1.General information
HephaKnot (“HephaKnot”, “we”, “us”) is a company based in Hong Kong. We build Knotest, a desktop application for evaluating AI models and data.
This statement explains what personal data we collect when you use our website at hephaknot.com, the Knotest desktop app, the HephaKnot Console at console.hephaknot.com and the Knotest documentation at docs.hephaknot.com, or when you email us. It also explains how we use that data and the choices you have.
We handle personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong (the “PDPO”). If your organisation has a separate agreement with us that covers personal data, that agreement also applies.
2.What data we collect and how we use it
We collect only what we need to provide each service. What that is depends on the service you use.
2a.This website
Contact form. When you send the contact form, we collect your name, work email and company or organisation, and, if you provide them, your phone number, the topic you select and your message. We use these details to reply to your enquiry and to discuss our products with you.
The form is delivered to our mailbox as an email through our email delivery provider. The website does not store your message in its database. To prevent duplicate and abusive submissions, it keeps a one-time form token, a one-way fingerprint of the submission and its delivery status for up to 24 hours, and a keyed hash derived from your IP address for up to 15 minutes.
Usage analytics. We use a privacy-friendly website analytics service to count page views and a few events: clicks on contact and demo links, plays of the demo video, and when someone starts or successfully sends the contact form. These events record the page address, the site language and where on the page a link was clicked. They never include what you type into the form. The analytics service does not use cookies and does not keep an identifier for your visit for longer than 24 hours.
Technical data. Like any website, our website hosting provider processes technical information such as your IP address, browser type and the pages you request in order to deliver the site and protect it from abuse.
Content management. The website’s content management system is used only by HephaKnot staff. It stores their name, email address and role.
2b.Knotest desktop app
Knotest runs on your Windows computer. Your projects, datasets, models, evaluation results, reports and evidence stay in the folders you choose on that computer. We do not receive them.
Knotest connects to the internet only for the following purposes:
- Licence activation and renewal, with the HephaKnot Console. An activation request contains the organisation name, contact name and contact email you enter, a random installation identifier, a fingerprint of the installation’s licence key, the app version and the identifier of the feature catalogue it supports. Renewals send the installation and activation identifiers. We record the IP address of activation requests for rate limiting and delete it within 48 hours.
- Update checks and downloads, from updates.hephaknot.com, which is served by our network security and content delivery provider. These requests carry standard technical information, such as your IP address.
- Optional inference engine downloads, from the same update service, when you choose to install an engine.
Services you connect. If you set up an API profile to call a model over the network, or connect the Project Operator to an OpenAI or compatible provider with your own API key, Knotest sends the data those features need directly from your computer to the service you chose. HephaKnot does not receive that data. That provider’s own terms and privacy policy apply.
Support bundles and feedback files are created on your computer. They reach us only if you choose to email them to us. Support bundles are designed to leave out model files, dataset files and credentials, but they can contain logs and system details, so please review them before sending.
2c.HephaKnot Console
The HephaKnot Console at console.hephaknot.com is where we manage Knotest licences. Operators and customers sign in by invitation.
- Sign-in. We use an authentication (sign-in) service provider to authenticate Console users. It processes your name, email address and sign-in details. If you sign in with Google, we also receive your Google account’s basic profile: your name, email address and profile picture. See section 9.
- Licence records. Organisations and their contact name and email; licence terms; licence requests; activations and installation identifiers; renewal records; and an audit log of operator actions, which records the operator’s user identifier and email address, the action taken and when it happened.
We use this data to issue and manage licences, to prevent misuse, to support customers and to keep an accountable record of licence changes. The Console is run by our website hosting provider and stores its data with our database provider in Singapore.
2d.Email and support
When you email us at info@hephaknot.com, we receive your email address, your message and any attachments, such as a support bundle. Our mailbox is hosted by our email hosting provider. We use this correspondence to answer you, to provide support and to keep a record of our communication.
Console sign-in codes and invitations are sent by our authentication service provider from hephaknot.com addresses.
3.Cookies
- Website. The website does not use advertising or analytics cookies. It may set one functional cookie, NEXT_LOCALE, to remember the language you chose when it differs from your browser’s language. This cookie expires when you close your browser. Staff who sign in to the content management system also receive sign-in and preview cookies.
- Console. Our sign-in service provider sets cookies that are strictly necessary to keep you signed in and to protect sign-in from abuse. Our network security provider may set a security cookie when it protects our services from automated traffic.
You can block or delete cookies in your browser’s settings. The Console cannot keep you signed in without its cookies.
4.Service providers and international transfers
We use service providers to host, secure and deliver our services: website, Console and documentation hosting, website analytics, network security and content delivery, databases, sign-in, email delivery and email hosting. If you choose Sign in with Google, Google also confirms your account. Our service providers process personal data only on our behalf and only as needed to provide their service. We do not sell personal data.
Some of them store and process data outside Hong Kong, including in the United States and Singapore. We choose established providers and rely on their contractual and security commitments to protect personal data to a standard comparable to the PDPO.
Enterprise customers can request the current list of our service providers, under a confidentiality agreement, by emailing info@hephaknot.com.
5.Retention
We keep personal data only for as long as we need it for the purposes in this statement, or as long as the law requires.
- Enquiries and email stay in our mailbox for as long as we need them to deal with your enquiry and our relationship with you. The website deletes its contact form delivery records within 24 hours and its rate-limiting keys within 15 minutes.
- Licence records are kept for as long as the licence relationship lasts and afterwards as needed for accounting, audit and legal purposes. Pending licence requests expire after 14 days. Audit log entries are deleted two years after the related licence contract ends. Rate-limiting records for activation requests, including IP addresses, are deleted within 48 hours.
- Console accounts are kept while you have access to the Console. Ask us if you would like yours removed.
When we no longer need personal data, we delete it or make it anonymous.
6.Security
We protect personal data with measures suited to the services we run. All of our services use encrypted HTTPS connections. Console access is limited to invited users, and operator actions are recorded in an audit log. Knotest licences are digitally signed, and contact form submissions are checked with signed, short-lived tokens. Our providers encrypt stored data.
No method of transmission or storage is completely secure. Because Knotest keeps your project data on your computer, the security of that computer and its backups remains in your control.
7.Your rights
Under the PDPO, you have the right to:
- ask whether we hold personal data about you and request a copy of it (a data access request);
- ask us to correct personal data about you that is inaccurate; and
- ask about our policies and practices for personal data and the kinds of personal data we hold.
To make a request, email info@hephaknot.com with the subject “Personal data request” and tell us which service it concerns. We may need to confirm your identity before we act on it. We will respond within 40 days, as the PDPO requires. We may charge a fee for a data access request that is not excessive, as the PDPO allows.
If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong.
8.Google user data
The HephaKnot Console offers Sign in with Google through our authentication service provider. When you use it, we request only the basic scopes needed to identify you: openid, email and profile. We receive your name, email address, profile picture and Google account identifier. We do not request access to Gmail, Google Drive, Google Calendar, your contacts or any other Google data.
We use this information only to authenticate you, to match your sign-in to your invitation and to show who is signed in. HephaKnot staff can see your name and email address as a Console user when they manage access or provide support.
HephaKnot’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
We do not sell Google user data. We do not use it for advertising, and we do not use it to develop, improve or train generalised AI or machine learning models. We share it only with our authentication service provider, which provides our sign-in service, or where the law requires it.
You can remove HephaKnot’s access at any time from your Google Account’s third-party connections. To delete your Console account data, email info@hephaknot.com.
9.Children
Our services are intended for businesses and professionals. They are not directed at children, and we do not knowingly collect personal data from anyone under 18.
10.Changes to this statement
We may update this statement when our services or legal requirements change. We will change the “Last updated” date above. If a change is significant, we will also tell Console users by email or in the Console.
11.Contact
If you have a question about this statement or about how we handle your personal data, email HephaKnot at info@hephaknot.com.