Privacy Policy

1. Who We Are

KnowThySelf360 LP is a Delaware limited partnership with its principal place of business at 874 Broadway, Unit 505, New York, NY 10003, USA.

2. Personal Information

We collect personal data directly from you and through automated technologies. This includes:

• Name and email address
• Google account details (if signing in with Google)
• IP address, device and browser data
• Feedback responses
• Feedback participant email addresses
• Site usage, browsing data, and analytics
• Marketing preferences
• Product-usage events (e.g., page views, clicks, feature-flag exposure) captured by PostHog in cookieless mode, so no cookies or localStorage are written
• IP addresses, browser identifiers, and cookie IDs collected by the Meta Pixel; conversion events (e.g., form submissions, CTA clicks) sent server-side to Meta via the Conversions API, only when you have given consent via our cookie banner or by creating an account

3. Legal Basis for Processing

Under data protection laws, we rely on the following bases:

• Consent: for marketing emails and for Meta advertising tracking (Pixel and Conversions API). Marketing consent is separate from creating an account: we ask for it explicitly, and we do not add you to our marketing list unless you opt in. For Meta advertising tracking you may give consent via our cookie banner or by creating an account; if you have not given consent through either method, Meta will not receive or process your data for advertising purposes
• Contract: to deliver services and process payments
• Legal obligation: to comply with laws and regulatory requirements
• Legitimate interests: to enhance our services, maintain security, understand user behavior, and send service emails about activity you have started (see section 4)

4. How We Use Your Personal Information

We use your personal data to:

• Provide and personalize services
• Generate portraits and insights
• Process payments
• Improve the Site and its features
• Communicate with you (e.g., support, notifications, marketing if opted in)
• Meet legal requirements
• Improve the Site and its features, including analysing user interactions through PostHog Cloud US (cookieless, pseudonymised event data only)

Email we send you

We send two distinct categories of email, on two different legal bases:

• Service email, sent on the basis of legitimate interest. These relate to something you have already started: verifying your address, confirming a payment, inviting people to give you feedback, reminders about an open feedback request, and letting you know a portrait is ready. You cannot opt out of these while your account is open, because they are part of delivering the service. If you no longer want them, you can delete your account.
• Marketing email, sent only with your consent. We ask for this separately from signup, and we record when and where you opted in. You can withdraw your consent at any time, and doing so is as easy as giving it. Withdrawing marketing consent does not affect your account or the service email above.

There are two marketing opt-ins, and they are independent. Agreeing to one is never treated as agreeing to the other, and you can hold either one on its own:

• Product news and offers, sent by us through Resend. Withdraw at any time using the toggle under Email preferences in your account settings, or the unsubscribe link in any of these emails.
• Our newsletter, published on Substack. If you opt in, we pass your email address to Substack so they can add you to the newsletter list. Because that list is held by Substack rather than by us, turning the setting off in your account stops us sending your address to them, but only Substack can remove you from the list itself, so use the unsubscribe link in any newsletter email, or your subscription settings on Substack, both of which we link to from your account settings.

If you gave feedback about someone and chose to receive updates from us on the confirmation screen, that is consent to product news and offers, and the unsubscribe link in those emails will remove you.

5. Sharing Your Information

We do not sell your data. We may share it with carefully selected service providers who help us operate, deliver, and improve the KT360 platform. These providers support functions such as secure hosting, encrypted communications, data processing, analytics, performance monitoring, and email delivery. We only share the minimum information necessary for these services to function. We work with vendors who are contractually obligated to follow applicable data protection laws. For vendors processing EU personal data, this includes GDPR compliance.

Meta Platforms, Inc.: When you consent to advertising tracking, we share conversion events (e.g., page views, form submissions), hashed email addresses and IP addresses, and browser identifiers with Meta via the Pixel and Conversions API. This data is used by Meta for advertising attribution and audience building. Meta Platforms, Inc. is based in the United States; transfers of personal data are governed by Standard Contractual Clauses (SCCs). No data is shared with Meta unless you have given consent through our cookie banner or by creating an account.

6. Data Hosting, Security and Infrastructure

• Vercel Serverless Functions: Secure, serverless infrastructure where no credentials are exposed in deployment.
• Neon PostgreSQL: Our primary database, hosted on AWS infrastructure in the United States (AWS US East 1, Northern Virginia), with encryption at rest and in transit. This is where your account, your feedback and your portraits are stored.
• Vercel AI Gateway and Anthropic: We use large language models to anonymise qualitative feedback and turn it into structured insights. Requests are routed through the Vercel AI Gateway to the model provider, which by default is Anthropic (Claude). Feedback text is transmitted for processing, is not retained by the model provider beyond the processing window, and is not used to train their models. All communication is encrypted in transit. Where we evaluate alternative models, the same terms apply to the provider concerned.
• Resend: Email delivery platform with end-to-end TLS encryption, used for both service and marketing email. Resend also stores your email preferences so that unsubscribe requests are honoured immediately. Its marketing list holds only people who have opted in: if you have not consented, no contact record for you exists there.
• Substack: Newsletter platform, used only if you opt in to the newsletter. We send them your email address so they can add you to the list; they then hold that address and manage your subscription under their own privacy policy. Substack Inc. is based in the United States. Nothing is sent to Substack unless you opt in.
• Stripe: Payment processing. Card details are entered directly with Stripe and are never received or stored by us. We retain only a customer reference and the outcome of each transaction.
• Inngest: Background job processing, used to run scheduled and queued work such as report generation and email delivery. Job payloads may contain your name and email address.
• PostHog Cloud US: product analytics, encrypted in transit and at rest, SOC 2 Type II and ISO 27001 certified.
• Have I Been Pwned: When you choose a password we check it against a public database of passwords exposed in known breaches. This uses k-anonymity: only the first five characters of a hash of your password are sent, never your password, your email address or anything that identifies you.

Additional security protocols include:

• TLS/SSL encryption for all data in transit
• Role-based access control (RBAC) for internal staff
• 2FA for all privileged accounts
• Continuous monitoring, logging, and alerting via Sentry

7. Cookies and Tracking Technologies

• Enable basic platform functionality (essential cookies)
• Analyze site usage and behavior (analytics cookies)
• Track advertising and campaigns (marketing cookies)

Analytics Providers:

Plausible Analytics: We use Plausible, a lightweight and privacy-friendly analytics tool that does not use cookies and does not collect personal data. All data is aggregated and anonymized. Plausible is hosted in the EU and compliant with GDPR. For more, visit Plausible's Privacy Policy.

Sentry: Sentry is an application performance monitoring tool provided by Functional Software, Inc. It helps us detect and resolve issues within our platform. Sentry collects technical error data (e.g., device, browser, session logs) but does not record personal user content. Learn more at Sentry's Privacy Policy. For detecting and resolving frontend/backend issues.

Meta Pixel: When you consent to advertising cookies, we load the Meta (Facebook) Pixel on our website. The Pixel sets cookies (_fbp, _fbc), collects behavioural data such as page views, clicks, and browser identifiers, and sends this information to Meta Platforms, Inc. for advertising attribution and audience building. The Pixel is only activated after you accept tracking via our cookie consent banner. Learn more at Meta's Privacy Policy.

Meta Conversions API: In addition to the client-side Pixel, we use Meta's Conversions API to send conversion events (e.g., form submissions, key CTA clicks) server-side to Meta. Any personal data included in these events (such as email addresses) is hashed using SHA-256 before transmission, so plaintext personal data is never sent. The Conversions API only fires when you have granted consent, either via our cookie banner or by creating an account (which constitutes agreement to this Privacy Policy).

Marketing Attribution: When you visit our website from a marketing campaign (e.g., a social media post), the campaign information from the URL (such as UTM parameters like source, medium, and campaign name) may be stored temporarily. If you subsequently create an account, this campaign data is saved alongside your account to help us understand how users discover our service. This data is used solely for internal analytics and is never shared with third parties.

Users can manage cookie preferences through our cookie consent banner or browser settings. You can withdraw your consent at any time by clicking the "Cookie settings" link in the footer of any page. If you created an account and wish to opt out of server-side ad measurement, contact us at contact@knowthyself360.ai.

8. Data Retention

We keep personal data only for as long as it serves the purpose it was collected for.

• Your account and its contents: kept for as long as your account exists. Deleting your account removes it, together with your portraits, your self-portrait, the feedback written about you and the invitations you sent, from our database.
• Unverified accounts: if you start signing up but never confirm your email address, the part-made account is deleted automatically after one month.
• Feedback you write about someone else: held as part of that person's 360, and removed when their account is deleted. Both the original text and the anonymised version are stored; only the anonymised version is ever shown to the person being reviewed.
• Unconfirmed subscription requests: if an email address is entered for the newsletter and the confirmation link is never clicked, the pending request expires and is deleted.
• Consent records: records of consent given or withdrawn are kept as an audit trail for as long as we need to evidence that consent, which data protection law requires us to be able to do. These records hold the email address, what was agreed to and when, and nothing else.
• Billing records: transaction references are retained for as long as tax and accounting law requires.

You can delete your account at any time from your account settings, or ask us to delete it by writing to contact@knowthyself360.ai.

9. International Data Transfers

We are a United States company and our infrastructure is located in the United States. If you use KT360 from the United Kingdom or the European Economic Area, your personal data, including your account, your feedback and your portraits, is transferred to and stored in the United States. It is not held within the UK or the EEA.

Where such transfers occur, we rely on:

• The UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, for transfers of UK personal data
• EU Standard Contractual Clauses (SCCs) for transfers of EEA personal data
• Adequacy decisions, including the UK Extension to the EU-US Data Privacy Framework, where the receiving vendor is certified under it
• Vendor compliance certifications (e.g., SOC 2, ISO 27001)

Specifically, when you consent to advertising tracking (via our cookie banner or by creating an account), conversion event data and hashed identifiers are transferred to Meta Platforms, Inc. in the United States under Standard Contractual Clauses (SCCs).

10. Your Data Rights

Under applicable law, you may have rights to:

• Access personal data
• Correct inaccuracies
• Request deletion
• Restrict or object to processing
• Request data portability

To exercise these rights, contact: contact@knowthyself360.ai

We aim to respond within one calendar month of receiving your request.

If you are unhappy with how we have handled your personal data you have the right to complain to your data protection supervisory authority. In the United Kingdom this is the Information Commissioner's Office (ico.org.uk). In the European Economic Area it is the supervisory authority for the country you live in. We would appreciate the chance to address your concern first, but you are not required to come to us before contacting them.

11. Children's Privacy

KT360 is not intended for children under 13. We do not knowingly collect data from children under this age. Users must confirm they are 13 or older at sign-up.

12. External Links

Our platform may link to third-party sites. We do not control those sites and are not responsible for their content or privacy practices. Please review their policies before using them.

13. Updates to This Policy

We may revise this Privacy Policy to reflect changes in the law, our services, or technology. Updates will be posted on this page and, if material, notified via email or in-app notice.

14. Contact Us

If you have questions or want to exercise your rights, contact us:

Email: contact@knowthyself360.ai

Mail: KnowThySelf360 LP, 874 Broadway, Unit 505, New York, NY 10003, USA

Your use of our services is subject to this Privacy Policy. Processing activities that require your consent will only occur after you have given it: Meta advertising tracking after you accept via our cookie consent banner or by creating an account, and marketing email only after you separately opt in.