Privacy & Cookie Policy

KnowLocal by GroLocal ("KnowLocal", "we", "us") is operated by Infonaut Ltd, the data controller. This policy explains what personal data we collect at knowlocal.io, why, the legal basis, how long we keep it, and your rights under UK GDPR. We collect as little as possible.

1. Who we are

Infonaut Ltd (registered in England & Wales), trading as KnowLocal by GroLocal. Registered office: 14/2E Docklands Business Centre, London E14 8PX, United Kingdom. We are registered with the UK Information Commissioner's Office (ICO), registration number ZC169421. Contact our data team at privacy@knowlocal.io.

2. What we collect

• Your email address — to send your one-time verification code and your audit report.
• The business you ask us to audit — the Google Maps link or business name you submit, and the public Google Business Profile data we retrieve about it.
• Your audit results — stored so you can revisit your report at its link.
• Marketing preference — whether you opted in to hear from us.
• Attribution & technical data — referral/UTM source, and IP address used only for security and rate-limiting.
• If you buy KnowLocal credits — your account email, credit balance and purchase history, a phone number if you choose to give one, and payment-confirmation metadata from Stripe (the amount, currency and Stripe reference ids) so we can credit your wallet and reconcile payments. We never receive or store your card number.

We do not collect passwords or card/bank details (our payment processor, Stripe, handles those), we do not access your Google account, and we do not process special-category data.

3. Why we use it, and our legal basis

Purpose	Legal basis (UK GDPR)
Run and deliver the audit you requested; email your report	Performance of a contract / your request
Verify your email; protect the service (security, rate-limiting)	Legitimate interests
Send you marketing about your reputation and our products (KnowLocal credits, guided tasks, and GroLocal when it launches)	Consent (you opt in; withdraw anytime)
Produce anonymised, aggregated industry benchmarks	Legitimate interests (data is anonymised)
Analytics cookies	Consent (via the cookie banner)

4. How long we keep it (retention)

• One-time codes: 10 minutes, then they expire.
• Audit reports: 180 days, then deleted (request earlier deletion anytime).
• Leads (if you opted in): up to 24 months from your last interaction, then deleted, unless you unsubscribe sooner.
• Credit wallet & purchase records: for as long as your account is active, plus up to 12 months after your last purchase (kept as evidence for payment disputes), then deleted.
• Legacy KnowLocal Plus membership records (historical cohorts only): for the original term plus up to 12 months after, then deleted.
• Anonymised benchmark data: retained indefinitely (it no longer identifies you).
• Security/rate-limit logs: short-term only.

5. Who we share it with (processors)

We never sell your data. We use a small number of trusted processors to run the service:

• Cloudflare, Inc. — hosting, database, file storage, email delivery and (where enabled) AI.
• Stripe — payment processing for credit packs. We never see or store your card details; Stripe shares your email (and phone, if you provide it) so we can credit your wallet.
• DataForSEO — retrieving public Google business-profile data.
• DeepSeek (via Cloudflare AI Gateway) — wording your report. The AI only rephrases facts our engine computes; it never sets your score.
• Google Analytics (only if you accept analytics cookies).

Some processors operate outside the UK. Where they do, transfers are protected by appropriate safeguards (UK International Data Transfer Agreement / Standard Contractual Clauses).

6. Your rights

Under UK GDPR you can ask us to: access a copy of your data; correct it; delete it; restrict or object to processing; port it; and withdraw consent at any time. Email privacy@knowlocal.io and we'll respond within one month. Every marketing email also has a one-click unsubscribe. You can complain to the ICO at ico.org.uk.

7. Cookies

We use the minimum cookies needed. Analytics and marketing cookies fire only after you accept them in our consent banner, which is managed by Cloudflare Zaraz with Google Consent Mode v2 set to default-denied — so nothing non-essential loads until you opt in.

• Strictly necessary — a small cookie that remembers your cookie choice, and (for site operators only) an admin sign-in cookie. No consent required.
• Analytics (optional) — Google Analytics (GA4), loaded via Cloudflare Zaraz, to understand traffic. Set only if you click Accept; you can Reject just as easily.
• Marketing (optional) — advertising pixels may be added in future; they too will fire only with your consent.

You can change or withdraw your choices at any time via the Cookie preferences link in the footer of every page, or by clearing cookies for knowlocal.io.

8. Changes

We'll update this page if our practices change; the "last updated" date above reflects the latest version.

9. Contact

Infonaut Ltd, operating KnowLocal by GroLocal. Privacy questions and requests: privacy@knowlocal.io.