Privacy Policy.

What this Policy covers

This Policy covers two categories of personal data.

Website and contact data. Personal data we collect when you visit kn0w.co, contact us, subscribe to updates, complete one of our free online self-assessment tools, or deal with us as a prospective or current customer contact.

Engagement data. Personal data we collect from a customer’s personnel to produce the Automation Report, a Quarterly Review or the Annual Report. It includes written form responses and recorded voice sessions.

The Data Contribution Agreement (“DCA”) governs engagement data in detail. Each customer signs it before any engagement data is collected. The DCA sets out how engagement data is processed for that customer. This Policy is the privacy-law notice that sits over it. Customers also receive a plain-English collection notice at the point each category of data is collected.

This Policy does not cover the anonymised Benchmark Dataset, which contains no personal data (see Section 7).

Personal data we collect

From website visitors and contacts:

• Contact details you give us (name, work email, company, role) when you enquire, book a call or subscribe.
• Free self-assessment responses. If you complete one of our free online self-assessment tools, we collect the work email you give us and your answers about your company. These include sector, country, approximate staff size and your own view of your company’s AI practices. We use them to generate and email your results, and to contact you about those results and kn0w’s services where you have agreed. In anonymised, aggregated form that carries no identity, we also use them to build indicative peer benchmarks. We hold these responses in our customer-relationship and marketing systems, apart from the platform that holds engagement data. Self-assessment results are indicative and self-reported. They are not an Automation Report.
• Account and billing data if your company commissions a report, managed through our account and billing provider.
• Limited technical data. Our public website sets no cookies and runs no third-party analytics (see Section 15). Where our infrastructure provider processes server-level connection data, such as IP address, to deliver and secure the site, Section 15 describes that processing.

From customer personnel during an engagement:

• Written form responses: name, role, function, and responses about your function’s workflows, tools, skills, oversight, spend and outcomes.
• Voice session recordings and transcripts: one CEO session and six function-head sessions.

We collect engagement data only after the customer has signed the DCA. The platform enforces this. It is not a manual step.

How we use personal data, and our legal bases

AI processing

kn0w uses AI models to conduct the voice sessions, and to write the narrative for each reading and draft findings. Three commitments apply.

• kn0w does not use customer data to train AI models.
• Company-identifiable data (defined in Section 8) is reasoned over in its home region and nowhere else. AI processing of identifiable engagement data runs on in-region infrastructure (AWS Sydney for Australian customers). No company-identifiable data is sent to a model endpoint outside the customer’s home region.
• AI writes the narrative. It does not issue the report. AI models write the narrative for each reading and draft findings. A separate deterministic scoring engine computes the score: the same inputs always produce the same outputs. Fixed code assembles the issued report; no model generates it. Every issued report passes a mandatory human approval step (Section 6).

Automated processing and how decisions are made

A deterministic scoring engine produces the kn0w Score. It applies fixed weights to the responses gathered during an engagement. The output is a finding about how much of a company is automated, what that costs and whether it is working. It is stated as the kn0w Score, a band and six readings.

This output does not, by itself, produce a legal or similarly significant effect on any individual. It is a finding about a company, not a decision about a person. Every issued report and Annual Report passes a mandatory human approval step before release. No report is issued to a customer on a purely automated basis. A customer may ask us about the basis of any finding through the contacts in Section 18.

The anonymised Benchmark Dataset

This Section describes the verified Benchmark Dataset built from customer engagement data. Elsewhere on our site it is called the peer data.

kn0w also keeps a separate, indicative benchmark pool built from the free self-assessment responses in Section 3. That pool is global, not by country. It is built only from anonymised, aggregated, self-reported answers that carry no identity. It applies the same minimum of five companies (k=5) before any comparison is shown. It never feeds the verified percentiles described below. The two are kept apart.

The Benchmark Dataset places each customer against its peers. It is built as follows.

• A single, dedicated anonymisation pipeline is the one permitted pathway between regional customer data and the benchmark store. Nothing else crosses that boundary.
• Data entering the Benchmark Dataset is anonymised and aggregated. Identity is removed before the data leaves its home region. The dataset holds no names and no company identifiers.
• No peer comparison is made from fewer than five companies (k=5). This applies from the first report issued. The platform enforces the threshold; it does not rest on policy alone.
• The Benchmark Dataset is hosted in the United States (AWS us-east-1). It is anonymised before transfer and carries no customer identity, so it is not personal data.
• Anonymised aggregate data is kept indefinitely.

kn0w may license the anonymised, aggregated Benchmark Dataset to institutional partners. This data carries no customer identity and is not personal data, so licensing it does not disclose your personal data.

Where your data lives: regional residency

In this Policy, “company-identifiable data” means engagement data that identifies, or can reasonably be linked to, a customer or an individual within it, before it passes through the anonymisation process in Section 7.

Company-identifiable data is stored in regional databases. It never leaves its home region except through the single anonymising pathway in Section 7.

• Australian customer data is stored and processed in AWS Sydney (ap-southeast-2).
• Website and contact data is processed by the service providers listed in Section 11.

kn0w currently operates in Australia. As kn0w expands to new markets, company-identifiable data for each market will be stored in-region. Before customers in a new market are onboarded, this Policy will be updated with that region and any additional transfer safeguards.

International transfers

kn0w currently operates in Australia. Australian company-identifiable data is stored and processed in Australia (AWS Sydney). It does not leave Australia except through the anonymisation process in Section 7. Only anonymised aggregate data, which is not personal data, is written to the United States benchmark store.

Any disclosure of personal information to overseas recipients is limited to the arrangements in Sections 7, 8, 10 and 11, and is addressed under the Australian Privacy Principles in Annex A. Overseas recipients include the United States, where kn0w LLC operates infrastructure, and Singapore, where KN0W PTE. LTD. acts as controller.

When kn0w onboards customers in other jurisdictions, this Section will be updated with the transfer mechanisms for those jurisdictions before any of their customer data is collected.

US legal process: CLOUD Act disclosure

kn0w LLC operates kn0w’s cloud infrastructure. It is a US entity and may be subject to the US CLOUD Act. We state this rather than claim it does not apply. It cannot be removed as a matter of law. It is managed.

Under the Sub-Processor Agreement, kn0w LLC must: (a) notify KN0W PTE. LTD. when it receives any legal demand for customer data; (b) challenge or seek to narrow any such request where the law allows; and (c) not disclose customer data without the direction of KN0W PTE. LTD., except where legally compelled.

Who we share personal data with

We do not sell personal data. We share it only with the following.

• kn0w LLC: technical sub-processor operating our AWS infrastructure (see Sections 1 and 10).
• Service providers acting on our instructions. These currently include:

This table is the current list of service providers. Changes are reflected here, and the list is available on request.

• Professional advisers (legal, accounting, insurance) where necessary.
• Authorities where the law requires disclosure, subject to Section 10 for customer data.
• A successor entity in a merger, acquisition or sale of assets. This Policy continues to apply to your data until it is replaced with notice.

How long we keep personal data

Deletion and redaction of engagement data are automated and logged.

How we protect personal data

Our security controls include regional data isolation with hard boundaries, encryption at rest and in transit, least-privilege access, append-only logging of lifecycle events, automated deletion and infrastructure monitoring. The same controls run on every regional instance and for every customer.

kn0w is pursuing SOC 2 Type II and ISO 27001 certification. Neither is held yet, and we will not claim either until it is. Our security controls and certification status are set out at kn0w.co/security.

Data breaches

If a personal data breach occurs that is likely to put your rights at risk, we will notify the relevant supervisory authority and the affected individuals where, and within the timeframes, the law in your jurisdiction requires. Our internal logging and monitoring are designed to support prompt detection and review.

Cookies and tracking

Our public website (kn0w.co) sets no cookies. It uses no analytics cookies, no advertising cookies and no third-party tracking pixels. You can browse the public site without any cookie being placed on your device and without being tracked. Our website infrastructure provider delivers page content, fonts and scripts without setting cookies. It may process server-level connection data, such as IP address, only as needed to deliver and secure the site.

Our customer portal (app.kn0w.co) is available only after you sign in. As a secure, authenticated application, it uses a small number of strictly necessary cookies. They are not used for advertising or cross-site tracking.

If we introduce non-essential cookies, we will update this Section and, where required, ask for your consent first.

Your rights

You have rights over your personal data. What they are, and how to exercise them, depends on where you are. The annexes below set out the detail by jurisdiction. In every case you can contact us at privacy@kn0w.co, and we will respond within the timeframe your jurisdiction’s law requires.

If you are personnel of a customer, some rights interact with the customer’s DCA, for example deletion of engagement data mid-engagement. We will coordinate with the customer where the law permits.

Children

kn0w’s services are provided to companies and are not directed at children. We do not knowingly collect personal data from anyone under 18.

Changes to this Policy and contact

We may update this Policy. We will notify customers of material changes directly and reflect them in the “Last updated” date above. Where a material change affects website visitors or contacts, we will also post notice on this page. Prior versions are available on request.