Privacy Policy

What We Collect

When you use Kolnox, we collect:

• Account information: Your name, email address and encrypted password when you create an account.
• Practice intelligence: Matter names, deadlines, promises, court dates and related information extracted from your connected email account.
• Document content: When you use Document Review, the content of documents you choose to upload is processed by AI to generate analysis, and is retained only as needed to provide the Service and show you your own review history.
• Usage data: How you interact with the Service, which features you use, and error logs — to help us improve the product.
• Payment information: Kolnox is currently in a free pilot period and does not collect payment information from you. When paid plans launch, billing details will be collected at that time, and payment processing will be handled by a payment provider — we will never store full card numbers.

We do not permanently store the full content of your emails or uploaded documents. Relevant content is processed — by Kolnox and by the trusted AI providers we use — only long enough to extract practice-relevant intelligence, which is what we actually keep.

How We Use Your Information

• To provide the Service: Reading your practice emails to identify and organise matters, promises, deadlines and court dates, and analysing documents you choose to upload for AI-assisted Document Review.
• To improve the Service: Understanding how users interact with Kolnox to fix bugs and build better features.
• To communicate with you: Sending account-related emails, product updates and support responses.
• To process payments: Managing your subscription and billing.

We never use your data to train AI models without your explicit consent.

Email Integration and Document Processing

When you connect Gmail or Outlook, Kolnox requests read access to your email account via official OAuth authentication provided by Google and Microsoft respectively.

• We access only your work-related emails to extract practice intelligence.
• Raw email content is processed — including by the trusted third-party AI providers we use to generate intelligence — and then discarded; only the extracted intelligence is stored long-term.
• We never access emails outside the scope of providing the Service.
• You can revoke email access at any time through your Google or Microsoft account settings.
• The same handling applies to documents you choose to upload for Document Review: content is processed to generate your analysis and is not retained beyond what's needed to provide the Service and your review history.

Data Sharing

We do not sell, rent or trade your personal data. We may share data with:

• Service providers: Third-party services that help us operate Kolnox, such as our database provider (Supabase), email delivery service, and payment processor. These providers are contractually bound to protect your data.
• AI service providers: To generate the intelligence Kolnox produces — matter extraction, deadline detection, and Document Review analysis — relevant content is sent to a small number of trusted third-party AI providers for processing. They do not use your content to train their general AI models, and do not retain it beyond what is needed to process your request.
• Legal requirements: If required by law, court order, or governmental authority, we may disclose information as legally required.
• Business transfer: If Kolnox is acquired or merges with another company, your data may be transferred as part of that transaction. We will notify you before this happens.

Data Security

• Passwords are encrypted using bcrypt — an industry-standard hashing algorithm. We never store or see your plain-text password.
• All data is transmitted over encrypted HTTPS connections.
• Access to firm data is controlled by our role-based permission system.
• We conduct regular security reviews and follow responsible disclosure practices.

No system is perfectly secure. If we become aware of a data breach that affects you, we will notify you promptly in accordance with applicable law.

Your Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request that we correct inaccurate data.
• Deletion: Request that we delete your personal data.
• Portability: Request your data in a portable format.
• Objection: Object to certain types of data processing.

To exercise any of these rights, contact us at hello@kolnox.com. We will respond within 30 days.

If you are located in the European Economic Area, you have additional rights under the General Data Protection Regulation (GDPR). If you are in California, you have rights under the California Consumer Privacy Act (CCPA). We honour these rights regardless of your location.

Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. When you delete your account:

• Your personal data is deleted within 30 days.
• Some data may be retained for longer where required by law or for legitimate business purposes such as fraud prevention.
• Aggregated and anonymised data that cannot identify you may be retained indefinitely.

Cookies

Kolnox uses essential cookies to maintain your session and keep you logged in. We do not use advertising cookies or cross-site tracking. You can disable cookies in your browser settings, but this may affect your ability to use the Service.

Children's Privacy

Kolnox is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from minors. If you believe we have collected data from a minor, please contact us immediately.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and inside the app. The effective date at the top reflects the most recent version.