Privacy Policy

Who this policy covers

This policy describes information handled by KnowStride, a project onboarding service operated by the KnowStride project team, based in Germany. It covers account holders, workspace owners, invitees and people whose information is supplied to a workspace.

Workspace owners choose the participants, content and connected sources used for their onboarding programs. For workspace-specific questions, contact the owner as well as the KnowStride project team. This describes the product’s handling of information; responsibilities for a particular workspace depend on its use and applicable law.

Information handled by the service

Account and membership information includes names and email addresses, roles, password hashes for password accounts, sign-in and invitation records, workspace membership and provider account identifiers associated with connected integrations.

Workspace material includes CVs uploaded by owners for invitees, including before the person accepts an invitation, as well as CV text supplied in other onboarding flows. It also includes CV-derived profiles, uploaded file contents and metadata, documents, knowledge bases, onboarding programs and generated lessons and quizzes. Learning records include participation activity, lesson progress, quiz answers, assessment results, scores and generated feedback. Questions and owner feedback supplied to AI-assisted features may also be processed.

Connected sources may include selected GitHub repository contents and pull request metadata, Jira issues and Confluence pages. Integration records include connection details, selected source identifiers and scoped OAuth tokens used to access provider APIs.

Session cookies, technical request information, security events and logs support sign-in, service operation and troubleshooting. Technical information may include IP addresses, browser details and request or error records. Support correspondence includes information you choose to send us. Please do not include credentials or unnecessary sensitive information.

How information is used

Information is used to provide account and workspace access, send invitations, organize onboarding programs, import and resync selected knowledge, generate personalized lessons and quizzes, evaluate assessment answers and show progress and results.

We also use relevant information to maintain reliability, investigate errors, protect accounts and workspaces against misuse, and respond to support and privacy requests. Workspace owners should provide only information appropriate for these purposes and inform people whose information they supply.

Visibility inside a workspace

Workspace owners can access invitee profiles, participation activity, learning progress, submitted answers, scores and assessment results to manage onboarding and provide support. Owners can also manage their workspace’s documents, knowledge sources and programs.

Invitees receive the learning content assigned to them and their own learning experience. This does not mean every invitee can access raw CVs or all internal source documents. Generated learning content can contain information derived from selected workspace sources, so owners should review it before sharing it.

Connected GitHub and Atlassian sources

Imports use read-only access to retrieve information from GitHub, Jira and Confluence; they do not edit provider content. Provider authorization scopes determine what the connection can read. Workspace owners control which available GitHub repositories, Jira projects or Confluence spaces are selected for import. Content within those selected sources may be read. Review the requested scopes and source selection before connecting.

Disconnecting marks the connection disconnected, clears its stored integration credentials and stops future sync through that connection. It does not erase historical imported content, connection metadata, program material or generated learning content already stored in the workspace. It does not revoke the provider authorization or uninstall a GitHub App. Use the provider’s own settings to revoke its authorization or remove the installation. Already-started processing may have transmitted content. Contact the workspace owner or our team about removal of stored content.

Service providers and AI processing

Railway provides hosting, database and file storage infrastructure. Resend is used to deliver service emails such as invitations and sign-in or verification messages; email delivery involves recipient addresses and message contents.

AI-assisted features send relevant extracted CV text, CV-derived profiles, selected source code, imported knowledge and document text, submitted essay answers and graded evidence to the external AI provider DeepSeek through the Bifrost gateway. Depending on the feature, program details, user questions, owner revision feedback and existing learning content may also be included. These inputs support CV analysis, knowledge summaries, lesson and quiz generation, personalization, essay evaluation and completion feedback. AI processing also occurs during GitHub import and resync to create a codebase overview, not only when a course is generated. Review the information you provide and do not submit secrets or unnecessary sensitive personal data.

External providers process information under their own applicable service terms and arrangements. Provider retention and use of inputs, including any use for training, depend on the applicable provider arrangements; this policy does not guarantee particular provider practices. Contact us for questions about the current processing setup before submitting information with special confidentiality requirements.

Information may also be handled to respond to a valid legal requirement or address a security incident. We limit the information involved to what is appropriate for the request or incident.

Retention and removal

Account information, workspace content and learning records are retained as needed for the purposes described here, including ongoing access, onboarding history, support, security and applicable legal obligations. Retention depends on the type of information and how the account or workspace is managed; there is no blanket automatic deletion period stated in this policy.

Workspace owners may control whether workspace material, programs and participant records remain needed. Removing access or archiving a program does not delete its underlying records. Deleting a CV or profile does not delete existing personalized learning plans, progress, results or participation history; generated content may still contain information derived from the profile. Removing source documents also does not automatically scrub existing generated programs. After personalization, the service attempts CV-original cleanup, which may require retries. File removal is not guaranteed to be immediate.

There is no self-service account-wide erasure feature. For a broader deletion or account-closure request, contact our team; for workspace-data retention, also contact your owner. We will assess the request and relevant limits, including legal obligations and the rights of others. A request should not be treated as confirmation that all information has already been removed.

Cookies and browser preferences

Authentication uses session cookies. Browser local storage remembers preferences such as your theme and selected workspace; the selected-workspace storage key includes your signed-in email address. Session storage remembers open and active program member tabs using enrollment identifiers. Signing out does not automatically clear these browser preferences.

The service and its infrastructure also handle technical and security information as described above. Browser preferences are not a claim that no logs, provider telemetry or other technical information are collected.

Security and international processing

The service uses authentication and workspace access checks to restrict access to protected information. Integration credentials are kept on the server rather than exposed as browser credentials. No online service can guarantee absolute security; use care with account access and the information you upload.

International processing is possible when hosting, email or AI providers handle information outside your country, including outside the European Union. Contact our team for information about the current providers and processing locations.

Privacy requests and your rights

Depending on applicable law and the circumstances, you may have rights of access, correction, deletion, restriction of processing, objection and data portability. Where processing is based on consent, you may withdraw that consent; withdrawal does not change the lawfulness of processing before it.

Send a privacy request to [email protected]. Tell us which account or workspace the request concerns, but do not send a password or unnecessary sensitive information. We may need to verify your identity and coordinate with the workspace owner to handle workspace records and protect other people’s information.

You may also complain to the relevant data protection supervisory authority. The rights available, any exceptions and how a request is handled depend on applicable law and the circumstances. Contact the KnowStride project team if you need help identifying the appropriate contact or understanding how your information is used.

We may update this policy as the service or processing setup changes. The date above identifies the latest wording. Material changes will be communicated through the service or an appropriate contact channel.