Privacy Policy

Last updated: July 27, 2026

Knock AI (an unincorporated project) (“Knock AI,” “we,” “us,” or “our”) operates the website tryknockai.com and the related services described therein (collectively, the “Service”). This Privacy Policy describes the categories of personal information we collect, the purposes for which we process such information, the parties with whom we share it, and the rights available to you in respect of that information.

This Policy applies to two categories of individuals. “Users” are individuals who register for an account. “Recipients” are individuals whose business contact information is identified by a User through the Service. Please review Section 8 if you have received an email and wish to have your information removed.

1. Information We Collect From Users

We additionally record a count of visits to the website. To do so we apply a one-way, salted cryptographic hash to the visitor’s IP address so that repeat visits can be distinguished from distinct ones; the IP address itself is not stored, and the resulting value cannot be reversed to identify a visitor. We do not use advertising or cross-site tracking cookies. Cookies set by the Service are those necessary to keep a signed-in User authenticated.

2. Information We Collect Regarding Recipients

In the course of providing the Service, we collect business contact information, which may include an individual’s name, professional title or role, employer or affiliated institution, publicly available profile URL, and business email address. Such information is obtained from publicly accessible sources, including institutional faculty and staff directories, public job boards, corporate websites, public web search results, and licensed third-party data providers. We do not collect special categories of personal data and we do not compile profiles for advertising purposes.

Business email addresses are either obtained from a publicly accessible page or derived from an employer’s established address convention and subsequently validated through a verification provider. Each contact record retains a status field indicating the method by which its address was obtained.

With respect to such information, the User who initiates a campaign determines the information to be collected and the individuals to be contacted, and we process the information on that User’s behalf for the purpose of providing the Service. Where the General Data Protection Regulation applies, we rely on our legitimate interests in conducting business-to-business correspondence as our lawful basis for processing, as balanced against the interests and fundamental rights of the individuals concerned. Such individuals retain the right to object to processing at any time, as set forth in Section 7.

3. Google User Data and Limited Use Disclosure

Where a User elects to connect a Gmail account, the Service requests two restricted OAuth scopes, gmail.send and gmail.metadata. The first permits the transmission of messages on the User’s behalf. The second permits us to read message headers and thread identifiers (specifically the sender, recipient, subject, date, and thread of a message) and is used for a single purpose: to determine whether a Recipient has replied to a message sent through the Service, so that a follow-up message is never sent to a person who has already responded and so that any follow-up appears within the original conversation thread.

The gmail.metadata scope does not permit access to message bodies or attachments, and Google does not return such content under it. Neither scope permits us to modify or delete any message. We do not request any scope conferring access to the contents of the User’s mailbox. Header information is read at the time a follow-up is prepared. Of what we read, we retain only the Gmail thread identifier of the User’s own sent message, which is required in order to thread a follow-up correctly, together with an indication of whether a reply was received.

We use this authorization solely for the purpose of transmitting the specific messages a User has reviewed and expressly approved. Refresh tokens are encrypted at rest using AES-256-GCM and are decrypted exclusively in memory, within our sending worker, at the time of transmission. Such tokens are not written to logs, are not transmitted to any browser client, and are not disclosed to any third party.

Knock AI’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Accordingly, we do not use Google user data for the purpose of serving advertisements, we do not sell such data, we do not transfer such data except as necessary to provide or improve the sending functionality, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with User notice, and we do not use such data to develop, improve, or train generalized artificial intelligence or machine learning models.

Users may disconnect a Gmail account at any time through the Settings page, or may revoke authorization directly through the Google Account permissions page located at myaccount.google.com/permissions. Disconnection results in deletion of the stored refresh token.

4. Automated Content Generation

We transmit User campaign information and a Recipient’s publicly available professional information to a third-party model provider (OpenAI, L.L.C.) for the purpose of generating message drafts and for related processing steps, including the interpretation of a User’s stated objective and the extraction of contact details from publicly accessible pages. Such provider acts as our processor and is contractually prohibited from using the transmitted data to train its models. No message is transmitted to any Recipient prior to the User’s express approval, and Users may edit any draft prior to approval.

5. Disclosure to Third Parties

We do not sell personal information. We disclose personal information to service providers engaged to perform functions on our behalf, including the following:

• Supabase, for database, authentication, and file storage services.
• Vercel and our worker hosting provider, for application hosting services.
• Google, for transmission of approved messages via the Gmail API.
• OpenAI, for message generation services.
• Resend, for transactional and administrative email sent by us to Users (for example, waitlist and account notices). Messages you send to Recipients are not sent through this provider; they are sent from your own Gmail account.
• Email discovery and verification providers, for the identification and validation of business email addresses.
• Stripe, for payment processing services.
• Arcjet, for security and abuse-prevention services.

We may additionally disclose personal information where required by applicable law, legal process, or governmental request, or in connection with a merger, acquisition, financing, or sale of assets, in which event this Policy shall continue to govern such information until affected individuals receive notice of any change.

6. Retention and Deletion

We retain personal information for so long as an account remains active. Users may delete all associated data at any time through the Settings page by selecting “Delete account,” which removes campaigns, contact records, drafts, stored Gmail credentials, and the User profile. We retain a limited record evidencing that a deletion was performed, together with any records we are required to retain for tax, accounting, or fraud-prevention purposes. Messages already transmitted remain in the User’s Gmail sent folder and in the Recipient’s mailbox and cannot be recalled by us.

7. Your Rights

Subject to applicable law, including the General Data Protection Regulation, the UK GDPR, and the California Consumer Privacy Act as amended by the California Privacy Rights Act, you may have the right to request access to, correction of, deletion of, or portability of your personal information, to request restriction of processing, to object to processing conducted on the basis of legitimate interests, and to be free from discriminatory treatment for exercising any such right. We do not sell or share personal information as those terms are defined under the California Privacy Rights Act.

To exercise any right described in this Section, please contact us at support@tryknockai.com. We will respond within thirty (30) days. Individuals located in the European Economic Area or the United Kingdom may also lodge a complaint with their local supervisory authority.

8. Recipients of Messages Sent Through the Service

Messages transmitted through the Service are sent by an individual User from that User’s own Gmail account and are reviewed by that User prior to transmission. You may reply directly to the sender to request that no further messages be sent.

You may alternatively contact us at support@tryknockai.com, and we will delete your information from our systems and suppress your address from future campaigns conducted through the Service. No account is required and no explanation is necessary in order to make such a request. A request made under this Section shall also constitute an objection to processing for purposes of the General Data Protection Regulation.

9. Security

We maintain administrative, technical, and physical safeguards designed to protect personal information. Data is encrypted in transit and at rest. Row-level security controls isolate each User’s data within our database. Gmail credentials are subject to the additional application-layer encryption described in Section 3. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. International Transfers, Children, and Amendments

We are established in the United States and process personal information in the United States. Where required, we rely on Standard Contractual Clauses approved by the European Commission in respect of transfers from the European Economic Area or the United Kingdom. The Service is not directed to individuals under the age of eighteen (18) and we do not knowingly collect personal information from such individuals. We may amend this Policy from time to time. Where an amendment is material, we will revise the date set forth above and provide notice to account holders by email.

11. Contact Information

Knock AI (an unincorporated project)
10 Tavern Circle, Westford, MA 01886
support@tryknockai.com