1.Who is responsible for your information
This matters, because it decides who you ask about your information.
- Your Organisation is the responsible party for the documents it loads, the questions asked in Knova, and the answers produced. We process that material as its operator, on its instructions, under a written agreement as section 21 of POPIA requires. Requests about that information should go to your Organisation.
- We are the responsible party for the information we hold to run Knova itself — your account details, our security and audit records, and correspondence with us.
Knova is operated by RedRock Technologies (Pty) Ltd, registration number 2021/575742/07, of 66 Queen Victoria Road, Claremont, Cape Town, 7708, South Africa.
2.Visitors to our website
Most of this policy is about using Knova itself. If you have only visited our website, this is the part that applies to you — and it is short, because the site collects very little.
- The contact form. If you ask for a demo we receive your name, company, email address, your role, your company size and whatever you write in the message. We use it to reply and to arrange the demo, and for nothing else. It is delivered to us by EmailJS, a third party in the United States that turns the form into an email. We do not add you to a mailing list.
- A theme preference. If you switch the site between light and dark, that choice is kept in your own browser’s local storage. It never reaches us.
- No analytics and no tracking. The website runs no analytics, no advertising pixels and no cross-site tracking cookies, so we cannot tell you apart from any other visitor unless you contact us.
We keep enquiries for as long as we are in contact about them and for a reasonable period afterwards as a business record. Ask us and we will delete yours.
3.What we collect
| Information | Why we hold it |
|---|---|
| Name and email address | To create your account, sign you in, and send service email such as invitations and password resets. |
| Your Organisation and role | To show you only your Organisation's documents, and to decide what you may do. |
| Questions you ask and answers you receive | To show you your conversation history, and so your Organisation can review answer quality. |
| Ratings and written feedback on answers | To find answers that were unhelpful or wrong, and improve retrieval for your Organisation. |
| Usage records — number of requests, tokens used, timestamps | To operate the service, apply your Organisation's limits, and bill accurately. |
| Audit records of sensitive actions | To keep a record of who changed or removed what, for security and accountability. |
| Technical error diagnostics | To detect and fix faults. These may include a page address and browser details. |
| Documents your Organisation uploads | To answer questions from them. These may contain personal information if your Organisation chooses to include it. |
We do not use advertising trackers, we do not sell personal information, and we do not build profiles of you for marketing.
4.Why we may lawfully process it
Under POPIA, we rely on:
- Performance of a contract — to provide the service your Organisation has contracted for, including giving you an account.
- Legitimate interests — to keep the service secure, prevent misuse, diagnose faults, and keep proper business records.
- Legal obligation — where we must retain or disclose information by law.
- Consent — where we ask for it specifically, which you may withdraw at any time.
5.Artificial intelligence, and what we do not do with your data
To answer a question, Knova sends the relevant extracts from your Organisation’s documents, together with your question, to the model providers listed below. They process it to generate that one answer and return it. We engage them under terms that prohibit using that content for model training.
Answers are generated by a machine and can be wrong. We do not make decisions about you by automated means that produce legal consequences or similarly significant effects.
6.Who else processes it
We use the following operators. Each is bound to protect the information and to process it only on our instructions.
| Provider | Purpose | Where |
|---|---|---|
| Supabase | Database, authentication and document storage | European Union (Ireland) |
| Vercel | Application hosting and delivery | European Union / global edge |
| Anthropic | Generating answers from retrieved extracts | United States |
| OpenAI | Document and question embeddings; fallback answer generation | United States |
| Cohere | Ranking retrieved extracts by relevance | United States |
| Upstash | Rate limiting and operational caching | European Union |
| Sentry | Error monitoring and diagnostics | European Union / United States |
| Google Workspace | Sending service email (invitations, password resets, alerts) | United States / European Union |
| EmailJS | Delivering website enquiries to us as email — website visitors only, no customer data | United States |
7.Sending information outside South Africa
Your information is stored in the European Union, and some of it is processed by providers in the United States, as the table above shows.
Section 72 of POPIA permits this where the recipient is subject to a law or binding agreement giving substantially similar protection. Our European providers are subject to the GDPR. Our United States providers are engaged under contractual terms imposing equivalent protections and restricting what they may do with the information.
8.How long we keep it
- Account details — for as long as your account is active, then deleted or anonymised within 90 days of your Organisation removing you.
- Documents, conversations and feedback — until your Organisation deletes them, or until its agreement with us ends, after which they are deleted or returned as that agreement requires.
- Usage and audit records — retained longer where we need them for security, billing or legal purposes.
- Backups — deleted on their ordinary cycle, and protected by the same obligations while they exist.
9.How we protect it
- Encryption of data in transit.
- Separation of each organisation's data, enforced by the database itself rather than only by application code.
- Access limited to the few personnel who need it to operate or support the service.
- Audit logging of sensitive actions.
- Automated monitoring of the services we depend on, with alerting when something fails.
If a security compromise affects your personal information, we will notify your Organisation without undue delay, and the Information Regulator and affected people where POPIA requires it.
10.Your rights
Under POPIA you may:
- ask what personal information we hold about you, and be given access to it;
- ask us to correct information that is inaccurate, irrelevant, out of date or incomplete;
- ask us to delete information we no longer have grounds to keep;
- object to processing based on legitimate interests, on reasonable grounds;
- withdraw consent where we relied on it;
- complain to the Information Regulator.
If your request concerns documents or conversations, ask your Organisation — it is the responsible party for those, and we will pass any request we receive to them. For your account details, contact us directly.
The Information Regulator of South Africa can be reached at inforegulator.org.za or enquiries@inforegulator.org.za.
11.Cookies and similar technologies
We set only what the service needs to work: a cookie that keeps you signed in, and local storage in your browser for preferences such as your theme. We do not use advertising or cross-site tracking cookies.
12.Children
Knova is a workplace tool and is not intended for children. We do not knowingly collect the personal information of a child.
13.Changes to this policy
We may update this policy. When a change is material we will give notice through the service or to your Organisation. The date at the top shows when this version took effect.
14.Contact us
Information officer: Simon Barber — privacy@redrocktech.dev
RedRock Technologies (Pty) Ltd, 66 Queen Victoria Road, Claremont, Cape Town, 7708, South Africa.