// legal
Privacy Policy
Last updated 2026-11-03.
Who this covers
This policy covers the Knotbind website, the dashboard, the public demo, the agent API and MCP server, Mend and the Gateway. "Knotbind", "we" and "us" mean the operator of www.knotbind.com. To reach us, use the contact form.
What we collect
- Account details: your name, work email, company name and, if you sign in with Google or Apple, the identity that provider sends us. Passwords are stored as hashes.
- Connection details: the URL of each MCP server or API you connect, and the credentials you give us for it. A pasted credential is encrypted before it is stored and is never shown again.
- Monitoring records: Runs, response previews, Findings, repair proposals, approvals and an append-only Audit Record of who did what.
- Agent activity: what an agent you authorised asks for, the steps of its runs and the notes it saves to agent memory.
- Code for Mend: when you connect a GitHub repository, Mend reads the files it needs to find affected calls and opens a draft pull request. It does not write to a default branch.
- Messages you send us: the contact form and any email you write.
- Visit data: see Cookies and analytics below.
We do not receive your card number. Card payments are handled by Stripe.
Why we use it
- To run the service you asked for: checks, alerts, repairs, the Gateway, Mend and agent actions.
- To sign you in, keep your account secure and keep the Audit Record.
- To take payment for a plan and send invoices and receipts.
- To send the emails the service needs: alerts, approval requests, sign-in and billing messages.
- To answer you when you contact us.
- To count visits to the public pages, in the way described below.
We do not sell personal data, and we do not use it for advertising.
Who processes it for us
We use these providers to run Knotbind. Each receives only what its part of the service needs.
| Provider | For what |
|---|---|
| Hetzner | Hosting the servers and database. |
| Stripe | Payments for Knotbind plans. |
| Resend | Sending email. |
| Google, Apple | Sign-in, when you choose it. |
| GitHub | Where Mend reads a repository you connect and opens its draft pull requests. |
| Google (Gemini) | Drafting a diagnosis or repair, with credential-like fields redacted first. Recall by meaning in agent memory, only when your Owner has switched it on: the memory text is sent to Google to be embedded. |
| Google Analytics | Counting visits, only after you accept it. |
The Gateway forwards your requests to the model provider you choose, using your own key. What that provider does with them is covered by your agreement with it.
Cookies and analytics
The cookies we set, and the choice you have over analytics, are described on the cookie page. Separately, we count visits to the public pages ourselves. For that we store a one-way fingerprint that is made from your network address and the date and changes every day. We never store the address.
How long we keep it
Run history is kept for the number of days your plan includes: 7 on Free, 90 on Pro and 365 on Business. When an Owner deletes an integration, its Runs, Findings and proposals are removed and only a short record that it was deleted remains. An Owner can export the Audit Record at any time. Contact messages are kept as long as we need them to answer and keep a record of the conversation.
Your rights
You can ask us for a copy of your personal data, to correct it, to delete it, to limit or object to how we use it, and to receive it in a portable form. Owners can export and delete their workspace data from the dashboard. For anything else, use the contact form. If you are in the European Economic Area or the United Kingdom, you can also complain to your data protection authority.
Where data is stored
Knotbind runs as a single deployment. There is no region to choose in the product. If where your data lives matters to you, ask before you sign up.
Security
The measures we use are described on the security page. No system is perfectly secure, and we cannot promise that it is.
Children
Knotbind is for businesses and is not directed to children. Do not use it if you are under 16.
Changes
When we change this policy we change the date at the top. If a change matters to how we use your data, we will tell account Owners by email.