Privacy

Last updated 18 October 2026

This page explains what personal data Knaxly collects when you use knaxly.com and the Knaxly app at app.knaxly.com, why, where it is kept, and what you can ask us to do with it.

Who we are

Knaxly is operated by KNAXLY LTD, a company registered in England and Wales (company number 17403507), registered office 103 Byewaters, Watford, WD18 8WH, United Kingdom. We are the controller of the personal data described here. You can reach us about anything on this page at support@knaxly.com, or through our contact form.

This website

knaxly.com itself sets no cookies and loads no analytics or advertising scripts. It is a static site. The one exception to it being entirely our own code is the contact page, described next.

The contact form

When you send a message through knaxly.com/contact, we receive the reason you chose, your name, email address, company name and country, and your subject and message. We send them as an email to our support inbox, where we use them only to reply to you and deal with your enquiry. We keep the email for as long as we need it for that, including any follow-up. We also keep a copy of it, as described below under “Where it is kept, and who processes it for us”.

The contact page uses Cloudflare Turnstile to check that a person, not a program, is sending the form. Turnstile runs in your browser. It sees your IP address and information about your browser and device, and it may store a small amount of data in your browser, under Cloudflare's own domain, to run the check. Cloudflare does this for us, as our processor. It also uses this information to improve how Turnstile detects bots, and for that purpose it is a controller under its own Turnstile privacy terms. We receive only the result of the check, with the time and the address of the page where it was completed.

The form is delivered by knaxly.com's own server-side function. When it can read your IP address reliably from the request, it uses a salted, one-way hash of that address to limit how many messages can be sent in a short time. It holds that hash only in its memory, for no more than twenty minutes, and never writes it to storage. Microsoft's monitoring for the function records an approximate location (city, region and country) derived from the IP address of each request to it, but not the address itself, and we keep those records for 90 days.

What we collect when you sign in to the app

You sign in with a Microsoft, Google or GitHub account. When you do, that provider tells us who you are, and we keep:

your name (or, if the provider gives none, your username or email address) and email address as the provider gives them, and whether the provider has verified that email address;
which provider you used and the identifier it assigns you, so we recognise you next time;
the organisations you create or join in Knaxly, your role in each, and when you last signed in.

We ask each provider only for your basic profile and email address. We do not receive your password, and we do not ask for access to your mailbox, files, contacts or repositories.

Sessions and security records

To keep you signed in and to protect accounts, we keep:

A session cookie (knaxly_session) on app.knaxly.com. It is essential to the service, cannot be read by scripts, and holds a random token. We store only a one-way hash of that token. A session ends after 8 hours without use, after 30 days at most, or when you sign out. Your browser keeps the cookie for up to 30 days, but it stops working as soon as the session ends.
A short-lived sign-in cookie that carries security values across the trip to your sign-in provider and back. It lasts at most 10 minutes.
Your browser's description of itself (its user agent) and a salted, one-way hash of your IP address, recorded with each session and each sign-in event. We keep the hash rather than the address itself. The providers that deliver our traffic, named below, necessarily see your IP address and may keep it in their own security logs; we do not receive or store it.
A record of sign-in events, such as a successful sign-in, a refused one, or a session being revoked, so that we can investigate misuse of an account.

Trust Center access requests

If you request access to private Trust Center resources, you first sign in to your existing Knaxly account. We keep the email address on that account, which sign-in method verified it and when we recorded that verification, your company, what you need to review, the date of the request, our decision, any review note, any access expiry or revocation, and whether the request and decision emails were accepted by our email service, failed or skipped. Acceptance means that the service queued the message; it does not prove that the mailbox delivered it. We use this information to assess the request, grant and remove access, notify you of the decision, and keep a record of the access decision.

The Trust Center does not create a second account. The request and any approval are attached to the same Knaxly account and session described above.

We use no analytics, advertising or tracking cookies in the app either.

Why we use it

To provide the service you signed up for: signing you in, keeping you signed in, and showing you the organisations you belong to. The legal basis is performance of our contract with you.
To keep accounts and the service secure. The legal basis is our legitimate interest in preventing fraud and misuse.
To answer messages you send us through the contact form or by email. The legal basis is our legitimate interest in responding to enquiries or, where you ask about becoming a customer, taking steps at your request before entering into a contract with you.
To prepare for meetings with people we correspond with, including by using our messages with them. The legal basis is our legitimate interest in running our meetings well.
To keep the contact form free of automated abuse, using Cloudflare Turnstile and the rate limit described above, and to check that the form works, using the monitoring records described above. The legal basis is our legitimate interest in keeping our service and our inbox secure.
To assess and administer requests for private Trust Center resources. The legal basis is our legitimate interest in answering security reviews and, where the request relates to becoming a customer, taking steps at your request before entering into a contract.

We do not sell personal data, and we do not use it for advertising.

Where it is kept, and who processes it for us

The app and its database run on Microsoft Azure in the Central US region, in the United States. Microsoft processes this data for us under its data protection terms. Because Knaxly is a UK company, keeping data in the United States is an international transfer, and we rely on the safeguards in those terms for it.

Requests to the app pass through Microsoft's global network (Azure Front Door), which may handle them in a country near you before passing them to Central US. It does not keep copies of the pages it delivers. This website is hosted on Azure Static Web Apps. Our domain names are run by Cloudflare, which also redirects visitors from www.knaxly.com to knaxly.com and sees their IP address when it does.

When you sign in, Microsoft, Google or GitHub handles the sign-in itself under its own privacy policy, as an independent controller. We receive from them only what is listed above.

Email you send us, including messages from the contact form, is handled by Google Workspace. Contact-form messages reach that inbox through Azure Communication Services, Microsoft's email service, which also sends Trust Center request alerts and decisions and processes them in its United States data location. The alert to our reviewer identifies the account and company, but does not include what you wrote about your intended use.

We also keep a copy of our email, sent and received, including contact-form messages, on a server in Nuremberg, Germany, hosted by Hetzner. The copy holds each message, the names of its attachments and any attachment we open or use, and from it we keep a contact record for each person we correspond with, so that we can find, sort and answer our correspondence and prepare for meetings. UK law recognises Germany as giving personal data adequate protection.

We keep each thread in that copy for no more than 24 months after the last message in it. When we delete a message from our mailbox for good, it is removed from the copy within a day, along with the attachments, drafts and reminders made from it, and its details are cleared from our activity records. A contact record is removed once nothing to or from that person is left in the copy and our last exchange with them was more than 24 months ago, unless we have added our own notes to it, or you have asked us to forget you, in which case we keep a record of that so that you are not added again. Backups of that server keep a copy of anything removed from it for up to about 53 weeks.

We use an AI service to help us sort email we receive, including contact-form messages, draft replies and prepare for meetings. When we do, the messages involved, and related messages and contact details from the copy described above, are processed by Anthropic, the AI provider we use for this, which stores them in the United States and may process them in other countries. A person at Knaxly reads and approves every reply before it is sent.

How long we keep it

We keep your account data for as long as your account exists. Our present Trust Center retention process is manual: an authorised operator applies a queue rule intended to remove pending requests 90 days after the request, denied requests 90 days after the decision, and revoked requests and expired approvals 365 days after the decision or expiry. We keep an approval while it is active. This is not yet an automated daily deletion schedule, and we will update this notice when it is automated and monitored. When a session ends it can no longer be used, but we keep the record of it, including the browser description and IP hash, alongside the sign-in records described below. We have not yet set a retention period for records of sign-in events, so for now we keep them until we do. We will set one and publish it here before the service is generally available. When you ask us to delete your account, we will delete your account data, including your personal data in those records and your Trust Center request, within one month. Copies in the app's database backups are overwritten within 14 days after that.

Your rights

Under UK data protection law you can ask us for a copy of the personal data we hold about you, and ask us to correct it, delete it, restrict how we use it, or give it to you in a portable form. You can object to any use of it that we base on our legitimate interests, such as keeping accounts secure or answering your messages. Email support@knaxly.com and we will respond within one month.

If you are unhappy with how we have handled your data, you can complain to the UK Information Commissioner's Office at ico.org.uk. We would appreciate the chance to put it right first.

Children

Knaxly is a service for businesses and is not intended for anyone under 18.

Changes

If we change how we handle personal data, we will update this page and the date at the top. If a change materially affects you, we will tell you before it takes effect.