Privacy Policy

Who this policy covers

This policy describes information handled by KnowStride, a project onboarding service operated by the KnowStride project team, based in Germany. It covers account holders, workspace owners, invitees and people whose information is supplied to a workspace.

Workspace owners choose the participants, content and connected sources used for their onboarding programs. For workspace-specific questions, contact the owner as well as the KnowStride project team. This describes the product’s handling of information; responsibilities for a particular workspace depend on its use and applicable law.

Information handled by the service

Account and membership information includes names and email addresses, roles, password hashes for password accounts, sign-in and invitation records, workspace membership and roles, invitations to join a workspace and provider account identifiers associated with connected integrations. An invitation to a workspace role keeps the invited email address and its status; accepted and revoked invitation records are retained.

Workspace material includes CVs uploaded by owners for invitees, including before the person accepts an invitation, as well as CV text supplied in other onboarding flows. It also includes CV-derived profiles, uploaded file contents and metadata, documents, knowledge bases, onboarding programs and generated lessons and quizzes. Learning records include participation activity, lesson progress, quiz answers, assessment results, scores and generated feedback. Questions and owner feedback supplied to AI-assisted features may also be processed.

Connected sources may include selected GitHub repository contents and pull request metadata, Jira issues and Confluence pages. Integration records include connection details, selected source identifiers and scoped OAuth tokens used to access provider APIs.

Session cookies, technical request information, security events and logs support sign-in, service operation and troubleshooting. Technical information may include IP addresses, browser details and request or error records. Support correspondence includes information you choose to send us. Please do not include credentials or unnecessary sensitive information.

How information is used

Information is used to provide account and workspace access, send invitations, organize onboarding programs, import and resync selected knowledge, generate personalized lessons and quizzes, evaluate assessment answers and show progress and results.

We also use relevant information to maintain reliability, investigate errors, protect accounts and workspaces against misuse, and respond to support and privacy requests. Workspace owners should provide only information appropriate for these purposes and inform people whose information they supply.

Visibility inside a workspace

Workspace owners can access invitee profiles, participation activity, learning progress, submitted answers, scores and assessment results to manage onboarding and provide support. Owners can also manage their workspace’s documents, knowledge sources and programs.

Each workspace member has one role. Owners have the access described above and also manage members, roles and integrations; a workspace has exactly one owner, who can transfer ownership to another member. Admins, such as team leads or managers, can manage programs and knowledge and see the same invitee profiles, participation activity, learning progress, answers and results as owners. Viewers can see programs, people, progress, scores, results and the onboarding plans assigned to participants, but not CV-derived profiles or uploaded CV files, and they cannot change anything. A person can be a workspace member and a program participant at the same time. Members can see each other’s names, email addresses and roles within the workspace.

Invitees receive the learning content assigned to them and their own learning experience. This does not mean every invitee can access raw CVs or all internal source documents. Generated learning content can contain information derived from selected workspace sources, so owners should review it before sharing it.

Connected GitHub and Atlassian sources

Imports use read-only access to retrieve information from GitHub, Jira and Confluence; they do not edit provider content. Provider authorization scopes determine what the connection can read. Workspace owners control which available GitHub repositories, Jira projects or Confluence spaces are selected for import. Content within those selected sources may be read. Review the requested scopes and source selection before connecting.

Disconnecting marks the connection disconnected, clears its stored integration credentials and stops future sync through that connection. It does not erase historical imported content, connection metadata, program material or generated learning content already stored in the workspace. It does not revoke the provider authorization or uninstall a GitHub App. Use the provider’s own settings to revoke its authorization or remove the installation. Already-started processing may have transmitted content. Contact the workspace owner or our team about removal of stored content.

Service providers and AI processing

Railway provides hosting, database and file storage infrastructure. Resend is used to deliver service emails such as invitations and sign-in or verification messages; email delivery involves recipient addresses and message contents.

AI-assisted features send relevant extracted CV text, CV-derived profiles, selected source code, imported knowledge and document text, submitted essay answers and graded evidence to the external AI provider DeepSeek through the Bifrost gateway. Depending on the feature, program details, user questions, owner revision feedback and existing learning content may also be included. These inputs support CV analysis, knowledge summaries, lesson and quiz generation, personalization, essay evaluation and completion feedback. AI processing also occurs during GitHub import and resync to create a codebase overview, not only when a course is generated. Review the information you provide and do not submit secrets or unnecessary sensitive personal data.

External providers process information under their own applicable service terms and arrangements. Provider retention and use of inputs, including any use for training, depend on the applicable provider arrangements; this policy does not guarantee particular provider practices. Contact us for questions about the current processing setup before submitting information with special confidentiality requirements.

Information may also be handled to respond to a valid legal requirement or address a security incident. We limit the information involved to what is appropriate for the request or incident.

Retention and removal

Account information, workspace content and learning records are retained as needed for the purposes described here, including ongoing access, onboarding history, support, security and applicable legal obligations. Retention depends on the type of information and how the account or workspace is managed; there is no blanket automatic deletion period stated in this policy.

Workspace owners may control whether workspace material, programs and participant records remain needed. Removing access or archiving a program does not delete its underlying records. Deleting a CV or profile does not delete existing personalized learning plans, progress, results or participation history; generated content may still contain information derived from the profile. Removing source documents also does not automatically scrub existing generated programs. After personalization, the service attempts CV-original cleanup, which may require retries. File removal is not guaranteed to be immediate.

A workspace owner can permanently delete a program once it has been archived. Deleting a program removes its participants’ enrollments, progress, assessment attempts and results, its generated plans and versions, its knowledge files, its connected sources and any CV originals uploaded for it. A workspace owner can also permanently delete a workspace once it has no programs left; this removes its members, pending invitations and integration connections. These deletions cannot be undone. Stored files are queued for removal and deleted shortly afterwards, which may take longer if the storage provider is temporarily unavailable. They do not delete participants’ user accounts or a CV analysis a person created under their own account, and they do not remove copies held in backups or by service providers under their own arrangements. Deleting a workspace clears the stored integration credentials but does not uninstall the app at GitHub or Atlassian; remove it there as well if you want access ended at the provider.

There is no self-service account-wide erasure feature. Owner deletion covers program and workspace data only. For account closure or a broader deletion request, contact our team; for workspace-data retention, also contact your owner. We may use the owner deletion described above to carry out a request. We will assess the request and relevant limits, including legal obligations and the rights of others. A request should not be treated as confirmation that all information has already been removed.

Cookies and browser preferences

Authentication uses session cookies. Browser local storage remembers preferences such as your theme and selected workspace; the selected-workspace storage key includes your signed-in email address. Session storage remembers open and active program member tabs using enrollment identifiers. Signing out does not automatically clear these browser preferences.

The service and its infrastructure also handle technical and security information as described above. Browser preferences are not a claim that no logs, provider telemetry or other technical information are collected.

Security and international processing

The service uses authentication and workspace access checks to restrict access to protected information. Integration credentials are kept on the server rather than exposed as browser credentials. No online service can guarantee absolute security; use care with account access and the information you upload.

International processing is possible when hosting, email or AI providers handle information outside your country, including outside the European Union. Contact our team for information about the current providers and processing locations.

Privacy requests and your rights

Depending on applicable law and the circumstances, you may have rights of access, correction, deletion, restriction of processing, objection and data portability. Where processing is based on consent, you may withdraw that consent; withdrawal does not change the lawfulness of processing before it.

Send a privacy request to [email protected]. Tell us which account or workspace the request concerns, but do not send a password or unnecessary sensitive information. We may need to verify your identity and coordinate with the workspace owner to handle workspace records and protect other people’s information.

You may also complain to the relevant data protection supervisory authority. The rights available, any exceptions and how a request is handled depend on applicable law and the circumstances. Contact the KnowStride project team if you need help identifying the appropriate contact or understanding how your information is used.

We may update this policy as the service or processing setup changes. The date above identifies the latest wording. Material changes will be communicated through the service or an appropriate contact channel.