What we keep, and who else sees it.

1Who this is about

Who AI Knows is an independent product, built and run by Nitin Mewar and Sidhanth Pandey in India. There is no company behind it; “we” on this page means the two of us. We decide what happens to the personal data described here, which makes us its controller. Write to us at [email protected] about anything on this page.

2What we collect, and when

We collect four things, and each one has a moment it arrives in. Nothing is bought from anyone, and nothing is inferred about you from anywhere else.

• When you run a free rating. Your email address, the domain you typed, and a one-way hash of your IP address. The hash is what stops one person spending the day’s free ratings; we do not store the address itself and we do not write it to our logs.
• When you make an account. Your email address. If you set a password we store it hashed with argon2id, never the password. Sign-in links and session tokens are stored only as hashes, so a copy of our database does not sign anyone in.
• When you pay. We never see your card. Polar is the merchant of record and takes the payment; we keep the customer and subscription references Polar gives us, which plan you are on, whether it is live, and when the period ends.
• When we produce a rating. We fetch the pages of the domain you gave us and the third-party pages the AI assistants cited in their answers, and we keep that text, the assistants’ answers and our analysis of them. Those pages are written by other people and can contain personal data — a founder’s name on an about page, an author byline on a review. We keep them as they were published, and we do not go looking for the people in them.

3Your rating page is public

A finished free rating gets a page at a public address. Anyone with the link can read it. It shows the domain and the score; it never shows the email address that asked for it. The address itself contains the domain, so the link is not a secret — treat it as something you can share, because that is what it is.

The full report behind it is not public. It needs you to be signed in, to be the account the rating belongs to, and to have a live plan.

Anyone can ask us to rate any domain, including one they have nothing to do with. If a page rates a website of yours and you want it taken down, write to [email protected] and say which one. We will remove it.

4Cookies, and what else your browser keeps

Two cookies, both strictly necessary, neither used to follow you anywhere.

• sid — your signed-in session. It is HttpOnly, so the page cannot read it, SameSite=Lax, Secure in production, and it lasts 30 days. Signing out deletes it.
• csrf — a token the page reads and sends back on every write, which is how we know a request came from our own screens and not from someone else’s. It is deliberately readable by the page, SameSite=Strict, Secure in production, and it lasts a day.

Your browser also keeps three preferences for you, on your own machine, that never reach us: theme (dark or light), wk.plan (the plan you clicked, so the choice survives the way to the till) and wk.analytics (your answer to section 5).

The analytics SDK we bundle sets no cookie and keeps its own identifiers in memory for the life of the page.

5Analytics, and your choice

We count page views with OpenPanel so we can see which pages get read. It does not run until you say yes, and saying no is one click and keeps working.

What it never receives: your email address, and the domain you asked us to rate. The address of every page you are on is rewritten before it leaves the browser — a rating page is reported as /r/:slug and never as the domain, the page title is dropped because a rating page titles itself after the business, and the page you arrived from is reduced the same way.

6Who else receives data

These are the companies that process something on our behalf, and the one thing each of them gets. We do not sell personal data to anyone, and there is no advertising network anywhere in this product.

• Polar — payments, as merchant of record. Your email address and an account reference when you start a checkout. They hold the card, we never do.
• Resend — email. Your address and the message: a sign-in link, or your weekly report.
• OpenRouter — the language models that produce every rating. The pages we read and the questions we ask. Not your email address, and not your IP address.
• Serper — Google AI Overviews. The buying question, a country code and a language code. Nothing about you.
• OpenPanel — page-view analytics, and only after you have said yes.
• DuckDuckGo — site icons. Our server asks their icon service for the favicon of the domain you track, and of the sites a public rating already names, then serves it from our own domain. Your browser never contacts them, and they are told a hostname and nothing about you. Inside the dashboard your competitors are drawn as monograms, so the set you track is never named to anyone.
• Our own crawler — not a third party, but worth saying plainly: producing a rating means fetching the domain you gave us and the third-party pages the assistants cited. Those websites see the request and our user agent in their own logs, as they would any other visitor.
• Railway — runs the service and its database.
• Cloudflare — the DNS and the proxy every request passes through on its way to Railway. Both keep the IP addresses of requests in their logs, as any web host does.

7How long we keep it

Expired sessions, and sign-in links that have been used or have run out, are deleted by a cleanup that runs weekly — so within about a week of expiring.

Everything else we keep until you ask us to delete it: your account, your ratings, the runs behind them and the pages we read to produce them. There is no automatic expiry on any of it, and we would rather say so than print a number we do not keep.

8Getting a copy, or getting it deleted

Write to [email protected] from the address on the account and say what you want: a copy of what we hold, a correction, or deletion. We will do it within 30 days.

There is no button for this in the product yet. It is done by hand, which is why it is an email address and not a screen. If that changes, this page changes with it.

9Your rights

If you are in the UK or the EU, the law gives you the right to see what we hold, to have it corrected, to have it deleted, to get it in a portable form, to object to how we use it, and to ask us to restrict what we do with it while something is being sorted out. Section 8 is how you use any of them. You can also complain to the data protection authority where you live.

Our lawful bases: performing the contract, for everything the product does for a paying account; legitimate interests, for keeping the free rating from being abused and for keeping the service secure; and consent, for analytics, which you can withdraw in section 5 as easily as you gave it.

10Where the data is

The service and its database are hosted by Railway. Railway and the other companies in section 6 process data in their own regions, which may be outside the UK, the EU and the country you live in; where that is so, transfers rely on the standard contractual clauses or the provider’s own approved transfer mechanism.

11Children

This is a tool for businesses. It is not meant for anyone under 16, and we do not knowingly keep data about them. If you think we have some, tell us and it goes.

12Changes

When this page changes, the date at the top changes. If a change means something materially different happens to data we already hold, we will email the account before it takes effect rather than quietly editing this page.

The terms that go with this are at Terms.