Overview
Knock is a hosted subscription billing platform: products, plans, quotes, subscriptions, recurring invoices and payments, with an AI assistant called Pip. This policy explains what personal data we handle, why, and what control you have over it.
Knock is operated as a hackathon project. We keep data collection deliberately small, and we describe only what the product really does.
Data we collect
- Account data: your name, email address, role (admin, staff or customer) and a bcrypt hash of your password. We never store your password in readable form.
- Billing data you or your team enter: customers, products, plans, taxes, discounts, quotes, subscriptions, invoices and payment records, including GST details and INR amounts.
- Pip conversations: the messages you send to Pip, any files you attach, and its replies, stored so your chat history is available to you.
- Contact messages: your name, email and message if you write to us through the contact form, plus a short-lived record of your IP address in server memory to limit abuse.
- Technical data: a session cookie, standard server logs (IP address, user agent, request path) and error reports needed to keep the service running.
How we use data
- To provide the service: authenticate you, generate invoices, track subscriptions and show reports.
- To send transactional email such as password reset links and billing notices.
- To answer Pip requests and contact messages.
- To secure the service, prevent abuse and debug faults.
We do not sell personal data, we do not run advertising, and we do not use third-party analytics or tracking cookies.
Pip and AI providers
When you talk to Pip, the text of your conversation and the billing context needed to answer you are sent to the configured AI provider (currently Hack Club AI or OpenAI, depending on deployment). Do not paste information into Pip that you would not want processed by that provider. Providers act as sub-processors; see the Data Processing page.
Retention
Account and billing data is kept while your account is active so invoices and tax records remain available. Reset tokens expire after one hour and are stored only as hashes. Contact messages are kept until handled and then deleted within a reasonable period. When you ask us to delete your account we erase or anonymise personal data, except records we must keep for tax or legal reasons.
Your rights
Depending on where you live, including under India's Digital Personal Data Protection Act, 2023 (DPDP Act) and GDPR-style laws, you may have the right to access your data, correct it, erase it, withdraw consent, receive a copy, and raise a grievance.
To exercise any of these rights, contact us through the contact page. We will respond within a reasonable time, and no later than any period required by applicable law.
Security
We protect data with hashed passwords, httpOnly session cookies, server-side role checks and expiring reset links. Details are on the Security page. No system is perfectly secure, and we cannot guarantee absolute security.
Children
Knock is a business tool and is not directed to children under 18. We do not knowingly collect data from children.
Changes to this policy
We will update this page when our practices change and revise the date at the top. Material changes will be announced in the product or by email.
Contact and grievances
For privacy questions or to reach our grievance contact, use the contact page and mark your message as a privacy request.