Knit

GDPR overview

There is no mention of the GDPR anywhere on the site: neither "GDPR" nor "General Data Protection Regulation" appears on any page. No Article 27 EU representative is designated, no data protection officer is named, no data processing agreement is offered, no sub-processor list is published and no legal basis for processing is stated. What stands in its place is the privacy policy of 27 July 2023, which sets out eight GDPR-style rights (to know, access, correct, erase, complain, object, portability and non-discrimination) and explicitly extends them to every customer whatever their location. Transfers outside the EU are acknowledged rather than framed: users in the EU or the UK are told their information is transferred to and stored in the United States, and that using the service constitutes consent. Data questions go to jc@promptknit.com.

Who owns the data?

Knit's privacy policy opens by stating that the data is yours, not the publisher's, and promises that personal data is never sold to third parties, a commitment repeated in the homepage footer. JIKE HK LIMITED stores your name, email address, billing information and billing address, prompt data, third-party API accesses, project settings and member relationships; card numbers go straight to the payment processor and never reach Knit's servers. No employee reads your content except with your express permission, for example when an error occurs while you are testing a prompt, or where the law requires it. Note that no terms of service are published, so no intellectual property clause can be checked.

Reuse rights

The privacy policy sets out eight rights that the publisher says it applies to every customer whatever their location: the right to know, to access, to correct, to erase, to complain, to object, to portability and to non-discrimination. Several of them can be exercised without asking anyone: you log in and edit your account information yourself. Portability is the weak spot. At the date of the policy there is no self-service export feature; the publisher says it will export your data manually if you contact it, and will build an export feature later. Before answering a request it may ask you to verify your identity, at minimum your name and email address. Some information stays exempt because the publisher needs it to run the service, and exercising certain rights may leave you unable to use Knit at all.

Data retention & training

Hosting summary

Knit makes one explicit statement about jurisdiction, in its privacy policy: the service is operated in Hong Kong and the server is located in the United States. The consequence is spelled out for users in the European Union, the United Kingdom or anywhere else outside the US: the information you provide is transferred to and stored in the United States, and using the service counts as consent to that transfer. Nothing more is claimed. No certification is asserted, neither SOC 2 nor ISO 27001 nor HIPAA, no data centre is named and no sub-processor is listed, including the payment processor that receives card details directly. The declared technical measures are SSL/TLS in transit, encrypted database backups, and RSA-OAEP and AES-256-GCM encryption on sensitive data. Separately, technical observation shows the site resolving to 66.241.125.92, an anycast address belonging to AS40509 Fly.io, Inc. and geolocated in the United States. That is an indication about the web front end, not a hosting commitment made by the publisher, and it should not be read as one.