assets, insolvency, or similar transaction, subject to appropriate confidentiality protections.
• Professional advisers. We may disclose information to attorneys, accountants, insurers, auditors, and other advisers who are subject to duties of confidentiality.
• With consent. We may disclose information for another purpose after providing notice and obtaining any consent required by law. SMS opt-in data and consent are excluded from these additional consent-based disclosures.

No sale or targeted advertising. Knockwell does not sell personal information for money. Knockwell also does not share personal information for cross context behavioral advertising as those terms are defined by applicable United States state privacy laws. If that practice changes, we will update this Policy and provide any legally required choices before the change applies.

SMS messaging and mobile information

If you opt in to text messages from Knockwell, we collect your mobile number, message content, delivery information, and records of your consent and opt-out choices. We use this information to provide the software information, demo scheduling, trial assistance, or customer support you requested. Promotional software messages require a separate express written opt-in; providing a phone number or using Knockwell does not by itself enroll you.

Mobile phone contact information and SMS opt-in data and consent will not be sold or shared with third parties or affiliates for their marketing or promotional purposes. We may provide the information necessary to deliver and manage your messages to service providers acting on our behalf, including Dialpad and messaging carriers, and record consent and follow-up preferences in our CRM, HubSpot. These providers may use it only to provide those services, not for their own marketing. The other disclosure provisions in this Policy do not authorize sharing SMS opt-in data or consent for third-party marketing.

Reply STOP to unsubscribe from texts, or HELP for assistance. You may also contact mo@knockwell.com. We retain the records reasonably needed to honor your preferences and document consent under Section 7. See our SMS messaging terms for message frequency, rates, and additional details.

5. AI, voice, maps, and location

AI assisted activity drafts

When a user asks Knockwell to turn a recording, transcript, or note into a structured activity or account draft, the submitted audio or text and limited context needed for the request may be sent to Google's Gemini API. The output is returned as an editable draft. A user must review and choose whether to save it. We may also use local rules in the application to create a draft without an external AI request.

Speech recognition

When you start a recording and grant microphone permission, Knockwell captures audio in your browser and sends the recording through its authenticated voice service to Gemini to produce a transcript or draft. Browser or device speech recognition may separately provide a temporary live preview and may send audio to that provider under its own privacy terms. Knockwell does not retain the raw recording as a saved customer audio file; provider processing and retention are governed by the applicable provider terms and settings. This is not a promise of zero provider retention. Users should not record a confidential conversation or another person without all consent required by law.

Maps, business information, and routes

Mapping and account research features may send an address, coordinates, search terms, map view, IP address, and device information to Google or another provider used by the feature. Opening a Google Maps, business directory, social profile, website, or similar link takes the user to a third party service governed by its own terms and privacy policy.

Google Maps Platform features are subject to the Google Maps Platform Terms of Service. Google's handling of information is described in the Google Privacy Policy.

Location choices

Device location is used only after the user or device grants permission. A user may deny or revoke that permission in browser or device settings, though nearby account ranking and route planning may be less accurate. Customers should configure employee devices and provide workforce notices as required by law.

6. Cookies and local storage

Service storage

Knockwell uses cookies and browser storage to authenticate users, preserve session state, continue signup and checkout, and protect the service. Local storage, session storage, IndexedDB, and caches also support saved preferences, draft recovery, offline activity queues, and the application shell. Browser storage can contain unsent work, so deleting it before synchronization may discard that work. Storage duration depends on its purpose: session storage lasts for the browser tab's session, while persistent storage and caches may remain until the application or your browser clears them.

Website and product analytics

We use PostHog to understand public website traffic, campaign sources, page engagement, demo-video playback, performance, and clicks toward a trial or demo booking. When configured, website analytics starts when a page loads without an in-site accept/reject prompt. Random browser identifiers in local storage allow us to recognize repeat visits from the same browser until that storage is cleared. These identifiers do not identify a named person, and counts may differ across browsers, devices, or cleared storage. We do not use third party advertising cookies.

Public website session replay and heatmaps help us understand scrolling, clicks, and navigation. Replay masks page text, input values, and element attributes, and blocks forms, editable regions, and embedded frames. It does not record microphone or camera media, canvas contents, console logs, or network request/response bodies or headers. New website replays are retained for 30 days. This public-site recording does not extend into the signed-in customer application.

We collect limited campaign labels for source, medium, campaign, and creative placement. Current campaign labels last up to 30 minutes after the last page load in a tab; the first attributed campaign is retained locally for up to 30 days. We remove URL query strings and unrecognized fragments before website recording starts and sanitize analytics URLs. We do not send recipient-specific outreach references to PostHog. Broad form/interaction autocapture and person profiles remain disabled, and stored client IP addresses are discarded. Network requests still transmit an IP address to the receiving provider. We do not intentionally send Customer Data, contact details, account or user identifiers, notes, transcripts, prompts, AI responses, addresses, or precise location through this analytics layer.

The footer's “Exclude this browser from website analytics” control stops website analytics and contact-linked outreach measurement in this browser. The choice is saved locally until changed or browser storage is cleared; it must be set separately on each browser/device. Browser Do Not Track and Global Privacy Control signals also disable public website analytics. These choices do not prevent use of the website or change necessary application storage. The customer application's separate analytics continues to use session-scoped identifiers without session replay.

Links in direct business outreach

Links in our individual sales emails may contain a random-looking reference associated with the intended recipient's HubSpot contact record. When this measurement is enabled, opening a link lets us associate the visit, estimated active reading time, public pages viewed, pricing views, and demo, trial, or route-planner interactions with that record so we can prioritize relevant follow ups. This measurement is separate from PostHog. We do not send the recipient's identity or outreach reference to PostHog, record keystrokes or form contents, or measure activity inside the customer application through this feature. A forwarded link or an automated security scan can create misleading attribution; a visit is not proof that a particular person read the email or bought anything.

The reference is removed from the displayed URL and kept in session storage for up to 30 minutes in that browser tab. Direct visits without the reference are not linked to a sales contact by this feature. Opening the original email link again can start another attributed visit. You can stop measurement for the current tab using the "Stop linking this visit to my email" button in the website footer. We also disable this separate measurement when the browser sends Do Not Track or Global Privacy Control. You can contact us to stop future contact-linked measurement or request deletion of your outreach activity.

Browser choices

Most browsers let users delete or block stored data. Blocking necessary storage may prevent sign in, offline capture, checkout, or other core features from working correctly. A mobile device or browser may also offer separate controls for location, microphone, and notifications.

PostHog is configured to respect the browser's Do Not Track signal where that signal is available. Public website analytics also honors Global Privacy Control. We do not currently sell personal information or share it for cross context behavioral advertising. Contact us using Section 11 to make a privacy request or ask about your choices.

7. Retention

We retain information for as long as reasonably necessary to provide the service, maintain the customer relationship, satisfy the purposes described in this Policy, comply with legal and accounting obligations, resolve disputes, enforce agreements, prevent fraud, and maintain appropriate business records.

Retention depends on the type of information, the customer's instructions, the sensitivity of the information, legal requirements, and the reason it was collected. Customer Data is generally retained while the customer's account is active and for a limited period after termination to support recovery, security, backups, disputes, and legal obligations. Backup copies may remain until they are overwritten in the ordinary backup cycle.

Customers should export information they need before termination. We may delete Customer Data after the account ends, subject to the agreement and applicable law. Deidentified or aggregated information that cannot reasonably identify an individual may be retained and used for legitimate business purposes.

8. Security

We use administrative, technical, and physical safeguards designed to protect personal information. Measures include authenticated access, organization based data separation, role based controls, encrypted network transport, restricted provider credentials, private storage for customer photos, logging, and vendor access controls. No internet service, transmission, or storage method is completely secure, and we cannot guarantee absolute security.

Customers and users are responsible for strong unique passwords, secure devices, appropriate roles, prompt removal of former users, and keeping credentials confidential. Contact us immediately at mo@knockwell.com if you believe an account or information has been compromised.

9. Privacy rights

Your choices

• Update account and profile information through the service or your organization administrator.
• Revoke location or microphone permissions through browser or device settings.
• Opt out of marketing email by using the unsubscribe method in the message or contacting us.
• Ask to access, correct, delete, or export personal information, or object to or restrict certain processing, where applicable.

Customer Data requests

If your information was placed in Knockwell by one of our business customers, please contact that customer first. We will assist the customer with a verified request as required by law and our agreement. We may refer your request to the customer because it controls the relevant records.

United States state privacy rights

Depending on your state of residence, the law and its applicability thresholds may provide rights to know or access personal information, correct inaccuracies, delete information, obtain a portable copy, opt out of certain sales, sharing, targeted advertising or profiling, limit certain uses of sensitive information, appeal a denied request, and receive equal service without discrimination for exercising a right.

To submit a request or appeal, email mo@knockwell.com with the subject “Privacy request” and describe the right you wish to exercise. We may request information reasonably necessary to verify your identity, authority, state of residence, and relationship to Knockwell. An authorized agent may submit a request where permitted by law, but we may require proof of authorization and verification directly from the individual.

We will respond within the period required by applicable law. If we deny a request, we will explain the basis when required and provide appeal instructions. We do not discriminate against a person for exercising an applicable privacy right.

California notice

The categories of personal information described in Section 2 may include identifiers, customer records, commercial information, internet or network activity, geolocation, audio or transcript information, professional information, and inferences drawn to support account prioritization or service features. We collect these categories from the sources and for the purposes described above, and disclose them to the categories of recipients in Section 4. We do not sell or share these categories for cross context behavioral advertising. We do not knowingly sell or share the personal information of anyone under 18.

10. Other important information

Business service for adults

Knockwell is a business service intended for authorized users who are at least 18 years old. It is not directed to children, and we do not knowingly collect personal information directly from children under 13. If you believe a child has provided personal information to us, contact us so we can investigate and delete it where appropriate.

United States operation

Knockwell is operated from the United States. Information may be stored and processed in the United States and other locations where our providers operate. Those locations may have data protection laws different from the laws where you live. A customer that needs a specific international transfer mechanism or data processing addendum should contact us before placing regulated international personal data in the service.

Not a healthcare service

Knockwell is not designed to store protected health information and is not offered as a service compliant with the Health Insurance Portability and Accountability Act unless we expressly agree otherwise in a signed writing.

Changes to this Policy

We may update this Policy to reflect changes in the service, law, or our practices. We will post the updated version and change the “Last updated” date. If a change materially affects how we use personal information, we will provide additional notice when required by law. Continued use after the effective date is subject to the updated Policy.

11. Contact us

For privacy questions, requests, complaints, or appeals, contact:

Please use “Privacy request” in the subject line. If your request concerns Customer Data controlled by a Knockwell customer, identify that customer so we can route the request appropriately.