Privacy Policy

This Privacy Policy describes how Knowella AI Inc., dba Knowella, a Delaware corporation (“Knowella,” “we,” “us,” or “our”), collects, uses, discloses, and protects Personal Information when individuals (“you”) interact with:

• Our websites, including www.knowella.com, www.knowlogistics.ai, www.knowrfp.ai, www.knowdoc.ai, www.knowergo.ai, www.knowhealth.ai, and any other website or domain we operate that links to this Privacy Policy (the “Sites”); and
• Our cloud-based platform, mobile apps, browser extensions, agentic‑AI tools, integrations, and related services (the “Services”).

The Services include, without limitation: Ella, our AI control tower, and the AI agents it coordinates; KnowLogistics, KnowRFP, and KnowDoc for freight, quoting, and paperwork workflows; KnowLive, which connects to cameras, drones, sensors, and other devices; KnowErgo; our safety, operations, and fleet applications (including KnowSafe, KnowHealth, KnowEnviro, KnowOps, KnowMaintain, KnowTrain, KnowQuality, KnowComply, KnowContractor, and KnowFleet); voice AI, messaging, and computer vision features; transportation management (TMS), warehouse management (WMS), enterprise resource planning (ERP), and other operational system functionality and integrations; and any new products, agents, or features we offer from time to time.

Product names and future Services. The product, agent, and website names in this Privacy Policy are examples only. This Privacy Policy applies to all current and future Knowella products, AI agents, add-ons, features, applications, and websites, whatever they are called and whether or not they are named here, including renamed, rebranded, or combined versions. Any description that refers to a named product also applies to any other Service with similar functionality. For example, the KnowLive section applies to any Service that connects to cameras, drones, sensors, or other devices. We may provide additional privacy notices for specific Services, which supplement this Policy.

By using our Sites or Services, you acknowledge this Privacy Policy.

1) Definitions

• Personal Information: Information that identifies or can reasonably be linked to an identifiable individual.
• Customer Data / Your Content: Prompts, files, documents, media, and other data you submit to the Services.
• Outputs: AI-generated responses produced by the Services.
• Service Telemetry: Non-content usage and diagnostic metadata (e.g., performance metrics, timestamps, error logs).
• De‑identified Data: Data that cannot reasonably be used to identify an individual and that we commit not to re-identify.
• Aggregated Data: Statistical data derived from Personal Information that cannot identify an individual.
• Customer: The business or organization that subscribes to the Services and makes them available to its personnel and other authorized users.
• Agentic Actions: Tasks the Services perform on a Customer’s behalf, such as sending emails, placing or answering calls, sending messages, logging into third-party portals, entering or updating records in third-party systems, booking appointments, tendering loads, and requesting or submitting documents.
• Third-Party Contacts: Individuals outside the Customer whom the Services contact or whose information the Services process on the Customer’s behalf, such as carriers, drivers, dispatchers, suppliers, vendors, contractors, consignees, brokers, and the Customer’s own customers and prospects.
• Sensor Data: Video, images, audio, and other data captured by cameras, drones, sensors, telematics, IoT, and similar devices connected to the Services.

2) Information We Collect

A. Information you provide

• Account details: name, business email, phone number, company, role/title, password.
• Communications: support tickets, emails, call notes, survey responses.
• Your Content: prompts, files, documents, or other materials you upload or connect to the Services.
• Billing: payment details handled by our payment processor (we do not store full card numbers).

B. Information collected automatically

• IP address, device and browser type/version, operating system, referring URLs, pages viewed, session duration, and similar analytics signals.
• Cookies, pixels, tags, SDKs, and local storage for authentication, security, performance, and analytics (see §4).

C. Information from integrations

• IDs and access tokens needed to connect third‑party services you authorize.
• Diagnostic data from service providers used to support and secure the platform.

D. Information we process on behalf of Customers

Depending on the Services a Customer uses and how it configures them, we may process:

• Operational and logistics data: orders, shipments, loads, lanes, rates, quotes, RFPs, tenders, appointments, inventory, tracking events, and location or telematics data.
• Third-Party Contact information: names, business emails, phone numbers, company, role, carrier or vendor identifiers, and the content of communications with them.
• Documents: bills of lading, proofs of delivery, rate confirmations, invoices, insurance certificates, tax forms, banking or remittance details submitted for vendor onboarding or settlement, permits, and similar records.
• Voice and messaging data: call audio, recordings, transcripts, voicemails, SMS and email content, and call metadata (see §13).
• Sensor Data: video, images, audio, and device readings from cameras, drones, and sensors connected through KnowLive or similar features, and short videos submitted for ergonomic assessments (see §14).
• Workforce, contractor, and driver information: training and certification records, incident and inspection reports, contractor prequalification records, driver qualification files, hours of service, and similar records (see §15).
• Health information: patient and employee health information processed through KnowHealth and similar Services, which may include protected health information (PHI), such as symptoms, assessments, treatment plans, progress notes, video assessments, and return-to-work information (see §15).
• Third-party system credentials: usernames, passwords, API keys, and tokens for TMS, WMS, ERP, carrier, appointment scheduling, and other portals that a Customer authorizes the Services to access. We store these in encrypted form and use them only to perform the Agentic Actions the Customer has enabled.

E. Information from other sources

• Public registries, commercial data providers, and publicly available business information (for example, carrier authority and safety records, business contact details, and company information), used to support the Services, verify parties, and for our own business development.

Except for health information processed through KnowHealth and similar Services as described in §15, we do not intentionally collect protected health information (PHI), GLBA “customer information”, biometric identifiers, or consumer health data. If such data is uploaded inadvertently, contact us for removal.

3) How We Use Information

We use Personal Information to:

• Provide, operate, and support the Services;
• Authenticate users, secure accounts, and prevent fraud/abuse;
• Deliver AI‑powered features including agentic workflows and RAG retrieval;
• Communicate onboarding, service alerts, and product updates;
• Monitor performance, debug issues, and improve reliability and quality;
• Comply with applicable laws and enforce our Terms of Service.
• Perform Agentic Actions, voice AI, document processing, computer vision, and other automated tasks that a Customer configures or approves;
• Send marketing and business communications to business contacts, subject to opt-out (see §16).

AI, LLM, and RAG Disclosures

• We do NOT use Your Content to train or fine‑tune foundation models.
• We may use De‑identified/Aggregated Data and Service Telemetry to operate, evaluate, secure, and improve platform performance and safety.
• If we use third‑party model providers, they are bound by contracts that prohibit retaining or using Customer Data for their own model training.
• AI Outputs may contain inaccuracies or be incomplete; you are responsible for reviewing Outputs before relying on them for consequential decisions.
• The Services may use a range of third-party AI technologies, including large language models, speech-to-text, text-to-speech, voice, optical character recognition, and computer vision models. We may add, remove, or change these providers at any time.
• Knowella does not use the Services to make decisions that produce legal or similarly significant effects about individuals. Customers decide how to use Outputs, including any decisions about their personnel or Third-Party Contacts.

4) Cookies, Pixels, Analytics

We use cookies and similar technologies to:

• Enable secure sign‑in and core functionality;
• Measure and enhance Site performance;
• Improve user experience.

Video Content & VPPA Considerations

Where our Sites include embedded/streamed video, we configure analytics to avoid transmitting identifiable video‑viewing data to third parties. If a scenario requires identifiable video‑tracking, we will seek explicit consent first.

You may manage cookies via your browser settings. Where required by law, we honor Global Privacy Control (GPC) signals.

5) How We Share Information

We disclose Personal Information only as follows:

• Service providers/subprocessors: cloud hosting, analytics, communications, security, and payments, bound by confidentiality and data‑protection terms; no secondary use.
• AI, voice, and telephony providers: model, speech, telephony, messaging, and computer vision providers that process data to deliver AI features, under contracts that prohibit use of Customer Data for their own model training.
• Integrations you enable: third‑party tools you explicitly connect to the Services.
• Third-Party Contacts and systems, at a Customer’s direction: when performing Agentic Actions, the Services share information needed to complete the task (for example, sharing shipment details with a carrier, or entering a record into a Customer’s TMS, WMS, ERP, or a third-party portal).
• The Customer: information processed through a Customer’s account is available to that Customer and its authorized administrators.
• Professional advisors: auditors, legal counsel, and similar advisors under confidentiality.
• Legal and safety: to comply with law or lawful process, and to protect rights, property, and safety.
• Corporate transactions: in connection with mergers, acquisitions, financings, or asset transfers, subject to continued protections.

We do not sell Personal Information and we do not share Personal Information for cross‑context behavioral advertising.

6) Data Retention

By default, we retain Personal Information for up to three (3) years to support product functionality, security, audit, and continuity. We may retain data longer where required by law, contract, dispute resolution, or to enforce our rights. When retention is no longer necessary, we delete or de‑identify the data.

Customer Data, including call recordings and Sensor Data, is retained according to the Customer’s agreement and configuration settings. Customers may set shorter retention periods where the Services support it. PHI is retained, returned, or destroyed as set out in the applicable business associate agreement. After a Customer’s subscription ends, we may delete Customer Data as described in our Terms & Conditions. Residual copies may remain in backups for a limited period until overwritten in the ordinary course.

7) Security

We maintain a comprehensive information security program with administrative, technical, and physical safeguards appropriate to the nature of the data:

Administrative Controls

• Role‑based access control (RBAC) with least‑privilege;
• Staff confidentiality obligations and background checks, as applicable;
• Mandatory privacy and security training;
• Multi‑factor authentication for privileged and production access.

Technical Controls

• Encryption in transit (TLS 1.2+) and at rest (AES‑256);
• Network segmentation and firewalling;
• Secure secrets management and regular rotation;
• Continuous vulnerability scanning and patch cycles;
• Centralized logging, audit trails, and integrity monitoring;
• DDoS and intrusion protections.

Cloud Architecture & SDLC

• Environment isolation across GCP, AWS, and Azure (U.S. regions);
• Hardened images/containers, automated scaling, zero‑trust access principles;
• Secure development lifecycle with 2‑week sprints, peer code reviews, regression and load testing, and release notes for production deployments.

Auditing & Monitoring

• Logs across front‑end, back‑end, databases, and microservices;
• Automated alerting for anomalies and infrastructure bottlenecks.

Backups & Disaster Recovery

• Daily full backups, differential backups every 4 hours, and hourly log backups;
• Disaster‑recovery environment in a distinct geographic region;
• Periodic restoration tests.

Incident Response
If an incident materially impacts Personal Information, we will investigate, contain, and notify affected customers within 72 hours of confirmation (or sooner if required), and support remediation.

Cloud providers we utilize may hold their own independent certifications (e.g., SOC 2). Such certifications relate to those providers and do not imply certification for Knowella.

The practices described in this section reflect our general security program, may change over time, and are not contractual warranties. See §19.

8) International Transfers & Cloud Hosting

We operate a multi‑cloud architecture for resiliency and availability:

• Google Cloud Platform (GCP): U.S. regions
• Amazon Web Services (AWS): U.S. regions (and Canada if contractually required)
• Microsoft Azure: U.S. regions

Default residency. Customer data is stored in the United States by default. Where a customer contract requires it, we may provision dedicated workloads or DR replicas in Canada. Regardless of provider or region, we apply the same security and privacy controls described in this Policy.

If Personal Information is transferred across borders, we implement appropriate safeguards (e.g., contractual commitments, access controls, encryption, and least‑privilege).

Some third-party AI, voice, telephony, and messaging providers may process data in other regions to deliver their features, and our authorized personnel and service providers may access data remotely from outside the United States, including from Canada, subject to the safeguards above. Data located in another country may be accessible to that country’s courts, law enforcement, and national security authorities.

9) Third‑Party Tools, Integrations, and Marketplace Apps

If you connect third‑party tools (e.g., Slack, Teams, Jira, Google Workspace, Microsoft 365, TMS, WMS, ERP, telematics, camera and video management systems, carrier and appointment portals):

• We exchange only the data necessary to enable the integration;
• The third party’s privacy policy governs their handling of data;
• You may disconnect integrations at any time;
• We are not responsible for third‑party privacy/security practices.

Review third‑party policies before enabling integrations.

10) Your Privacy Rights (United States)

Depending on your U.S. state, you may have rights to access, delete, correct, and obtain information about our processing of your Personal Information. To submit a request, contact us at support@knowella.com. We may request information to verify your identity.

We will not discriminate against you for exercising any privacy rights available under applicable law.

If your Personal Information was provided to the Services by a Customer (for example, you are a Customer’s employee, a driver, a carrier contact, or a person captured by a Customer’s camera), please direct your request to that Customer. We will assist the Customer in responding as required by law and our agreement with the Customer.

11) California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know/Access: the categories and specific pieces of Personal Information collected, the sources, purposes, and categories of disclosures;
• Delete: request deletion of Personal Information, subject to lawful exceptions;
• Correct: request correction of inaccurate Personal Information;
• Opt‑out of Sale/Sharing: we do not sell or share Personal Information for cross‑context behavioral advertising;
• Non‑discrimination: we will not deny goods/services, charge different prices, or provide a different level/quality of services for exercising your rights.

How to exercise California rights: email support@knowella.com with the subject “California Privacy Request.” We will verify requests as required by law and respond within the statutory timeframe. You may use an authorized agent, subject to verification of the agent’s authority.

12) Our Role: Service Provider for Customer Data

When we process Customer Data, including information about a Customer’s personnel, Third-Party Contacts, and individuals captured by Sensor Data, we act as a service provider or processor on the Customer’s behalf and under its instructions. The Customer is responsible for its own privacy practices, for providing any required notices, and for obtaining any required consents or authorizations, including from its workforce and Third-Party Contacts. This Privacy Policy does not describe a Customer’s practices.

13) AI Agents, Voice AI, and Third-Party Communications

• Agentic Actions. Our AI agents may contact Third-Party Contacts by email, phone, SMS, chat, and portals on a Customer’s behalf, and may log into, read from, and write to third-party systems the Customer authorizes. These actions are performed under the Customer’s instructions, configuration, and, where the Customer requires it, human approval.
• Voice AI. Calls placed or answered by the Services may be handled by an AI voice agent and may be recorded, transcribed, and analyzed to complete the task, create records, and maintain quality and security. Where required by law, AI agents identify themselves as automated and calls include any required recording disclosures.
• Communications records. We keep logs and copies of communications and Agentic Actions to provide audit trails, resolve disputes, and support the Customer.
• Opting out. If you are a Third-Party Contact and no longer wish to be contacted, reply to the message, tell the agent during the call, or email support@knowella.com, and we will notify the relevant Customer.

14) KnowLive, Cameras, Drones, and Sensors

• KnowLive and similar features connect to cameras, drones, sensors, and other devices that a Customer owns or controls, and use computer vision and AI to detect safety, operational, quality, maintenance, and site access events.
• Sensor Data may capture images, video, or audio of individuals, vehicles, and license plates at Customer sites. The Customer decides where devices are placed, what is captured, and how long it is kept, and is responsible for signage, notices, consents, and compliance with workplace, privacy, labor, and surveillance laws and any collective agreements.
• The Services are not configured to perform facial recognition or to create biometric templates by default. Any feature that could process biometric identifiers will be enabled only under a written agreement with the Customer, who is responsible for any required notices, consents, and retention schedules.
• The Services are not designed for covert monitoring, and Customers may not use them for unlawful surveillance.

15) Workforce, Driver, Patient, and Health Information

Certain Services help Customers manage training, certifications, incidents, injuries, ergonomic assessments, wellbeing programs, return-to-work, contractor compliance, and driver qualification files. These records may include health-related information, such as injury details or driver medical certificate status. We process this information only on the Customer’s behalf, to provide the Services, and with access restricted to authorized users. The Services do not provide medical diagnosis or treatment.

KnowHealth. KnowHealth and similar Services store and process patient and employee health information on behalf of Customers, which may include healthcare providers, occupational health providers, and employers. This information may include PHI.

• Where a Customer is a HIPAA covered entity or business associate, Knowella acts as its business associate and processes PHI only under a signed business associate agreement (BAA). Customers must have a BAA in place with Knowella before submitting PHI. If this Policy conflicts with a BAA as to PHI, the BAA controls.
• We use health information only to provide the Services to the Customer, as permitted by any applicable BAA, and as required by law. We do not sell health information, use it for marketing or advertising, or use it to train foundation models.
• We use subprocessors for health information only under agreements that include business associate terms where HIPAA requires them.
• Health information may also be subject to other U.S. state and Canadian provincial health privacy laws. The Customer is responsible for patient notices, consents, and authorizations. Patients should direct requests to access, correct, or amend their records to their healthcare provider or the Customer, and we will assist the Customer as required by law and the BAA.

16) Marketing Communications

We may send business contacts information about our products, events, and offers. You can opt out at any time by using the unsubscribe link in our emails or by contacting support@knowella.com. We may still send transactional and service messages related to your account.

17) Canada and Other Jurisdictions

Our Sites and Services are intended for business users, primarily in the United States and Canada. If you are in Canada, you may have rights under applicable federal or provincial privacy laws to access and correct your Personal Information and to withdraw consent, subject to legal and contractual restrictions. You may also contact us with questions about our practices or our service providers outside Canada. If you are located elsewhere, local law may give you additional rights; contact us and we will respond as required by applicable law. Requests may be sent to support@knowella.com.

18) Children’s Privacy

The Sites and Services are intended for business use by individuals 18 and older. We do not knowingly collect Personal Information from children. If you believe a child has provided us Personal Information, contact us and we will delete it.

19) No Certification Claims; No Guarantee of Security

• Unless expressly stated in a written agreement signed by Knowella, Knowella does not represent that it holds any third-party certification, attestation, or authorization (including SOC 2, ISO 27001, PCI DSS, HITRUST, FedRAMP, or CMMC), or that the Sites or Services comply with any specific law or framework, including the GDPR. Where Knowella signs a business associate agreement, its obligations for PHI are those set out in that agreement and applicable law.
• No method of transmission, storage, or processing is completely secure. While we work to protect Personal Information, we cannot guarantee its absolute security, and you provide information at your own risk. Statements on our Sites and in marketing materials describing our security or privacy are general descriptions, not guarantees.

20) Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version with a new “Last Updated” date and, for material changes, provide reasonable notice (for example, by email or in-product notice). Continued use of the Sites or Services after the effective date means you acknowledge the updated Policy.

21) Contact Us

Knowella AI Inc. (dba Knowella)
Attn: Privacy
300 Delaware Avenue
Suite 210 #206
Wilmington, DE
Email: support@knowella.com