Privacy Policy
Archived version. This version applied from October 4, 2026 until it was replaced on October 5, 2026. The current version is at gnok.com/legal/privacy.
Version 2026-10-04 · Effective October 4, 2026 · Replaced October 5, 2026 · Replaced version 2026-10-03 and version la-2026-10-01
This policy explains how Gnok, Inc. ("Gnok", "we") collects and uses personal information when you use the Gnok data platform: Gnok Studio, the Gnok sign-in, catalog and SQL services, organization addresses on gnokdb.com, and the websites gnok.com and docs.gnok.com (the earlier gnok.io addresses redirect there) (together, the "Service"). Gnok Mail (gnokmail.com) is covered by its own privacy policy.
Your organization's data. The tables, files and other content an organization puts into the Service ("Customer Data") belong to that organization. We process Customer Data on the organization's behalf, under its instructions and our Data Processing Addendum. If Customer Data includes information about you, contact that organization about it; we will help it respond.
Gnok is in Limited Availability. Please don't store personal, confidential or regulated data in it.
What we collect
- Account information: your name, email address, username, password (stored only as a one-way hash), and second-factor settings such as passkeys or an authenticator app.
- Organization information: your organization's name, its members and their roles, its plan, its trial (start and end dates, credits granted and used), and its settings.
- Sign-up and sign-in information: when you sign up or sign in, the time, the result, your IP address and your browser's user agent. When you accept our terms, we record the version, the time, your IP address and your browser. If your organization uses single sign-on, we receive the name and email your identity provider sends.
- Usage information: the queries you run and their metadata (time, duration, rows, errors), resource usage against your plan, AI and embedding token usage, and audit records of administrative changes.
- Customer Data: the tables, files, models, notebooks, worksheets and dashboards your organization creates. We process it only to provide the Service.
- Billing information (once you subscribe to a paid plan): the billing contact, plan, invoices and payment history. Payment-card details are collected and stored by our payment processor; we receive only limited details such as the card brand, last four digits and expiry date.
- Messages: what you send to support@gnok.com, security@gnok.com or abuse@gnok.com.
- Website requests: like most websites, our servers and content-delivery network process your IP address and browser details to serve pages and protect the Service; our web firewall logs the requests it blocks, challenges or flags.
Why we use it
- To provide the Service: sign you in, run your queries, store your data, and apply your organization's access rules and plan limits.
- To keep the Service secure: detect abuse, throttle and lock repeated failed sign-ins, check new sign-ups, and investigate incidents.
- To communicate with you: review new organizations, and contact you about your account, security, planned maintenance or deletion, billing, and changes to our terms.
- To bill you, once you subscribe to a paid plan.
- To understand how the Service is used so we can improve it. We do this from our own service records; we don't use third-party analytics or advertising trackers.
- To comply with the law and enforce our terms.
We don't sell your personal information, and we don't share it for targeted advertising. We don't send marketing email.
Who processes it for us
We use a small number of service providers, listed with what they do on our Subprocessors page: Amazon Web Services for hosting, storage, backups, content delivery, our web firewall and email delivery; Anthropic for language models; and OpenAI for embeddings. Once online payment is available, a payment processor will handle payments; we will name it on that page before it receives any data.
AI features. Language-model features are off until your organization has a monthly token budget and an administrator enables them; when they run, the prompt and the data it references are sent to Anthropic. EMBED() works within your organization's monthly embedding allowance; when you call it, the text is sent to OpenAI. Under their current API terms, neither provider uses data sent through its API to train its models, and each may keep it for up to 30 days to monitor for abuse before deleting it.
We may also disclose information if the law requires it, to protect the rights, safety or security of users or the Service, or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply to it.
Cookies and browser storage
We use only cookies that the Service needs to work: there are no advertising or analytics cookies. Gnok Studio also keeps your sign-in state and interface preferences in your browser's local storage. The gnok.com and docs.gnok.com websites set no cookies.
| Cookie | Where | Purpose |
|---|---|---|
__gnok_session (__Host-gnok_session on organization addresses) | Gnok Studio | Keeps you signed in to Studio. |
__gnok_csrf (__Host-gnok_csrf) | Gnok Studio | Protects your Studio session against cross-site request forgery. |
__gnok_oidc (__Host-gnok_oidc) | Gnok Studio | Carries the sign-in request while you sign in. |
gnok_catalog_auth | Sign-in page | Keeps a sign-in in progress across its steps. |
gnok_catalog_org | Sign-in page | Remembers which organization you sign in to. |
gnok_catalog_sso, __Host-gnok_catalog_saml | Sign-in page | Single sign-on with your organization’s identity provider. |
__Host-gnok_signup | Sign-up page | Lets the email verification link work in the browser you signed up in. |
gnok_admin_session | Organization administration | Keeps an administrator signed in. |
aws-waf-token | Sign-up and sign-in | Records that your browser passed our bot check (set by our web firewall). |
How long we keep it
During Limited Availability, data may be deleted at any time, and is deleted when the preview ends unless we tell you otherwise. Apart from that, we keep information as follows:
| Information | Kept |
|---|---|
| Account, organization and content | While your organization exists. An organization whose trial or paid subscription ended without an upgrade or a new subscription is kept for 30 days after the end, then deleted. When an organization is deleted, sign-in stops at once and its data is deleted after 7 days. |
| Copies in database backups and earlier versions of files | Database backups (including the copy in a second US region) for 14 days; earlier versions of files for 30 days. After an organization is deleted, these copies are gone within 30 days. |
| Record of a deleted organization | Its name and identifiers, and when and why it was deleted: kept so the name stays reserved and the request is documented. |
| Sign-ups that are never verified | Removed 7 days after the verification link expires. |
| IP address and browser in sign-up email records | Up to 30 days. |
| Record of your acceptance of the terms (version, time, IP address, browser) | With your account, until it or its organization is deleted. |
| Sign-in records, audit records and query history | While your organization exists, and deleted with it. |
| Application logs (which can include email addresses and the text of queries) | 30 days. |
| Load-balancer access logs (IP address, time, requested address, browser) | 90 days. |
| Web firewall logs (IP address, request path, user agent) for requests the firewall blocks, challenges or flags | 90 days. |
| Messages to support or security | As long as needed to answer them and keep a record of the request. |
| Billing records (once you subscribe to a paid plan) | As long as tax and accounting laws require. |
Where it is stored
The Service runs in the United States, on Amazon Web Services in us-east-1 (Northern Virginia), with backup copies in us-west-2 (Oregon). If you use it from elsewhere, your information is transferred to and processed in the United States. The Service is intended for organizations based in the United States.
Your choices and rights
You can see and change most of your account information in Gnok Studio. To ask for a copy of your personal information, a correction, or deletion, or to object to how we use it, email support@gnok.com. We will confirm your identity and respond within 30 days. Depending on where you live, including California and other US states with privacy laws, you may have further rights, such as to know what we collect and to appeal a decision we make about your request. You may use an authorized agent, and we won't treat you differently for exercising your rights.
If your request is about Customer Data that an organization controls, we will pass it to that organization and help it respond.
Security
We protect the Service with encryption in transit (TLS), encryption at rest for stored data and backups, per-organization isolation, a second factor for administrators, a web application firewall, and monitoring. Gnok doesn't hold security or compliance certifications. No system is perfectly secure. Report security issues to security@gnok.com (see our disclosure policy). If a breach affects your personal information, we will tell you as the law requires, and organizations as our Terms of Service describe.
Children
The Service is for organizations and is not directed to children under 18. We don't knowingly collect their information.
Changes
We will post changes here with a new version number and archive the previous version. For material changes, we will tell you by email or in the Service before they take effect.
Contact
Gnok, Inc.. Privacy questions and requests: support@gnok.com.