Kniwit.ai Privacy Policy

Effective Date: September 1, 2026

Who We Are and Scope of This Policy

Knitwit.ai is a product and online service owned and operated by TimeclockOnline.com, Inc., a California corporation. TimeclockOnline.com, Inc. is the legal entity that provides the Services, enters into transactions with users, and is responsible for the personal information practices described in this Privacy Policy. Knitwit.ai is a product and brand of TimeclockOnline.com, Inc. and is not a separate legal entity.

In this Privacy Policy, “Knitwit,” “we,” “us,” and “our” refer to TimeclockOnline.com, Inc. and its operation of the Knitwit.ai website and application. “Services” means the Knitwit.ai website, application, and related features and services.

Knitwit provides a web application that helps users compose, manage, store, share, and compare prompts sent through OpenRouter, an artificial-intelligence routing provider (“Routing Provider”), to one or more third-party large language model providers (“Downstream Model Providers”). For supported prompt text, OpenRouter applies a narrowly configured redaction feature limited to the detection of Social Security numbers and payment-card numbers before transmitting that text to a Downstream Model Provider. No other category of personal information is redacted. This feature is described in Section 3. In this Privacy Policy, “AI Providers” collectively means OpenRouter and the Downstream Model Providers. This Privacy Policy explains how we collect, use, disclose, retain, and otherwise process information when you visit or use the Services.

The Services are strictly prohibited from processing protected health information (PHI) under HIPAA, consumer health data under state privacy laws (including Washington’s My Health My Data Act), or any information that would trigger healthcare privacy obligations. Any inclusion of health-related data within User Content constitutes a material breach of our Terms of Use. If health information is submitted inadvertently, Knitwit will process it solely to provide the requested features and will not use it for any secondary purpose. Knitwit is not HIPAA-compliant and does not provide Business Associate Agreements. Users are solely responsible for ensuring they have authorization to submit any health information and understand it will be transmitted to Downstream Model Providers.

For purposes of applicable privacy laws, TimeclockOnline.com, Inc. may act as a “controller” or “business,” or as a “processor,” “service provider,” or “contractor,” depending on the context and as further described below.

Organizational Customers; Controller and Processor Roles

When a business or other organization (“Organizational Customer”) uses the Services to process personal information contained in prompts, files, conversation histories, Model Outputs, notes, shared content, or other Customer Data, the Organizational Customer generally acts as the controller or business, and Knitwit acts as its processor, service provider, or contractor.

Knitwit processes Customer Data only to provide, maintain, secure, and support the Services; follow the Organizational Customer’s documented instructions; transmit data to authorized Downstream Model Providers and other subprocessors; comply with law; and perform other processing permitted by the applicable customer agreement. Knitwit does not sell or share Customer Data for behavioral advertising or use it to train generalized artificial-intelligence or machine-learning models.

Knitwit acts as a controller or business for personal information it processes for its own purposes, including account administration, authentication, billing, security, support, communications, legal compliance, and enforcement of its agreements. Knitwit may therefore act as a processor for Customer Data while acting as a controller for related account, billing, security, or support information.

Organizational Customers are responsible for providing required privacy notices, obtaining necessary rights and consents, configuring the Services appropriately, and responding to privacy requests concerning Customer Data they control. If Knitwit receives such a request, it may refer the requester to the applicable Organizational Customer and will provide assistance as required by law and the applicable agreement.

If an account is controlled by an Organizational Customer, its authorized administrators may access, manage, export, retain, or delete the account and its Customer Data, subject to the organization’s agreement with Knitwit.

Where Knitwit and an Organizational Customer enter into a Data Processing Addendum or other written agreement, that agreement controls over this Privacy Policy to the extent of any conflict concerning Customer Data.

U.S.-Only Service and Processing Locations

The Services are offered only to individuals who reside in and access the Services from the United States, and we may restrict account creation, billing, and access based on IP address, account information, payment information, or other reasonable measures. If you access the Services from outside the United States, you do so at your own risk and understand that your information may be processed in the United States and by service providers located in other jurisdictions.

Knitwit is operated from the United States, and information collected through the Services will be processed and stored in the United States. Downstream Model Providers and other service providers may process information in additional locations according to their own infrastructure, contractual commitments, and privacy practices.

If you access the Services from outside the United States notwithstanding this restriction, you do so contrary to our eligibility requirements and understand that your information may be transferred to and processed in the United States and other jurisdictions whose privacy laws may differ from those where you are located.

1. Information We Collect

a. Account and Contact Information. We may collect your name, email address, password or authentication credentials, and similar account details necessary to administer your account. You may optionally upload photo and/or a public-facing biographical, social media-style paragraph.

b. Billing Information. If you purchase a paid plan, our third-party payment processor collects and processes payment card information. We may receive limited billing details such as your subscription tier, token usage, and payment status, but we do not store full card numbers.

c. Prompt Content and Workspace Data (“User Content”). We collect and store the prompts you create, edit, organize, compare, or save; prompt sections; reusable prompts; shared prompts; conversation histories; model outputs; your edits to outputs; notes; and files you upload, including CSV, PDF, images, and other files. This content may include intellectual property, business information, confidential information, or other sensitive material.

Knitwit may receive and store the original, unredacted version of User Content. When supported text content is submitted for model processing through OpenRouter, OpenRouter may apply a configured redaction feature designed to detect and remove or mask Social Security numbers and payment-card numbers before transmitting the text to a selected Downstream Model Provider. The availability and behavior of this feature may vary by model, request type, file type, and provider.

All other content, including personal names, email addresses, telephone numbers, physical addresses, IP addresses, and any other identifiers you include, is forwarded as submitted. The redaction process does not remove the original information from your Knitwit workspace unless you separately edit or delete it using the Services. For more information about OpenRouter’s guardrails feature generally, including detection categories that Knitwit has not enabled, please review OpenRouter’s Guardrails documentation at https://openrouter.ai/blog/announcements/guardrails/.

d. Model Outputs. We collect responses generated by Downstream Model Providers and any edits you make to those responses.

e. Audit Prompt Data.  If you use our Audit Prompt feature, your prompt text along with specialized evaluation instructions are transmitted to a Downstream Model Provider via OpenRouter to generate an improvement report. Both the prompt and the resulting analysis report are stored in your workspace data.

f. Technical Information. We may collect device and browser information, IP address, log data, usage data, and cookie-related information.

g. Sharing and Recipient Information. If you use a feature that sends or shares prompts, outputs, reports, files, or other content with another person, we collect the recipient’s email address or other contact information, the content being shared, information about the sender, delivery status, and related access and security logs. We use this information to deliver and secure the shared content, prevent abuse, provide support, and maintain records of the sharing request. We process the shared content through third-party transactional email delivery providers

You represent that you are authorized to provide the recipient’s contact information and to share the selected content with that recipient. The recipient may be able to download, copy, forward, or otherwise retain the content. Knitwit cannot control information after it has been received or copied by a recipient.

h. Communications Information. We collect information contained in support requests, feedback, survey responses, and other communications with us. We may also maintain records showing whether service or marketing messages were delivered, opened, or acted upon.

i. Information From Third-Party Services. If you use a third-party authentication service, payment provider, integration, OpenRouter, or a Downstream Model Provider in connection with the Services, we may receive account identifiers, authentication confirmations, transaction information, redaction results, model responses, error messages, usage information, and other information necessary to provide the requested functionality. We do not receive or store complete payment card numbers from our payment processor. This statement does not prevent a payment-card number that a user manually enters into User Content from being received by Knitwit and OpenRouter, although the Limited Guardrail is configured to redact detected payment-card numbers before forwarding supported text to a Downstream Model Provider.

j. Sources of Information. We collect personal information:

• directly from you;
• automatically from your browser, device, and use of the Services;
• from payment processors, authentication providers, Model Providers, hosting providers, security providers, and other vendors;
• from another user when that user shares content with you or provides your contact information; and
• from publicly available or legally permitted sources when necessary for security, fraud prevention, or legal compliance.

k. Information About Other People. User Content may contain personal information relating to employees, customers, clients, contractors, or other third parties. Before submitting such information, you must have all rights, permissions, and legally required notices or consents necessary for Knitwit, its service providers, and the selected Downstream Model Providers to process that information as described in this Privacy Policy.

2. How We Use Information

We use information to:

• provide, maintain, and operate the Services;
• store and organize your prompts and outputs;
• transmit prompts, files, and related context to OpenRouter for routing, redaction processing, and delivery to the Downstream Model Providers you select;
• detect and redact Social Security numbers and payment-card numbers from supported prompt text before that text is forwarded by OpenRouter to a Downstream Model Provider;
• let you compare outputs from multiple LLMs;
• create and maintain your knowledge base of prompts and outputs;
• process payments and track token usage;
• announce product-related information, provide support, and troubleshoot issues;
• detect abuse, secure the Services, and prevent fraud;
• comply with law and enforce our terms; and
• improve the Services using aggregated or de-identified data.

We also aggregate or de-identify personal information so that it no longer reasonably identifies you and use this information for the purposes described above, such as to analyze the way our Services are being used, to improve and add features to them, and to conduct research. We will maintain and use de-identified information in de-identified form and not attempt to reidentify the information, unless required by law.

3. Limited PII Redaction, AI Training, and AI Provider Practices

Knitwit uses OpenRouter to route model requests to the Downstream Model Providers selected by users. OpenRouter applies a Limited Guardrail, which is an automated, best-effort risk-mitigation filter designed to detect and mask Social Security numbers and payment-card numbers before text is forwarded. This is not an absolute guarantee of redaction. Knitwit and OpenRouter receive unredacted data prior to transmission. The availability, scope, and effectiveness of this filter vary by user content, model, request type, file type, and provider.

The redaction feature is designed to address only Social Security numbers and payment-card numbers. Personal names, email addresses, telephone numbers, physical addresses, IP addresses, dates of birth, employer or client identifiers, account numbers other than payment-card numbers, health-related information, and all other content in your prompt text are ordinarily transmitted to each selected Downstream Model Provider as you submit them. You should assume that content other than detected Social Security numbers or payment-card numbers may be disclosed to the Downstream Model Providers you select.

When the Limited Guardrail detects a Social Security number or payment-card number, OpenRouter replaces or removes the detected information before sending the processed text to the selected Downstream Model Provider. If the same request is submitted to multiple Downstream Model Providers, the processed version is transmitted separately to each selected provider.

Redaction, if applied, occurs after the information has been received by Knitwit and OpenRouter. The original, unredacted content remains stored in your Knitwit workspace, conversation history, logs, and backups in accordance with Section 6. Knitwit expressly disclaims liability for automated redaction failures, including the failure to detect or the incorrect redaction of sensitive information. Automated detection may fail, may redact information incorrectly, or may not recognize information presented in unusual formats, contexts, or languages. Users remain solely responsible for ensuring that sensitive identifiers, regulated data, and confidential information are not submitted into prompts or workspace sections.

Unless expressly stated otherwise in the Services, the redaction feature applies only to supported text transmitted through the applicable OpenRouter workflow. It may not apply to files, images, audio, embedded file content, model outputs, content sent through third-party integrations, or information shared with other people. The scope and applicability of the feature may change as models, providers, and workflows evolve.

The Limited Guardrail applies only to Social Security numbers and payment-card numbers detected in supported prompt text. It does not apply to any other personal information contained in submitted content, and it does not apply to account information, billing information, technical metadata, security logs, recipient information, or other information processed separately to operate the Services. For example, we process your account email address and IP address for authentication, security, fraud prevention, and service administration, and any name, email address, telephone number, or physical address you enter into a prompt is transmitted to the selected Downstream Model Providers without redaction. You remain responsible for reviewing content before submission and for having all rights, permissions, notices, and consents required to process it. The Limited Guardrail does not make Knitwit suitable for protected health information, cardholder data, government identifiers, or other regulated data, and it does not override the restrictions in Section 5.

OpenRouter’s Independent Practices: OpenRouter receives all submitted content before applying the Limited Guardrail and processes it according to its own publicly available Terms of Service and Privacy Policy. Knitwit does not have a custom Data Processing Addendum with OpenRouter and relies on their standard terms. OpenRouter’s current privacy policy can be found here: https://openrouter.ai/privacy.

Downstream Model Provider Practices: Downstream Model Providers receive all remaining prompt text (including any identifiers you include), conversation context, instructions, and files. A provider’s retention, logging, human-review, and model-training practices may differ substantially from Knitwit’s. Before submitting content, you must review the disclosures presented for the selected Downstream Model Provider. Knitwit does not control an AI Provider’s independent use of information and cannot guarantee deletion from an AI Provider’s systems beyond the scope of their standard public agreements.

4. How We Disclose Information

We may disclose personal information to the following categories of recipients for the purposes described in this Privacy Policy:

• OpenRouter, to receive model requests, apply the Limited Guardrail, route requests, and transmit processed content to the Downstream Model Providers selected by users;
• Downstream Model Providers, to process the prompt text, instructions, conversation context, files, or other content forwarded through OpenRouter after any applicable guardrail processing;
• hosting and storage providers, to host the Services and store account information and User Content;
• authentication and identity providers, to create accounts, authenticate users, and prevent unauthorized access;
• payment processors, to process subscriptions, payments, refunds, and billing events;
• email and communications providers, to send account notices, support communications, and user-requested shared content;
• security, logging, and fraud-prevention providers, to protect users and the Services;
• analytics providers, if enabled as described in this Privacy Policy;
• professional advisers, including attorneys, accountants, insurers, and auditors, subject to appropriate confidentiality obligations;
• government authorities and other parties, when we reasonably believe disclosure is required by law or necessary to protect rights, safety, property, users, or the Services;
• a purchaser, successor, or transaction participant, in connection with a financing, merger, acquisition, reorganization, bankruptcy, sale of assets, or similar transaction; and
• other people or organizations at your direction, including recipients with whom you choose to share content.

We may also disclose aggregated or de-identified information that cannot reasonably be used to identify you.

The Downstream Model Providers currently available through the Services are identified in the application when you select a model or submit a request. OpenRouter serves as the Routing Provider for these requests. Available models and Downstream Model Providers may change over time.

4A. Categories of Personal Information

• Identifiers and account information
• Commercial information
• Internet or electronic activity
• Approximate location
• User Content and electronic communications
• Audio, visual, or similar information
• Sensitive personal information

These categories describe information Knitwit may collect, including information contained in original User Content. They do not necessarily describe the information ultimately transmitted to a Downstream Model Provider. As described in Section 3, OpenRouter is configured to redact only detected Social Security numbers and payment-card numbers from supported prompt text; information in the other categories listed above may be transmitted to a Downstream Model Provider as submitted.

We do not intentionally infer sensitive characteristics about users from User Content or use sensitive personal information to determine eligibility for employment, housing, credit, insurance, health care, or other services producing legal or similarly significant effects.

5. Sensitive, Regulated, and Third-Party Information

The Services are not designed to process regulated or unusually sensitive information. OpenRouter applies the Limited Guardrail — Social Security numbers and payment-card numbers only — to supported prompt text. The Limited Guardrail does not detect any other regulated or sensitive information, is not guaranteed to identify every Social Security number or payment-card number, and does not make the Services appropriate for regulated data. Knitwit and OpenRouter may receive the information before redaction occurs. Unless Knitwit expressly agrees otherwise in writing, you must not submit:

• protected health information subject to HIPAA, consumer health data under state privacy laws, or any other regulated health or medical information;
• payment-card numbers, card security codes, or other cardholder data, except for payment information submitted directly to Knitwit’s authorized payment processor through the designated billing interface;
• Social Security numbers, tax identification numbers, government identification numbers, financial account numbers, or financial account credentials;
• precise geolocation information;
• consumer reports or information regulated by the Fair Credit Reporting Act;
• information regulated by the Gramm-Leach-Bliley Act, FERPA, CJIS requirements, or similar sector-specific laws;
• information subject to professional secrecy, attorney-client privilege, or another confidentiality restriction unless you have determined that transmission to Knitwit and the selected Model Providers is authorized and will not waive or violate that protection; or
• personal information, source code, trade secrets, confidential information, or other material you are not authorized to store or disclose.

Because the Limited Guardrail does not redact names, contact information, or other ordinary identifiers, any personal information about third parties that you include in a submission will be disclosed in full to the Downstream Model Providers you select. You must hold all rights, permissions, and consents necessary for that disclosure before submitting.

The fact that Social Security numbers and payment-card numbers are within the Limited Guardrail’s scope does not authorize you to submit them; the restrictions above prohibit doing so, and you must not rely on the Limited Guardrail as a substitute for removing Social Security numbers, cardholder data, protected health information, authentication credentials, or other regulated or highly sensitive information before submission.

The Limited Guardrail is intended to reduce disclosure to Downstream Model Providers. It does not prevent the original content from being processed by Knitwit or OpenRouter, stored in your workspace, included in backups, disclosed through a sharing feature, or accessed by a person to whom you choose to send or share the content. You should separately review and redact content before storing or sharing it.

You are responsible for selecting the Downstream Model Provider, conversation context, files, and prior interactions included with each submission. Removing an item from a conversation may prevent it from being included in future Knitwit submissions, but it does not recall information already transmitted to a Downstream Model Provider or received by another person.

6. Retention and Deletion

We retain information only for as long as reasonably necessary for the purposes described in this Privacy Policy, subject to the following general retention periods:

• User Content: Retained until you delete it or close your account. Deleted User Content will ordinarily be removed from active systems within 30 days and may remain in encrypted or access-restricted backups for up to 90 additional days.
• Account information: Retained while your account is active and ordinarily deleted or de-identified within 90 days after account closure.
• Shared content and recipient information: Retained while the sharing feature or link remains active and for up to 90 days afterward for security, delivery, and abuse-prevention purposes. Copies retained by recipients are not controlled by Knitwit.
• Technical, access, and security logs: Ordinarily retained for up to 12 months, unless a longer period is reasonably necessary to investigate abuse, fraud, or a security incident.
• Support and business communications: Ordinarily retained for up to three years after the communication is resolved.
• Billing, tax, and transaction records: Retained for up to seven years, or longer if required by applicable tax, accounting, or financial laws.
• Privacy-request records: Retained for at least two years or for the period required by applicable law.

We may retain information beyond these periods when reasonably necessary to comply with law, respond to legal process, preserve evidence, establish or defend legal claims, enforce our agreements, investigate fraud or abuse, or complete a corporate transaction. When practical, we will restrict the information from ordinary use during the extended retention period.

Deletion from Knitwit does not delete information already transmitted to a Model Provider, downloaded by you, included in an external system, or received or copied by a sharing recipient. Those copies are governed by the practices of the applicable third party.

Deleting content from Knitwit does not necessarily delete copies or records processed by OpenRouter or a Downstream Model Provider. OpenRouter receives submitted content before applying the Limited Guardrail and may retain request information according to its contractual commitments and applicable retention practices. A Downstream Model Provider ordinarily receives the version of supported text processed by the Limited Guardrail, but it may retain that processed content according to its own contractual commitments and retention practices. Knitwit will request or facilitate provider-side deletion when required by applicable law and supported by our agreement with the applicable provider.

7. Security and Security Incidents

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, acquisition, destruction, alteration, or disclosure. These safeguards may include encryption in transit, encryption at rest where supported, access controls, authentication controls, logging, monitoring, backup protections, and restrictions on personnel access.

Our use of the Limited Guardrail is a narrow data-minimization measure that reduces only the disclosure of detected Social Security numbers and payment-card numbers to Downstream Model Providers. It is not an encryption mechanism, a data-loss-prevention guarantee, or a substitute for appropriate access controls and user review. The Limited Guardrail may fail to detect information or may redact information incorrectly.

No online service or storage system can be guaranteed to be completely secure. You are responsible for maintaining the confidentiality of your credentials, using a unique and secure password, enabling any available security features, and promptly notifying us if you suspect unauthorized access to your account.

If we discover a security incident affecting personal information, we will investigate and take reasonable measures to contain and remediate the incident. We will notify affected individuals and government authorities when required by applicable law.

8. Cookies, Analytics, and Privacy Signals

We use cookies, local storage, and similar technologies that are necessary to authenticate users, maintain sessions, remember preferences, protect the Services, and provide requested functionality. Disabling essential technologies may prevent portions of the Services from functioning.

We do not currently use Google Analytics or third-party advertising cookies. If we introduce non-essential analytics, advertising, or cross-site tracking technologies, we will update this Privacy Policy and provide any notice, consent mechanism, or opt-out required by applicable law before using those technologies.

Some browsers transmit “Do Not Track” signals. Because there is no uniform industry standard for responding to those signals, the Services do not currently respond to ordinary Do Not Track settings. Where required by applicable law, we will process recognized universal opt-out signals, such as the Global Privacy Control, as requests to opt out of sale, sharing, or targeted advertising for the browser or device transmitting the signal.

8A. Service and Marketing Communications

We may send transactional or service-related messages concerning your account, security, billing, changes to the Services, and changes to our legal terms. Because these messages are necessary to administer the Services, you may not be able to opt out of them while maintaining an account.

We may also send promotional or marketing communications where permitted by law. You may unsubscribe from marketing emails by using the unsubscribe link in the message or by contacting us. Unsubscribing from marketing communications will not stop transactional or service-related messages.

8B. Third-Party Services and Links

The Services use OpenRouter to route requests to Downstream Model Providers and may contain links to, integrate with, or allow you to interact with other third-party services. OpenRouter receives submitted content before applying the Limited Guardrail. Downstream Model Providers receive the content forwarded by OpenRouter after that processing. Knitwit’s Privacy Policy does not govern a third party’s independent collection or use of information, and your use of a third-party service may also be subject to that party’s privacy policy and terms.

8C. De-Identified Information

We may create and use aggregated or de-identified information for analytics, security, research, and product improvement. When we maintain information as de-identified, we will maintain and use it in de-identified form and will not attempt to re-identify it except to test whether our de-identification measures are effective or as otherwise permitted by law.

9. Children’s privacy

The Services are not directed to children under 18, and we do not knowingly collect personal information from children under 18.

10. U.S. State Privacy Rights

Depending on your state of residence and the applicability of state law, you may have the right to:

• confirm whether we process your personal information;
• request access to personal information we maintain about you;
• request correction of inaccurate personal information;
• request deletion of personal information, subject to legal exceptions;
• obtain a portable copy of certain personal information;
• obtain information about the categories of personal information collected, used, and disclosed;
• opt out of the sale of personal information, sharing for cross-context behavioral advertising, or use for targeted advertising;
• limit certain uses or disclosures of sensitive personal information;
• opt out of certain profiling or automated decision-making activities producing legal or similarly significant effects;
• use an authorized agent to submit a request where permitted by law;
• appeal our denial of a privacy request; and
• receive equal service and pricing without unlawful discrimination for exercising a privacy right.

Knitwit does not currently sell personal information for money or other valuable consideration, share personal information for cross-context behavioral advertising, or use personal information for targeted advertising as those terms are defined under applicable state privacy laws. We do not use sensitive personal information for purposes that require a right to limit under California law. We do not currently offer financial incentives in exchange for personal information.

We do not use personal information to make decisions based solely on automated processing that produce legal or similarly significant effects concerning users.

Submitting a Request

You may submit a privacy request by:

• emailing privacy@knitwit.ai with the subject line “Privacy Request”; or
• using the privacy or account controls available within the Services, if provided.

Your request should identify the right you wish to exercise and provide sufficient information for us to locate your account and verify your identity. We may verify a request by requiring access to the email address associated with the account, authentication through the account, confirmation of account information, or other information reasonably necessary to prevent unauthorized disclosure or deletion.

We will respond within the period required by applicable law, generally within 45 days. When legally permitted, we may extend that period after notifying you. We may deny or limit a request when an exception applies, when we cannot reasonably verify your identity, or when fulfilling the request would adversely affect another person’s rights.

Authorized Agents

Where permitted by law, an authorized agent may submit a request on your behalf. We may require evidence of the agent’s authority and may ask you to verify your identity or confirm that you authorized the request. An agent holding a legally valid power of attorney may provide that documentation instead.

Appeals

If we deny your request, you may appeal by emailing privacy@knitwit.ai with the subject line “Privacy Appeal” within 30 days after receiving our decision. Include a copy or description of the original request and explain why you believe the decision should be reconsidered. We will respond within the period required by applicable law.

10A. California Privacy Notice

This section supplements the remainder of this Privacy Policy for California residents. During the preceding 12 months, we may have collected the categories of personal information identified in Sections 1 and 4A from the sources described in Section 1(j). We may have used and disclosed those categories for the business and commercial purposes described in Sections 2 and 4.

Knitwit has not knowingly sold or shared the personal information of consumers under 16 years of age. Because the Services are restricted to adults, users under 18 may not create accounts or use the Services.

California residents may exercise the rights described in Section 10. California law may permit us to retain or decline to delete information needed to complete transactions, provide requested services, detect security incidents, prevent fraud, exercise legal rights, comply with law, or make other internal and lawful uses compatible with the context in which the information was provided.

California’s “Shine the Light” law may permit California residents to request information concerning disclosures of certain personal information to third parties for those parties’ direct-marketing purposes. Knitwit does not disclose personal information to third parties for their own direct-marketing purposes without authorization.

11. Data Controls

Our Services provide you with a number of controls over your Personal Data and how it is used and retained. You can always change these settings in your account. These include the following controls:

• You can export your any part of your stage, chats, conversations, topics, and saved prompts.
• You can delete stages or stage elements, threads, audits, conversations, topics, responses, knit insights, or your account entirely.
• Depending on applicable law, you may be able to choose which cookies are used when you use our Services
• You can unsubscribe from marketing communications you receive from us by using the choices provided in those communications.

12. Changes to This Policy

We may update this Privacy Policy to reflect changes in the Services, Model Providers, legal requirements, or our information practices. We will post the revised Privacy Policy and update the Effective Date.

If a change materially affects how we use or disclose previously collected personal information, we will provide additional notice through the Services, by email, or by another reasonable method before the change takes effect when required by law. We will obtain consent when applicable law requires consent for the changed practice.