Privacy Policy
How KnytX collects, uses, stores, and protects your personal information. KnytX is operated by NCRYPTO Labs Private Limited.
- For browsing, we collect very little. Name and email if you contact us, cookieless analytics when you browse, and application materials if you apply for a role. Protection services add only the identifiers you ask us to protect.
- For protection services, we collect what we need to protect you. Email addresses, phone numbers, and other identifiers data brokers list you under. Biometrics (face, voice) only on Executive plans, only with explicit consent.
- We never sell your data. Not to advertisers, data brokers, or anyone else. Our business model is subscriptions and services — not your data.
- We don't track you with cookies. Our analytics (Umami) is cookieless and privacy-respecting.
- You can ask us to delete your data at any time — email legal@knytx.com and we'll handle it within 30 days. Biometric data is destroyed within 7 days.
- Your rights depend on where you live. EU/UK/Swiss residents have GDPR rights, Indian residents have DPDPA rights, California residents have CCPA rights. We honour all three.
Effective: 22 May 2026.
1. Who we are (the controller)
This Privacy Policy is published by:
NCRYPTO Labs Private Limited (“NCRYPTO Labs”, “we”, “us”)
A company incorporated under the Companies Act, 2013 (India).
Registered office: Bangalore, Karnataka, India.
Email: legal@knytx.com
NCRYPTO Labs operates the KnytX privacy & security platform under the trading name “KnytX”. For the purposes of GDPR (Regulation (EU) 2016/679), NCRYPTO Labs is the data controller of personal data processed through knytx.com and KnytX services. For DPDPA, 2023 purposes, NCRYPTO Labs is the Data Fiduciary. For CCPA purposes, NCRYPTO Labs is the business.
In short: NCRYPTO Labs (India) runs KnytX. It is the controller for GDPR, the Data Fiduciary for DPDPA, and the business for CCPA. A DPO isn’t legally required yet; we re-check that every six months.
2. What this policy covers
In short: this policy covers knytx.com and KnytX products. Other NCRYPTO Labs businesses have their own policy, linked below.
This policy applies to:
- the knytx.com website and any subdomain we publish under knytx.com
- KnytX products and services once you sign up for them (subject to additional product-specific notices)
- KnytX consulting and professional services engagements (subject to additional contractual terms)
For broader processing across NCRYPTO Labs operations — including Stalten (semiconductor IP), XRTE (autonomous systems), and corporate functions — see the NCRYPTO Labs Privacy Policy.
3. What we collect, why, and on what legal basis
In short: the table below lists every category we collect, why we collect it, our legal basis, and how long we keep it. For browsing, it’s very little. Protection services add only the identifiers you ask us to protect.
| Category | What | Why | GDPR lawful basis | DPDPA basis | Retention |
|---|---|---|---|---|---|
| Contact form / email | Name, email, company, message content | To respond to your inquiry | Legitimate interest (Art. 6(1)(f)); consent for marketing follow-up. | Voluntary disclosure for specified purpose | 24 months after last contact |
| Website analytics (Umami) | Hashed page-view events, referrer, country (IP-derived), device class. | Understand traffic and improve the site. | Legitimate interest (Art. 6(1)(f)). Cookieless; no personal identifiers stored. | Anonymised; outside DPDPA scope | Aggregated raw events deleted within 30 days. |
| Job applications | Name, contact details, CV, cover letter, application materials. | Evaluate your application | Pre-contractual steps (Art. 6(1)(b)); consent | Voluntary disclosure for hiring | 12 months from application date |
| Waitlist signups | Email, optional country | Notify you when a product launches; honour early-access pricing. | Consent (Art. 6(1)(a)) | Consent | Until unsubscribed or 24 months inactivity. |
| Service engagement data | As specified in your service agreement. | Deliver the service you've contracted | Performance of contract (Art. 6(1)(b)) | Necessary for service | Per service agreement default 24 months post-termination. |
| Protection identifiers | Emails, phone numbers, postal address, and usernames you ask us to monitor. | File removal requests; run breach and dark-web scans. | Performance of contract (Art. 6(1)(b)) | Necessary for service | Subscription duration deleted within 30 days of cancellation. |
| Facial embeddings | 512-dim vector derived from photos you upload; original photos deleted within seconds. | Detect impersonating social profiles (Executive tier). | Explicit consent (Art. 9(2)(a)) | §6 consent; documented in DPIA | Until consent revoked or plan downgraded; 7-day deletion. See Biometric Data Policy. |
| Voiceprints | 192-dim vector derived from a voice sample; original audio deleted within seconds. | Detect AI voice clones (Executive tier). | Explicit consent (Art. 9(2)(a)) | §6 consent; documented in DPIA | Until consent revoked or plan downgraded; 7-day deletion. |
| Stealer-log identifiers | Email addresses you authorised us to monitor against stealer-log corpora. | Detect active credential compromise (Pro tier+). | Performance of contract (Art. 6(1)(b)) | Necessary for service | Active monitoring window raw queries not logged beyond scan transaction. |
| Dark-web exposure hits | Source forum/market, snippet, date, threat assessment from third-party intelligence. | Notify you of dark-web mentions (Pro tier+). | Performance of contract (Art. 6(1)(b)); Art. 6(1)(f) for security. | Necessary for service | 24 months from detection unless you delete earlier. |
| Scam-call telemetry | Caller-ID match results and timing, no audio. | Maintain the Passive Call Shield and learn new scam patterns. | Performance of contract (Art. 6(1)(b)) | Necessary for service | Aggregated per-call records deleted within 30 days. |
| Call-screening logs | Hashes of incoming numbers checked locally on your device, only uploaded when you flag a number. | Build the scam-number database (anonymised aggregate). | Legitimate interest (Art. 6(1)(f)) for the aggregate; consent for the flag. | Necessary for service | Per-event records deleted within 30 days aggregate persists. |
| Impersonation evidence | Public-profile snapshot, similarity scores, takedown status when you confirm "Not me". | File platform takedown reports on your behalf. | Legitimate interest (Art. 6(1)(f)) — see Impersonation Takedowns. | Necessary for service | 12–18 months full evidence then minimised. |
We do not collect:
- payment card numbers (handled by Stripe / your local processor — see their privacy policies)
- behavioural advertising signals
- cross-site tracking identifiers
- raw call audio or raw SMS bodies — these are processed on your device only (see Mobile App Permissions)
- demographic inferences from biometric data — our face and voice models are not used to infer age, gender, ethnicity, or health
4. Who else sees your data (recipients and sub-processors)
In short: only our vetted service providers, our own staff on a need-to-know basis, the brokers we file removals with, and legal recipients when the law compels it. We never share your data with advertisers or for commercial gain.
We share personal data only with:
- Service providers we contract with to operate the site and services, under written processor agreements that limit their use to instructed purposes. The full sub-processor list is published at /transparency/sub-processors/, with jurisdiction, purpose, what we send each vendor, and the transfer mechanism. That list includes the Pro-tier dark-web vendors (SpyCloud, Hudson Rock, Flare.io, DarkOwl) and the Executive-tier image-search provider (PimEyes).
- NCRYPTO Labs internal teams — engineering, security, customer success, legal — strictly on a need-to-know basis.
- Responding businesses when we file removal requests on your behalf as your authorised agent. The identifiers we share are the minimum necessary to identify you to the broker so they can locate and delete your records.
- Legal recipients — only when compelled by valid legal process (subpoena, court order, or equivalent), and we will notify you unless the legal process forbids it.
We do not share personal data with advertisers, data brokers (other than as a removal target on your behalf), marketing partners, or any party for monetary or commercial consideration.
5. International transfers
In short: your data lives in Frankfurt. The narrow transfers to India (support tickets, CVs) are listed here with their legal basis.
Default processing region is the European Union (Frankfurt, Germany). Some operational data may be transferred to India for processing by NCRYPTO Labs staff — for example, support ticketing and employee CVs reviewed in India. Such transfers from the EU rely on either:
- adequacy mechanisms applicable at the time of transfer, or
- Standard Contractual Clauses (Module 1 / Module 2 as applicable, 2021/914), or
- explicit consent.
A copy of the relevant transfer safeguards is available on request from legal@knytx.com.
6. Your rights
In short: you can ask us to show, fix, delete, or export your data, and you can withdraw consent. Email legal@knytx.com. Your exact rights depend on where you live (GDPR, DPDPA, or CCPA), and you can also complain to a data-protection regulator.
You have the following rights, exercisable by emailing legal@knytx.com. We will respond within 30 days (GDPR / DPDPA) or 45 days (CCPA, extendable by 45 days). There is no charge for a reasonable request.
Under GDPR (EU, UK, Switzerland) — access, rectification, erasure, restriction, data portability, objection, and the right to withdraw consent. You also have the right to lodge a complaint with a supervisory authority. EU/EEA residents may complain to the data protection authority in their own country — find yours in the EDPB members list. UK residents may contact the ICO. Swiss residents may contact the FDPIC.
Under DPDPA, 2023 (India) — access, correction/completion, erasure, and grievance redressal. You may also nominate a representative to exercise your rights if you die or become incapacitated, and you may approach the Data Protection Board of India once it is operationalised.
Under CCPA / CPRA (California) — the right to know, delete, and correct. You may also opt out of “sale” or “sharing” (we do neither), limit our use of sensitive personal information, and be free from retaliation for exercising these rights. We do not sell or share personal information as defined by CCPA.
Universal commitments — we will not require you to create an account to exercise your rights. We will not charge you for reasonable requests. We will verify your identity in proportion to the request’s sensitivity.
7. Cookies and similar technologies
In short: no tracking cookies, no ad cookies, no tracking pixels. Only the few cookies the site needs to work, plus cookieless analytics.
We do not use tracking cookies, advertising cookies, or third-party tracking pixels. We use:
- Strictly necessary cookies for site functionality (preferred currency, theme, region) — set on first interaction, no consent banner required under GDPR e-Privacy guidance.
- No analytics cookies — Umami operates cookieless and uses hashed visit signals only.
If we add additional cookies (e.g., for an authenticated dashboard), we will publish a cookie notice and obtain consent before setting non-essential cookies.
8. Children’s privacy
In short: our consumer products aren’t for children, and we don’t knowingly collect their data. KnytX for Families is run by a parent or guardian, with consent recorded at signup.
KnytX consumer products are not directed at children under 16 (EU) / 18 (India, DPDPA verifiable parental consent threshold) / 13 (US, COPPA). We do not knowingly collect personal data from children. KnytX for Families is intended to be used by a parent or legal guardian on behalf of family members. Parental consent is captured and recorded at signup. If you believe we have collected data from a child without proper consent, contact legal@knytx.com and we will delete it.
9. Security
In short: we encrypt your data at rest and in transit, limit access, test our systems, and will tell you and the regulators if a breach affects you. No system is fully secure, and we don’t pretend otherwise.
We follow security practices proportionate to the sensitivity of the data we hold:
- Encryption at rest (AES-256) and in transit (TLS 1.3)
- Access controls with least-privilege defaults and audit logging
- Annual third-party security review (SOC 2 Type II currently in progress; not yet attested)
- Quarterly penetration testing on production systems
- Documented incident-response runbook with regulatory breach-notification timelines (72h GDPR, 72h DPDPA once operational)
No system is fully secure. We will notify affected individuals and relevant regulators in accordance with applicable law if a breach materially affects you.
10. Automated decision-making and profiling
In short: the scores on your dashboard are for your eyes only. They never set your price, your features, or your eligibility, and we never share them with insurers, lenders, employers, or landlords. You can dispute an input or ask for a human review.
KnytX surfaces several numeric signals on user dashboards. They are the Privacy Risk Score (all tiers), the Privacy Maturity Level (Pro+), the Scam Vulnerability Score (Pro+), and a 4-dimension Pro score (financial, identity-theft, physical safety, reputation).
Your Privacy Risk Score and related signals are used only to inform and alert you. They do not determine the price of KnytX, the features you receive, your eligibility for the service, or any decision with legal or similarly significant effects under GDPR Article 22. We do not share scores with any third party, including insurers, lenders, employers, or landlords. You can contest any score input or request a human review by contacting legal@knytx.com.
The full disclosure lives at /transparency/scoring-transparency/. It sets out the input-to-output mapping for each score, the weights we apply, and your rights: to dispute an input, to a human review, and to opt out of seeing scores. That page is the meaningful-information disclosure required under GDPR Article 13(2)(f) and Article 14(2)(g). It is also the equivalent transparency disclosure for DPDPA, 2023 once the Rules are finalised.
11. Changes to this policy
In short: if our practices change, we update this page and tell you the important changes by email and in-product notice.
We will update this policy when our practices change. Material changes are communicated three ways: by email (to subscribers and waitlist members), by in-product notification, and by a notice on the policy page. The “Last updated” date at the top reflects the most recent revision.
12. Contact
In short: for any privacy question, email legal@knytx.com. For regulator complaints, see Section 6.
Privacy and data-protection inquiries: legal@knytx.com
Postal address: NCRYPTO Labs Private Limited, Bangalore, Karnataka, India
For supervisory-authority complaints, see Section 6.