How KnowsYou handles your information.

1. Who is responsible, scope and intended users

KnowsYou is operated by Terra Cycle S.R.L., a company registered in Romania (trade register no. J2017000856137, fiscal code RO37298322), with its registered office at Aleea Ghiocelului 7, Eforie Nord, Eforie, Constanța, România. Terra Cycle S.R.L. is the controller of the personal data described in this notice; the contact for anything in it is privacy@knowsyou.ai.

KnowsYou is a conversational general-wellness application. This notice covers the authenticated application, its web and mobile clients and the public website. It does not replace the privacy notices of connected services such as WHOOP or Google.

The current service is intended for adults aged 18 or older. We do not knowingly design the preview for children.

2. Information the service processes

Depending on how you use KnowsYou, this can include:

• Account and profile data: name, email address, timezone, preferred conversation language and profile details you choose to provide.
• Conversation and wellness data: messages, meals, activities, habits, goals, treatment routines, body measurements, check-ins, notes and remembered preferences.
• Files and media: images, PDFs and voice recordings or transcriptions you submit.
• Connected data: information you authorize from WHOOP, which can include profile and body measurements, cycles, recovery, sleep, strain and workouts.
• Technical and operational data: sessions, device and notification tokens, usage records, errors, security events and audit records of agent actions. This includes a first-party record of when you open the app — a timestamp and which client, nothing about what you did — kept so we can tell whether the preview is genuinely used. No third-party analytics SDK is involved.

You decide what to submit, but wellness information and health documents can be sensitive. Do not upload information you do not want the service and its necessary providers to process.

3. Why information is used

Information is processed to:

• create and maintain your account and profile;
• respond in conversation and create the records you request;
• preserve conversation context and selected active memories;
• calculate and display progress and approximate wellness estimates;
• sync connected services you authorize;
• send reminders or notifications you enable;
• troubleshoot, prevent abuse and audit whether agent actions matched the request; and
• improve reliability and safety.

Where EU data-protection law applies, the legal bases are: performance of the service you signed up for, for account and product records; your explicit consent, given when you create the account, for the health information you choose to submit and for the provider transfers described in section 4; and our legitimate interest in keeping the service secure, preventing abuse and fixing failures, for technical and audit data. You can withdraw consent at any time by deleting your account (section 7); the service cannot run without it.

KnowsYou does not currently sell personal information or use wellness data for targeted advertising.

4. AI and other service providers

KnowsYou relies on providers to operate particular parts of the service. Relevant data is sent only when needed for that function. Current providers can include:

DeepSeek, OpenRouter, OpenAI, Anthropic, Google, Alibaba's Qwen models and Groq are the current AI providers, used for generating replies, transcribing voice, and reading images and documents you attach. Alongside them:

• DigitalOcean for private object storage and service infrastructure;
• Google also provides sign-in, if you choose it, and the basemap on Android activity-route screens. The Maps SDK processes technical request and device metadata, crash metrics, IP address and a Maps-specific pseudonymous identifier to provide and improve maps;
• Expo and platform push services for enabled mobile notifications;
• Sentry for crash and error reports — scrubbed before sending, so they carry technical detail and an opaque account identifier, never your content;
• Discord hosts our internal operations channel. It receives your name and email when you register, and — when you ask the assistant for something it cannot yet do — what you asked for, so the missing feature reaches the people who build it. That request is sent without your name, account or conversation attached; and
• WHOOP when you choose to connect your WHOOP account.

Which provider handles which task changes as models change, and several are configured as alternates that take over when another is unavailable or is not the right tool for a task. So what this page keeps current is the set of providers your information can reach — not a mapping of task to vendor, or the individual model names, both of which move too often to be useful here.

Where the conversation goes, stated plainly: replies are generated by DeepSeek, a provider based in China. To answer you it receives your message together with the health context that message needs — which can include your stored notes about yourself, recent conversation, active treatments and conditions, out-of-range lab markers, goals and habits. China has no European adequacy decision, so the protection given to that data there may be weaker than under EU law. The legal mechanism for this transfer is your explicit consent, given on the register form when you create the account — the form says this in the same words before you agree. You can withdraw it at any time by deleting your account. If you are not comfortable with the transfer, do not use KnowsYou during this beta — the assistant is the product, and there is currently no version of it that runs elsewhere.

These providers operate under their own terms and privacy obligations, and not all of them keep data in the same country as you. See Data & security for the current technical data flow.

5. Storage and security

Core account, conversation and structured wellness records are stored in the product database. Uploaded files are currently stored in a private DigitalOcean Spaces bucket in Frankfurt, Germany. The application uses authenticated, short-lived links when a client needs to retrieve a private file.

Deployed web connections use HTTPS. WHOOP access and refresh tokens are encrypted before they are stored, are not returned to the client and are not added to agent context. Security controls reduce risk, but no online service can guarantee absolute security.

6. Retention, memory and deletion

The preview retains account and product records while they are needed to provide the service, preserve its audit trail, investigate problems and meet applicable obligations. A final, category-by-category retention schedule has not yet been adopted for commercial use.

Raw conversation history and curated memories are separate. Asking the agent to forget a saved memory removes it from future active context by soft-deleting it; the audit record is still retained. It is not an immediate hard erasure of the underlying record or the messages from which it came.

Disconnecting WHOOP stops future imports and removes the local connection credentials. Previously imported records remain until they are deleted through a supported control or an account-data request.

7. Your choices and privacy requests

You can correct records by talking to the agent, manage notifications in the application, disconnect WHOOP from Settings — and delete your account and everything in it yourself, under Settings → Profile → Delete account, on the web and in the app (how deletion works). Depending on where you live, you may also have rights to access, correct, export, restrict, object to processing of, or delete personal information, and to withdraw consent where consent applies.

Send a request to privacy@knowsyou.ai. We may need to verify your identity before disclosing or changing account data. Applicable legal rights are not limited by the wording of this preview notice.

8. Public website data

The current marketing site does not include advertising or marketing-analytics code. Normal hosting and network systems can still process technical request data, such as an IP address, timestamp, requested page and browser information, to deliver and protect the site.

Sign-in and authenticated application sessions use the technical storage needed to keep you signed in and protect the account.

9. Changes and contact

This notice can change as the product, providers and launch markets change. Material revisions will be accompanied by a new effective date.

For privacy questions or requests, email privacy@knowsyou.ai. For a plain-language view of current processing and controls, read Data & security.