Summary: We collect only what we need to provide our services. We don't sell your data. We don't use your uploaded data to train AI models. Your research data remains yours. Uploaded datasets are processed transiently and are not stored as persistent datasets on the platform.
1. Introduction
Knowsis (Pty) Ltd ("Knowsis", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Data Alchemy Platform and our related services.
We comply with applicable data protection laws, including the South African Protection of Personal Information Act (POPIA) and the European Union General Data Protection Regulation (GDPR) where applicable.
This policy explains the legal basis on which we process each category of information. Section 3 sets out those bases. Where we rely on your consent, we ask for it separately and you can withdraw it at any time.
2. Information We Collect
2.1 Account Information
When you create an account, we collect:
- Name and email address
- Company name (optional)
- Password (stored as a one-way hash, never in readable form)
- Billing information (processed by our payment provider)
2.2 Usage Data
We automatically collect information about how you use our services:
- Log data (IP address, browser type, pages visited, time spent)
- Feature usage and session activity
- Error logs and performance data
- AI feature interaction data (e.g., prompts submitted to the Alchemist chatbot and responses generated), for operating, securing, and improving the service
2.3 Research Data You Upload
When you upload data for analysis ("Your Data"), we process it solely to provide the analytical services you have requested. Your Data may include survey responses, customer information, or other research datasets.
We do not store uploaded datasets as persistent datasets on the platform. Your Data is processed within your session and becomes unavailable when you close or end the session. You are responsible for maintaining your own copies of datasets and for downloading any outputs (reports, charts, models) you wish to keep.
Important: We do not use your uploaded datasets to train machine learning models, and we do not use them for any purpose other than providing you with the analytical services you requested. We do not sell your data.
Some of our services send data to a named third-party AI provider to perform part of the analysis. What leaves our systems depends on which product you are using, and is set out product by product in section 4.1. The Data Alchemy Platform and the Persona Engine send nothing: they run on Knowsis-operated hardware in Cape Town using a locally hosted open-source model.
3. How We Use Your Information
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Provide and maintain the Services | Account info, Your Data | Contract performance |
| Process payments | Billing information | Contract performance |
| Send service communications | Email address | Legitimate interest |
| Improve our services | Usage data (aggregated) | Legitimate interest |
| Improve AI features (Alchemist chatbot) and quality assurance | De-identified AI interaction samples; aggregated usage data | Legitimate interest |
| Provide customer support | Account info, correspondence | Contract performance |
| Comply with legal obligations | As required | Legal obligation |
4. Data Sharing and Disclosure
We do not sell your personal information or Your Data. We may share information only in the following circumstances:
4.1 Service Providers
We use third-party service providers who process data on our behalf. Each one is named below, with what it is used for, what data it receives, and where it processes that data.
| Provider | Purpose | Data it receives | Region |
|---|---|---|---|
| Anthropic PBC (Claude API) | Text analysis inside specific products | Varies by product – see 4.1.1 below | United States / global |
| Twilio SendGrid | Delivery of report emails | Your email address and the report sent to it | United States |
| Paystack Payments South Africa (Pty) Ltd | Card payment processing | Your billing details | South Africa / regional |
| Formspree | Contact form on knowsis.net | Whatever you enter in the form | United States |
| Netlify | Hosting for the knowsis.net website | Standard web request data, including your IP address | United States |
| PostHog | Product analytics, including session replay | Session-level behavioural data – which pages you visit, what you click, and a replay of the session with all form inputs masked | United States |
| Google LLC (Google Drive) | Off-site backups | Encrypted backup archives | United States |
We engage each of these providers under their commercial terms of service, which limit their use of the data to providing that service to us.
4.1.1 What leaves our systems, by product
Our products do not all work the same way, and the difference matters. Some send no data outside our own hardware. Some send only aggregated statistics. Two send raw respondent text. Here is each one.
- Data Alchemy Platform – Nothing leaves our systems. Analysis and AI features run on Knowsis-operated hardware in Cape Town using a locally hosted open-source model. Uploaded datasets are not sent to any external AI provider.
- Persona Engine – Nothing leaves our systems. It uses the same locally hosted open-source model.
- Slide and report rendering – Nothing leaves our systems. Rendering runs on Knowsis-operated hardware.
- Questionnaire Audit – Your questionnaire and your brief are sent to Anthropic's API for analysis. No respondent data is sent, at any point.
- Knowsis Tables – Aggregated table cells and index statistics are sent to Anthropic's API to write the narrative summary. No respondent-level data is sent.
- cxCatalyst – Raw respondent open-ended responses are sent to Anthropic's API for polarity scoring and labelling. The narrative summary is written from aggregated results only.
- Verbatim Coder – Raw respondent open-ended responses are sent to Anthropic's API for coding. This is the core function of the product.
Anthropic's commercial terms provide that inputs and outputs submitted through their API are not used to train their models.
Hosting and processing are separate questions, so we state both. The Data Alchemy Platform and the Persona Engine run on Knowsis-operated hardware in Cape Town. The knowsis.net website is hosted by Netlify in the United States. The specific functions listed above call the named providers in the regions shown.
4.2 Legal Requirements
We may disclose information if required by law, regulation, legal process, or government request.
4.3 Business Transfers
In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will notify you of any such change.
5. Data Security
We protect your information with encryption in transit (TLS) and access controls on our administrative and production systems. Knowsis is a small consultancy, and only a small number of people have access to production systems.
While we strive to protect your information, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.
6. Data Retention
- Account information: Retained while your account is active, plus 2 years for legal and accounting purposes
- Your Data (uploaded research data): Not retained as a persistent dataset. Processed transiently within a session and becomes unavailable when the session ends
- De-identified AI interaction samples (Alchemist chatbot): May be retained for quality review and service improvement. These samples are not linked back to individual users. Retained for up to 12 months or until no longer needed for improvement purposes
- Usage logs: Retained for 12 months
- Payment records: Retained for 7 years as required by law
7. Your Rights
Depending on your location, you may have the following rights regarding your personal information:
7.1 For All Users
- Access: Request a copy of your personal data
- Correction: Request correction of inaccurate data
- Deletion: Request deletion of your data (subject to legal requirements)
- Export: Download your generated outputs/reports during your session, and request export of account-related information where applicable
7.2 Additional Rights for EU/UK Residents (GDPR)
- Restriction: Request restriction of processing
- Objection: Object to processing based on legitimate interests
- Withdrawal: Withdraw consent at any time
- Complaint: Lodge a complaint with a supervisory authority
7.3 Additional Rights for South African Residents (POPIA)
- Request confirmation of whether we hold your personal information
- Object to processing on reasonable grounds
- Lodge a complaint with the Information Regulator
To exercise any of these rights, please contact us at info@knowsis.net.
8. International Data Transfers
Your information may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place for such transfers, including:
- Standard contractual clauses approved by relevant authorities
- Data processing agreements with service providers
- Compliance with applicable data transfer mechanisms
9. Cookies and Tracking
We use cookies and similar technologies to maintain your session and authentication, remember your preferences, understand how you use our services, and measure our marketing.
When you first visit knowsis.net you are shown a cookie consent banner. Cookies are grouped into three categories: Necessary (always on — your session, security tokens, and your consent choice), Analytics, and Marketing. Analytics and marketing cookies are switched off until you consent to them, and you can accept, decline, or change your choice at any time using the Manage Cookies link in the footer of every page. Your choice is stored in a first-party cookie named kns_consent for 12 months. For our Google advertising and analytics tags we use Google Consent Mode v2, so those tags collect nothing until you consent, and PostHog and the LinkedIn Insight Tag do not load at all without consent. If your browser sends a “Do Not Track” signal, all optional categories default to off.
For the full list of cookies we use — including each cookie's name, purpose, provider, and lifespan — and details of how to withdraw consent, see our Cookie Policy. You can also control cookies through your browser settings; note that disabling necessary cookies may affect the functionality of our services.
10. Children's Privacy
Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Services. Your continued use of the Services after changes take effect constitutes acceptance of the updated policy.
12. Contact Us
If you have questions about this Privacy Policy or our data practices, please contact us:
Knowsis (Pty) Ltd
Data Protection Inquiries
Email: info@knowsis.net
Website: https://knowsis.net
Information Regulator (South Africa)
If you are a South African resident and wish to lodge a complaint, you may contact:
The Information Regulator (South Africa)
Website: https://inforegulator.org.za