Privacy Policy

1. Information We Collect

We collect the minimum information required to deliver our services effectively:

• Account & contact details: name, email address, company name, role, and any optional profile information you provide.
• Project inputs: briefs, copy, imagery, credentials, feedback, and other direction shared through our dashboard, forms, or chat.
• Transaction data: payment confirmations, subscription status, invoices, and related metadata processed via Stripe.
• Usage data: log information, device/browser details, and interaction events that help us secure the platform and improve user experience.
• Support communications: email threads, chat logs, and call notes when you contact our team.

We do not intentionally collect sensitive personal information. Please remove or anonymise any sensitive data before sharing project material.

2. How We Use Information

We use the information we collect to:

• Provide, operate, and maintain our service deliveries, retainers, and client dashboard.
• Plan production schedules, allocate team members, and collaborate efficiently on your requests.
• Process payments, send invoices, and manage subscription billing.
• Deliver project updates, collect feedback, and respond to support enquiries.
• Monitor platform performance, detect security issues, and prevent misuse.
• Comply with legal obligations and enforce our agreements.

We may also send service announcements or curated updates. You can opt out of non-essential communications at any time by contacting us.

3. Legal Basis

Depending on your location, we rely on one or more of the following legal bases to process personal information:

• Performance of a contract when we deliver purchased services or active retainers.
• Legitimate interests such as securing our infrastructure, improving workflows, and communicating important service updates.
• Compliance with legal obligations, including finance and tax record keeping.
• Consent for optional features, testimonials, or marketing communications.

4. Sharing & Disclosure

We only share personal information with trusted partners when necessary:

• Infrastructure & hosting: providers such as Neon, Cloudflare, and Netlify to host our platform and store project data.
• Payments: Stripe to process one-off payments and recurring retainers.
• Communications & analytics: tools that help us manage email, chat, project delivery, and website analytics.
• Professional advisors: legal, accounting, or compliance partners when needed.
• Legal authorities: when required to respond to lawful requests or to protect our rights and users.

We do not sell personal information. Vendors are only given access to the minimal data needed to perform their services and are bound by confidentiality obligations.

5. Data Retention

Project data and account history are kept for as long as you maintain an active relationship with us, and thereafter for a reasonable period to meet legal, accounting, or audit requirements. You may request deletion of non-essential materials at any time; however some records (e.g., invoices, contractual agreements) must be retained for compliance.

6. Security

We implement administrative, technical, and physical safeguards designed to protect against unauthorised access, alteration, disclosure, or destruction of information. These include access controls, encryption in transit, staging environments for QA, and regular security reviews. No method of transmission or storage is completely secure, so please notify us immediately if you believe your account has been compromised.

7. International Transfers

Knowd operates remotely and may store data on infrastructure located outside New Zealand, including the United States and the European Union. Where we transfer personal data from the EEA or UK to a third country, we ensure appropriate safeguards are in place through Standard Contractual Clauses (SCCs), vendor certification programmes (e.g., EU-US Data Privacy Framework), or comparable contractual protections.

8. Your Rights

You may request to:

• Access the personal information we hold about you.
• Correct or update inaccurate or incomplete information.
• Request deletion of information we are not required to retain.
• Object to certain processing or withdraw consent for optional uses.
• Request a portable copy of your personal data in a structured, machine-readable format.
• Restrict processing in certain circumstances, such as while a correction request is being reviewed.

To exercise these rights, email hello@knowd.nz. We may need to verify your identity before completing your request.

New Zealand — Privacy Act 2020

Under the NZ Privacy Act 2020, you have the right to access and correct your personal information. If you believe we have breached the Privacy Principles, you may complain to the Office of the Privacy Commissioner (privacy.org.nz). We will work with you to resolve any concerns before escalation.

European Economic Area & UK — GDPR / UK GDPR

If you are located in the EEA or UK, you have additional rights under the GDPR and UK GDPR respectively, including the right to lodge a complaint with your local supervisory authority. For EU/UK data protection enquiries, contact us at hello@knowd.nz and we will route your request to our data protection contact.

We do not engage in automated decision-making or profiling that produces legal or similarly significant effects. Where we process data based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

9. Third-Party Links

Our site may contain links to third-party websites. We are not responsible for the privacy practices of external sites and encourage you to review their policies before providing any information.

10. Updates

We may update this policy from time to time. When we make changes, we will revise the "Last updated" date above and, where appropriate, notify you through the dashboard or by email.