Privacy Policy

This Privacy Policy describes how we collect, use, and share information in connection with your use of the KNav service.

Last updated: December 10, 2025

This Privacy Policy describes how WhatMatters LLC ("Company," "we," "us," or "our") collects, uses, and shares information in connection with your use of the Knav website, dashboard, embed scripts, and related services (collectively, the "Service").

By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy.

1. Overview

Knav is a command palette service that involves two types of users:

Dashboard Users: Individuals who create accounts, configure command palettes, and embed them on websites
End Users: Visitors to websites where the Knav embed script is installed

This Privacy Policy covers how we handle data for both types of users.

2. Information We Collect

2.1 Information from Dashboard Users

Account Information When you create an account, we collect:

Email address
Name (optional)
Account preferences and settings

Workspace and Command Data When you use the Service, we collect:

Workspace names and settings (theme, colors, branding preferences)
Command configurations (labels, descriptions, action types, URLs)
Embed script settings

Usage Information We automatically collect:

Log data (IP address, browser type, device information, pages visited)
Service usage patterns (features used, actions taken)
Date and time of access

Payment Information If you subscribe to a paid plan, our payment processor (Stripe) collects:

Payment method details (credit card number, expiration date)
Billing address
Transaction history

We do not store complete payment card information on our servers.

2.2 Information from End Users

When someone visits a website with the Knav embed script installed, we may collect:

Interaction Data

Whether the command palette was opened
Commands searched for and selected
Keyboard shortcuts used
Timestamp of interactions

Technical Data

Browser type and version
Device type (desktop, mobile, tablet)
Screen resolution
Referring page URL
Anonymous session identifiers

What We Do NOT Collect from End Users

Personal identification information (names, email addresses)
Cookies for tracking across websites
Sensitive personal data
Keystroke logging beyond command palette searches

2.3 Information from Third Parties

We may receive information from:

Authentication providers (if you sign in via social login in the future)
Analytics services
Payment processors (transaction confirmations)

3. How We Use Information

3.1 Dashboard User Information

We use your information to:

Create and manage your account
Provide, maintain, and improve the Service
Process payments and send transaction confirmations
Send service-related communications (updates, security alerts, support)
Respond to your inquiries and provide customer support
Analyze usage patterns to improve features
Detect, prevent, and address fraud or security issues
Comply with legal obligations

3.2 End User Information

We use end user interaction data to:

Provide analytics to Dashboard Users about command palette usage
Improve the performance and functionality of the embed script
Identify and fix technical issues
Generate aggregated, anonymized insights

3.3 Aggregated and Anonymized Data

We may create aggregated or anonymized data from personal information by removing identifying details. This data may be used for:

Industry benchmarking and reports
Service improvement
Marketing materials (without identifying individuals)

4. How We Share Information

4.1 With Dashboard Users

We share analytics data about end user interactions with the Dashboard Users who own the respective workspaces. This data is aggregated and does not include personal identification of end users.

4.2 Service Providers

We share information with third-party service providers who assist us in operating the Service:

| Provider | Purpose | Data Shared | | -------- | ---------------------- | ------------------------------- | | Neon | Database hosting | Account data, workspace data | | Vercel | Hosting and deployment | Log data, usage data | | Resend | Email delivery | Email addresses, email content | | Stripe | Payment processing | Payment and billing information |

These providers are contractually obligated to protect your information and use it only for the purposes we specify.

4.3 Legal Requirements

We may disclose information if required to do so by law or in response to:

Court orders, subpoenas, or legal process
Requests from law enforcement or government agencies
Protection of our rights, property, or safety
Protection of the rights, property, or safety of others

4.4 Business Transfers

In the event of a merger, acquisition, bankruptcy, or sale of assets, your information may be transferred to the acquiring entity. We will notify you of any such change and any choices you may have regarding your information.

4.5 With Your Consent

We may share your information for other purposes with your explicit consent.

5. Cookies and Tracking Technologies

5.1 Dashboard Website

Our dashboard website uses:

Essential Cookies

Session cookies for authentication
Security cookies for fraud prevention

Analytics Cookies

Usage analytics to understand how visitors use our site
Performance monitoring

You can control cookies through your browser settings. Disabling certain cookies may affect Service functionality.

5.2 Embed Script

The Knav embed script:

Does NOT set cookies on end user browsers
Does NOT track end users across websites
Uses session-based identifiers that do not persist after browser closure
Operates with minimal data collection by design

6. Data Retention

6.1 Dashboard User Data

We retain your account information for as long as your account is active. After account deletion:

Account data is deleted within 30 days
Backup copies may persist for up to 90 days
Aggregated analytics data may be retained indefinitely

6.2 End User Data

End user interaction data is retained according to the Dashboard User's subscription tier:

Free tier: 90 days
Pro tier: 90 days
Enterprise tier: Custom retention periods

6.3 Legal Requirements

We may retain certain information longer if required by law or to protect our legal interests.

7. Data Security

We implement appropriate technical and organizational measures to protect your information, including:

Encryption of data in transit (TLS/SSL)
Encryption of sensitive data at rest
Regular security assessments
Access controls and authentication
Secure cloud infrastructure
Regular backups

However, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

8. Your Rights and Choices

8.1 Account Information

You can:

Access your account information through the dashboard
Update or correct your information at any time
Delete your account by contacting us or using the dashboard settings

8.2 Communications

You can opt out of promotional emails by:

Clicking "unsubscribe" in any promotional email
Updating your communication preferences in the dashboard

You cannot opt out of service-related communications (security alerts, billing notices).

8.3 Data Export

You may request a copy of your data by contacting us at randy@whatmatters.so.

9. Rights for Users in Specific Jurisdictions

9.1 European Economic Area (EEA) and UK - GDPR

If you are in the EEA or UK, you have the following rights under the General Data Protection Regulation (GDPR):

Right to Access: Request a copy of your personal data
Right to Rectification: Request correction of inaccurate data
Right to Erasure: Request deletion of your personal data ("right to be forgotten")
Right to Restrict Processing: Request limitation of how we use your data
Right to Data Portability: Receive your data in a structured, machine-readable format
Right to Object: Object to processing based on legitimate interests
Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent

Legal Basis for Processing

We process personal data under the following legal bases:

Contract: To provide the Service you requested
Legitimate Interests: To improve our Service, prevent fraud, and ensure security
Consent: Where you have provided explicit consent
Legal Obligation: To comply with applicable laws

Data Transfers

Your data may be transferred to and processed in the United States. We ensure appropriate safeguards are in place for such transfers, including Standard Contractual Clauses.

Supervisory Authority

You have the right to lodge a complaint with your local data protection authority.

9.2 California - CCPA/CPRA

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

Right to Know: Request information about the categories and specific pieces of personal information we collect
Right to Delete: Request deletion of your personal information
Right to Correct: Request correction of inaccurate personal information
Right to Opt-Out: Opt out of the sale or sharing of personal information
Right to Non-Discrimination: We will not discriminate against you for exercising your rights

Do Not Sell or Share My Personal Information

We do not sell personal information as defined by the CCPA. We do not share personal information for cross-context behavioral advertising.

Categories of Personal Information Collected

In the past 12 months, we have collected:

Identifiers (email address, name, IP address)
Commercial information (transaction history, subscription details)
Internet activity (usage data, interaction data)
Geolocation data (general location based on IP)

To exercise your California privacy rights, contact us at randy@whatmatters.so.

9.3 Other Jurisdictions

If you are located in another jurisdiction with data protection laws, you may have similar rights. Please contact us to exercise any applicable rights.

10. Information for Website Owners

If you are a Dashboard User embedding Knav on your website, you are responsible for:

Informing your website visitors about third-party services, including Knav
Updating your website's privacy policy to disclose the use of Knav
Ensuring compliance with applicable privacy laws in your jurisdiction
Obtaining any necessary consents from your website visitors

We recommend including language in your privacy policy such as:

"This website uses Knav, a third-party command palette service, to provide navigation functionality. Knav may collect anonymous interaction data such as command searches and selections. For more information, see Knav's Privacy Policy at https://knav.app/privacy."

11. Children's Privacy

The Service is not directed to children under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16, we will take steps to delete such information.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at randy@whatmatters.so.

12. Third-Party Links and Services

The Service may contain links to third-party websites or enable interactions with third-party services. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party websites or services you visit or use.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

Posting the updated Privacy Policy on our website
Updating the "Last Updated" date at the top
Sending an email notification (for material changes)

Your continued use of the Service after any changes indicates your acceptance of the updated Privacy Policy.

14. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us:

WhatMatters LLC Email: randy@whatmatters.so Address:

Data Protection Officer (if applicable): Email: randy@whatmatters.so

For data subject requests (access, deletion, correction), please email randy@whatmatters.so with the subject line "Privacy Request."

15. Additional Information

15.1 Automated Decision-Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects on you.

15.2 Do Not Track

Our Service does not currently respond to "Do Not Track" browser signals. However, our embed script is designed with privacy in mind and minimizes data collection by default.

15.3 Data Protection Principles

We adhere to the following data protection principles:

Lawfulness, Fairness, and Transparency: We process data lawfully and transparently
Purpose Limitation: We collect data for specified, legitimate purposes
Data Minimization: We collect only what is necessary
Accuracy: We keep data accurate and up to date
Storage Limitation: We retain data only as long as necessary
Integrity and Confidentiality: We protect data with appropriate security measures

By using Knav, you acknowledge that you have read and understood this Privacy Policy.