Privacy policy

Last updated: November 5, 2026

This policy explains what Knocklog collects, why, for how long, who we share it with and what rights you have. It covers the website knocklog.ai, the API at api.knocklog.ai, the MCP server and the emails we send. Knocklog was designed to keep as little personal data as possible: we never store full IP addresses, query strings, cookies or request headers from the visitors of the sites we measure.

Who is responsible

There are two situations:

Data about the visitors of a customer's site. The customer who installed Knocklog on their site is the controller. Knocklog processes that data only on the customer's behalf and to provide the service to them.
Data about our customers and about visitors to knocklog.ai. Knocklog is the controller.

Knocklog is a service of Workers Tecnologia Ltda, based in Florianópolis, Santa Catarina, Brazil.

Data about the visitors of the sites we measure

When a site sends us its traffic through our Cloudflare Worker, through imported access logs or through the API, we keep, for each request from an automated client and for each successful page view by a person:

the time, the HTTP method, the path of the page (without the query string) and the response status;
the identification of the agent (name, operator and type) and the result of the identity check; the browser identification string (user agent) is not stored;
a shortened form of the network the request came from, never the full IP address;
when a person arrived from an AI assistant, the name of that assistant (for example, ChatGPT or Perplexity).

The full IP address is used only while the request is processed, to check the agent's identity, and is then discarded. For ordinary visitors, our collector does not send the IP address at all. Uploaded log files are processed and not stored; only the fields above are kept. We do not use cookies, fingerprinting or cross-site tracking, and we do not try to identify people.

Data about our customers

Project: the site's address, its name and the creation date. Keys are stored in a protected form that cannot be read back.
Weekly summary: the email address you give us, the language, and when you confirmed and when we last sent. Nothing besides the confirmation email is sent until you click its link, which expires after 7 days.
Billing: the identifiers of your customer record and subscription at Stripe and the subscription status. Card and payment data go directly to Stripe; we never receive them.
Sign-in: when you sign in by email, a one-time link valid for 15 minutes and a session that lasts up to 30 days or until you sign out.
Contact: the messages you send to contact@knocklog.ai.

Visitors to knocklog.ai

knocklog.ai uses no cookies and no third-party analytics or advertising trackers. Your browser keeps your language choice and, while you are signed in, your access to the report; the access is sent only to the Knocklog API, to load your data. When you check a site, we fetch its public pages and keep the result in a cache for a short time so repeated checks are fast. To prevent abuse, request rates are limited using the IP address, which is not stored for that purpose. Our infrastructure provider, Cloudflare, keeps operational logs of requests for a short period for security.

Why we use the data

To provide the service you asked for: collect, verify and report traffic, send the emails you confirmed and manage your plan (performance of a contract).
To keep the service secure and prevent abuse (legitimate interest).
To send the weekly summary (your consent, which you can withdraw at any time with the unsubscribe link in every email).
To keep billing and tax records (legal obligation).
To produce aggregated statistics about AI agents that do not identify any customer, site or person (legitimate interest).

We do not sell personal data and do not use it for advertising.

Cloudflare, which hosts the site and the API, stores the data and sends our emails.
Stripe, which processes payments and manages subscriptions.
Public authorities, when the law or a court order requires it.

These providers may process data outside Brazil, including in the United States. We rely on providers that commit to safeguards compatible with the Brazilian General Data Protection Law (LGPD), such as standard contractual clauses.

How long we keep it

Traffic events: for the history of the project's plan, and at least 90 days (Free and Pro: 90 days; Business and Enterprise: 13 months). After a downgrade, the longer history is kept for 30 more days.
Projects: until you ask us to delete them.
Email for the weekly summary: until you unsubscribe or the project is deleted.
Billing records: for as long as tax and accounting law requires.
Site check results: a short cache, refreshed when the site is checked again.

Security

All traffic is encrypted. Keys are protected, sign-in links and sessions expire, each project's data is kept separate from the others, and access to production systems is limited to the people who run Knocklog.

Your rights

Under the LGPD, and under similar laws such as the GDPR where they apply, you can ask us to confirm whether we process your data, access it, correct it, delete it, port it, receive information about who we share it with, and withdraw consent. Write to contact@knocklog.ai and we will answer within 15 days. If your data reached us as a visitor of a customer's site, contact that site first, as they decide about it; we will help them answer. You may also complain to the Brazilian data protection authority (ANPD).

Children

Knocklog is a service for businesses and is not directed at people under 18.

Changes to this policy

When we change this policy, we will update the date at the top. For material changes we will give notice on this page and, when we have your email, by email.

Contact and data protection officer

Questions, requests and the data protection officer (encarregado): contact@knocklog.ai