Privacy policy for account data, business documents, and service operation.

At signup, Kognarit collects the contact person's full name, the business name, email address, phone number, address or city, country of registration, industry, an optional website address, and a password, which is stored only as a one-way hash. Kognarit also records when the client accepted the Terms of Service, this Privacy Policy and the Acceptable Use & Compliance Policy, and which version of each was accepted.

This information is used for account creation, account management, compliance screening, support, billing, and service operation. Clients may later add further account details, such as a website domain or a logo, through the dashboard.

Clients may upload business documents and related material through the dashboard as part of the knowledge-base setup path.

Those uploaded documents are used to build the client's AI knowledge base so the service can answer from the client's own business material.

The quality and relevance of the assistant depend on the quality and relevance of the material provided by the client.

Client information is used to operate the service, maintain the account, screen the account against sanctions data, support onboarding, manage billing, issue notices, and keep the service functioning correctly.

Business documents and related uploaded material are used for the knowledge-base path connected to the client's own service instance.

Technical, operational, and usage information may also be processed when needed for security, abuse protection, billing, diagnostics, and service reliability. Online card checkout through TBC Bank is not currently available and is pending approval and integration; until then, setup payments and invoices are paid by bank transfer arranged with Kognarit support. Kognarit does not store payment card details.

Email addresses and account contact information may be used for verification, password reset, account notices, billing notices, and security-related communication.

These communications are part of operating the account and protecting account access, service continuity, and billing visibility.

The service may store technical, usage, and operating data where needed for security, abuse protection, billing, diagnostics, account-level protection, and normal service operation.

This may include information necessary to understand how the service is being used, whether billing should be calculated, whether misuse needs to be limited, and whether operational issues need to be investigated.

For sanctions screening, Kognarit sends the business name, country of registration, address and website declared at signup, and the contact person's name, to OpenSanctions, a sanctions data service, when the account is created, on every new login, and when Kognarit staff re-run the check. Email address, phone number, password, industry, documents and conversations are not sent.

Kognarit stores each screening result. For a clear result it keeps the date, the trigger and the outcome; for a potential match it also keeps a bounded summary of the matched entry — its identifier, name, match score, list topics and programmes. The provider's full response is not stored. A potential match restricts the account while Kognarit reviews it, as described in the Acceptable Use & Compliance Policy.

Clients remain in control of the documents and service path connected to their account. In the dashboard a client can remove a document, a conversation or a visitor record: it disappears from their dashboard, exports and assistant immediately and cannot be restored by the client. Removing is not erasure — Kognarit keeps a restricted copy until the end of that item's retention period (section 10) and then purges it.

Clients may also close their own account. Closing an account disables access and revokes operational credentials; stored records then follow the retention periods in section 10.

If the client later returns, that path begins again as a new account path under the service rules then in effect.

Client account data and business material are not treated as public content. They are used for the operation of the client's service path, support process, billing process, and account-level system operation.

The purpose of collecting and handling this information is to operate the service correctly, not to expose the client's material publicly.

Authorised Kognarit personnel may access account records, documents, conversations and visitor data where reasonably necessary for support, security, abuse prevention, billing, compliance, dispute handling or legal reasons. Kognarit discloses data to authorities only where applicable law requires it or in response to a valid legal request or order.

Kognarit uses the following service providers to run the service. Each receives only what its task requires:

• Hetzner Online (data centre in Nuremberg, Germany) — hosts Kognarit's application servers and database.
• Cloudflare — provides DNS for kognarit.com, and R2 object storage for uploaded documents, other stored files such as chat attachments, logos and exports, issued invoice PDFs, and platform backups.
• OpenAI — generates the assistant's replies. It receives the visitor's question, the most relevant excerpts from the client's knowledge base and the client's assistant instructions. It does not receive uploaded files, chat attachments, visitor contact details or whole documents; knowledge-base search runs on Kognarit's own servers.
• OpenSanctions — sanctions screening, using only the fields listed in section 6.
• Brevo — delivers account, security, billing and compliance emails. It receives the recipient's address and the content of each email.

Some of these providers process data outside Georgia, including in the European Union and the United States. Kognarit does not sell client or visitor data and does not use advertising or analytics trackers on its website.

Each kind of data is kept only as long as its purpose requires. The periods that apply today:

• Chats and messages — up to 12 months after the chat's last activity (rolling). Chat attachments follow their chat and are purged with it.
• Visitor data — up to 12 months after it was collected.
• Knowledge-base documents — kept while in active use and never purged merely for age; a removed document is purged no later than 12 months after removal. The search index built from documents is removed when a document is removed or the account is closed.
• Account profile — kept while the account and service are active. After closure, the account's documents are purged and its ordinary profile data (contact names, email, phone, address, website, logo) is purged or anonymised no later than 12 months after closure; a minimal account reference is kept so that invoices and legal records stay linked.
• Invoices, payment records, legal-acceptance, compliance, security and audit records are not part of ordinary data deletion. They are retained for applicable accounting, tax, contractual, dispute and legal obligations; the service currently has no automatic purge for them, and clients cannot delete them. Each issued invoice is kept as the PDF document that was issued.
• Visitor-data export files are deleted after 30 days, platform backups rotate on a 30-day cycle, daily storage measurements are deleted after 30 days, daily usage counters after 90 days, and expired one-time email codes are deleted automatically.

"Remove" in the dashboard takes an item out of the client's view at once; it is not an immediate physical deletion. Kognarit keeps a restricted copy, accessible only to authorised staff for support, security, dispute, abuse, compliance or legal reasons, until the end of the item's period above, and then purges it — unless a legal hold or another legal or security reason requires keeping it longer. Removing never restarts a period. Data purged from the live system can remain in a backup for up to 30 more days, until that backup rotates out; if a backup is ever restored, it is reconciled against the deletion records before use. Every removal, hold and purge is recorded without copying the content.

A formal request to access, correct or delete personal data is separate from Remove. Submit it in the dashboard under Settings → Privacy & Data, or by email to support@kognarit.com. Kognarit reviews each request, records its decision and replies; records with a continuing legal retention obligation, such as invoices and payment records, may be kept.

The service and related frontend experience may use cookies, local storage, or similar browser-side storage for practical service behavior.

That can include theme preferences, language preferences, login and session behavior, and related account experience settings.

This Privacy Policy should be read together with the Payment Policy, the Terms of Service, the Acceptable Use & Compliance Policy and the Visitor Data Policy.

Together, those pages explain how account data, billing, service operation, and client responsibilities are handled within the service. If you have questions about privacy at Kognarit, please use the contact page.