Privacy Policy

Welcome to Kognit AI, operated by KognitHQ (Kognit Headquarters) ("KognitHQ", "we", "us", or "our"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform at KognitHQ.com. By using Kognit AI, you agree to the collection and use of information in accordance with this policy. If you do not agree with the terms of this privacy policy, please do not access the application.

2.1 Personal Information — When you create an account or use our services, we may collect: Name, email address, and profile credentials (via Google Sign-In or Microsoft Sign-In); Profile picture (from your connected Google or Microsoft account); Payment information (processed securely by Stripe, or by Shopify for Shopify merchants — we do not store card details).

• Google & Gmail APIs: We access your emails, message headers, folders, drafts, and sender/recipient information solely for the Shared Inbox feature.
• Microsoft Graph & Outlook APIs: We access mail folders, messages, headers, drafts, and metadata solely to sync and manage emails within Kognit.
• Facebook, Instagram & WhatsApp (Meta) APIs: Facebook Page names and IDs, Instagram professional account IDs and usernames, WhatsApp Business phone number IDs, access tokens, and the messages people send to your Page, Instagram account or WhatsApp number (message text, sender name and platform sender ID) — solely to show those conversations in your inbox and send your replies.
• Shopify: Store domain, product catalog, customer lists, order history, and fulfillment info for store synchronization.
• WooCommerce: Store URL, consumer keys, product catalog, orders, and customer lists for CRM tools.
• Helpdesk Migrations (Zendesk, Gorgias, Freshworks, Intercom): Support ticket history, knowledge base articles, user profiles, and conversation logs via secure APIs.

We only request scopes and permissions strictly necessary. We do not sell, rent, or misuse your connected platform credentials or data. You can revoke permissions at any time.

• Service Delivery: Manage, sync, and reply to messages; send email campaigns; create and publish social media content.
• AI Content & Support Automation: Generate personalized scripts, responses, images, and marketing content.
• Account Management: Manage your subscription, usage quotas, and API integrations.
• Communication: Send system notifications, updates, and email campaigns regarding your account.
• Improvement: Analyze usage patterns and improve system performance and user experience.
• AI training (optional, off unless you turn it on): In Settings → AI training, a merchant can choose to (a) prepare training data for an AI model that serves only their own store, and/or (b) let Kognit use their conversations to improve the AI for all Kognit customers. Only conversations from the Kognit chat widget and email forwarded to the merchant's Kognit support address are ever used — never Gmail or Outlook mailbox data, Facebook, Instagram or WhatsApp messages, marketplace messages, or Shopify customer records. Before use, names, email addresses, phone numbers, postal addresses, postcodes, order, tracking, card and other reference numbers, and links are removed. Training data is assembled from current conversations each time it is prepared, so conversations that are deleted, erased at a customer's request (including Shopify data-erasure requests) or covered by an opt-out are left out of later training data. Merchants can turn either option off at any time.

Kognit AI integrates with Meta's Messenger, Instagram Messaging and WhatsApp Business Platform APIs. In compliance with the Meta Platform Terms and Developer Policies:

• We only access data you explicitly authorize through Facebook Login or WhatsApp Embedded Signup, and only for the Pages, Instagram accounts and WhatsApp numbers you choose to connect.
• We use this access to receive messages sent to your business, show them in your Kognit inbox, and send replies written by your team or, if you turn it on, drafted by our AI assistant.
• To draft AI replies, the text of the conversation is sent to our AI providers (Google Gemini or Anthropic Claude via AWS Bedrock) only to generate that reply.
• Access tokens are stored in Google Cloud Firestore, encrypted at rest, and are only used by our servers to call Meta's APIs on your behalf.
• We do not sell, share, or transfer Facebook, Instagram or WhatsApp data to data brokers or advertisers, and we do not use it for advertising, profiling, or any purpose other than the messaging features you use.
• Disconnect at any time from Settings → Integrations; this revokes our permissions on Facebook and deletes the stored tokens.
• To delete your Meta data, remove Kognit HQ from your Facebook settings or follow the steps on our Data Deletion page. Deletion requests are processed automatically and you receive a confirmation code you can check there.

When you connect your Gmail or Google accounts, our access, use, storage, and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements:

• We only use access to read, write, send, and control Gmail message bodies (including attachments), metadata, and headers to provide a unified Helpdesk and CRM email client.
• We do not transfer this Gmail data to third parties unless necessary to provide/improve features, comply with law, or as part of a merger/acquisition.
• We do not use Gmail data for serving advertisements, retargeting, or user profiling.
• We do not allow humans to read this data unless we have your affirmative agreement for specific messages, it's necessary for security purposes, or to comply with applicable law.

We may share or sync your data with the following third-party subprocessors, solely to provide our services:

• Google Workspace & APIs — Secure Google Sign-In and Gmail Shared Inbox syncing.
• Microsoft Graph APIs — Outlook Shared Inbox syncing.
• Google Firebase & GCP — Authentication, database, backup infrastructure, and secure hosting.
• Meta Platforms (Facebook, Instagram & WhatsApp Business API) — Synchronizing direct messages and social channels.
• AI Infrastructure (Google Gemini / Vertex AI, OpenAI) — AI-powered content generation, reply drafting, and autopilot resolutions.
• Fal.ai & ElevenLabs — AI media, graphic assets, and voice narration generation.
• Payment Processors (Stripe & Shopify Billing API) — Secure payment processing, subscription management, and recurring billing. Stripe handles USD/GBP subscriptions for direct signups. Shopify Billing API handles charges for merchants who install via the Shopify App Store — charges appear on their Shopify invoice.
• Ecommerce & Catalog Sync (Shopify, WooCommerce) — Product catalog, inventory, customer, and order lifecycle synchronization.
• Amazon Web Services (AWS Bedrock, S3, SES, CloudWatch) — AI model inference via Claude (Anthropic), encrypted database backups, transactional email delivery, and application monitoring.
• Requests from public authorities — We disclose personal data to a public authority only when the law requires it. Every request is reviewed for legality before we respond; we challenge requests we consider unlawful, overly broad or not properly issued; we disclose only the minimum data the request legally requires; and we keep a record of each request, our response, the legal basis and the people involved. Where the law allows, we tell the affected customer first. Requests go to support@kognithq.com.

We do not sell your personal data to any third party. For a full list of sub-processors, see our Data Processing Agreement.

For merchants using our Shopify integration, we strictly adhere to Shopify's Protected Customer Data requirements and the Shopify API License and Terms of Use. We act as a data processor on behalf of the merchant (the data controller).

• Protected Customer Data: We access customer names, email addresses, phone numbers, shipping/billing addresses, and order history solely to power helpdesk features (ticket context, order lookup, refund processing). We never use this data for marketing, advertising, or any purpose unrelated to the merchant's support operations.
• Data Minimization: We process only the minimum personal data required to provide our services.
• No Secondary Use: We do not sell, rent, share, or transfer Shopify customer data to any third party except as required to operate the service (e.g., AI inference for reply generation), and Shopify customer records are never used for AI training.
• Consent & Opt-outs: We respect all customer consent decisions and honor unsubscribe requests.
• Shopify Billing: Merchants who install via the Shopify App Store are billed through Shopify's AppSubscription API. Charges appear on the merchant's Shopify invoice. We do not store Shopify payment credentials.
• Data Retention: We enforce automated retention policies. Upon app uninstall, all Shopify-sourced data is purged within 30 days.
• Webhook Verification: All Shopify webhooks are verified using HMAC-SHA256 signatures to prevent tampering.

We collect and process billing information to manage your subscription:

• Plans: Free (no payment required), Starter ($19.99/mo), Growth ($49.99/mo), Pro ($149.99/mo), and Enterprise (custom). All paid plans include a 7-day free trial.
• Shopify Merchants: Billed through Shopify's Billing API. We do not collect or store any payment card information. Charges appear on the merchant's Shopify invoice and are subject to Shopify's billing terms.
• Direct Signups (Stripe): Payment card details are collected and processed exclusively by Stripe. We receive only a customer ID, subscription ID, and payment status. We never see or store your full card number.
• Billing Data Stored: Plan name, billing cycle (monthly/annual), subscription status (active/trialing/cancelled), payment provider (Shopify or Stripe), subscription ID, and billing timestamps.
• Refunds: Refund requests are processed within 14 days of charge. Shopify billing refunds are subject to Shopify's refund policies. Stripe refunds are credited to the original payment method within 5-10 business days.
• Cancellation: You may cancel at any time via Settings. Access continues until the end of the current billing period. No partial refunds for unused time.

• Encryption: All personal data is encrypted at rest (AES-256) and in transit (TLS 1.2+). All automated database backups are strictly encrypted.
• Infrastructure Segmentation: Strict separation between development, test, and production data environments.
• Access Controls & Logging: Staff access limited by least privilege with MFA for all staff accounts. Comprehensive audit logs track all access.
• Data Loss Prevention (DLP): Active DLP strategy to monitor, detect, and prevent unauthorized data exfiltration.
• Incident Response: Active Security Incident Response Policy for rapid identification, containment, and remediation.

We retain your data for as long as your account is active or as needed to provide services. Under India's DPDP Act 2023, EU GDPR, and US CCPA, you have the right to request erasure of your account and all associated personal data at any time via self-service tools in Settings.

• Self-Service Account Deletion: Permanently purge your profile, connected OAuth accounts, contacts, and tickets via Settings → Delete Account & All Data.
• Customer Data Erasure: Purge individual customer shopper records, ticket threads, and subcollection chat history via Settings or Inbox.
• Data Portability Export: Download a complete, structured JSON package of all your account records via Settings → Export Your Data.
• Automated Token Purge: Revoke and erase all connected platform tokens (Gmail, Outlook, Meta, Shopify, WooCommerce) immediately upon account termination.

We process personal data in accordance with India's Digital Personal Data Protection (DPDP) Act 2023, EU GDPR, and US CCPA/CPRA. Depending on your location, you have the following rights as a Data Principal / Data Subject:

• Right to Erasure / Right to be Forgotten (DPDP Sec. 12 / GDPR Art. 17): Request permanent deletion of your account or customer personal data at any time.
• Right to Data Portability (DPDP Sec. 12 / GDPR Art. 20): Export your data in a structured, machine-readable JSON format with one click.
• Right to Access & Rectification (DPDP Sec. 11 / GDPR Art. 15-16): View and update your personal information, profile, and store integrations.
• Right to Grievance Redressal (DPDP Sec. 13): Contact our Data Protection Officer (DPO) at support@kognithq.com for rapid resolution of privacy concerns.
• Right to Nominate (DPDP Sec. 14): Nominate an individual to exercise your data rights in accordance with applicable Indian law.
• Right to Withdraw Consent (DPDP Sec. 6 / GDPR Art. 7): Withdraw processing consent at any time via Settings or by disconnecting platform integrations.

Kognit AI uses essential cookies and local storage for authentication sessions. We do not use tracking cookies or third-party advertising cookies. For more details, see our Cookie Policy.

Kognit AI is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children.

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.