Privacy Notice

Last updated 16 September 2026 · Knurlsoft LLC (Wyoming)

Interim version — under legal review. This notice describes our actual practice accurately and you may rely on it as a statement of what we do. It is being reviewed by counsel and the reviewed version will replace it here; we will update the date above when that happens.

Knurlsoft LLC, a Wyoming limited liability company, publishes this notice to explain what we collect, what we do not, and why the answer is shorter than you expect.

The short version

This website sets no cookies, runs no analytics, and loads nothing from a third party. Our software products send us nothing at all. The only personal data we hold is what you deliberately send us — an email, or the details attached to a purchase.

This website

No cookies. We set none, for any purpose, including analytics.
No analytics or tracking. There is no analytics service, no tag manager, no pixel, and no fingerprinting.
No third-party requests. Every font, script, style, and image is served from our own domain. Loading this page contacts nobody but us.
Server logs. Our web server records ordinary request logs, which include IP addresses, for security and troubleshooting. They are retained for a short period and are not used to build any profile of you.

Our software

FlareID and our other Ignition modules run inside your own gateway, on your own infrastructure. They are built so that:

They contain no telemetry, usage analytics, or automatic error reporting.
They transmit nothing to Knurlsoft, at any time, including after a licence is activated. Licence keys are not re-validated over the network.
Authentication tokens are held in memory only and are never written to disk, configuration, logs, or connection strings.
Certificates and client secrets you configure are stored in your own gateway's encrypted configuration. We never receive them and cannot read them.

The only network connections our software makes are to the endpoints you configure — your Microsoft Entra ID tenant and your own database servers.

When you contact us or buy something

If you email us, we hold your message and address so we can help you and keep a record of the conversation. If you buy a licence, we keep an order record — your name or company, contact email, the licence keys issued to you, and your entitlement dates — because we need it to re-issue a lost key, to honour support, and to meet tax and accounting obligations. How long each of those lives is set out below.

We do not process your payment ourselves. Purchases are handled by our merchant of record, who is the seller for the transaction and who collects and holds payment details under their own privacy policy. We never see your card details.

We do not sell, rent, or share personal data for marketing, and we do not send marketing email to people who have not asked for it.

How long we keep it

Stated plainly, because "as long as necessary" is not an answer:

Web server logs — 30 days. Then deleted.
Order and licence records — for as long as the licence lives, plus seven years. This one is deliberately long and it is worth explaining: our licences are perpetual, so a customer may lose a key and come back in year nine, and we would rather be able to re-issue it than tell them their record was tidied away. The seven-year tail covers tax and accounting obligations after a licence is retired. The record is company name, contact email, licence keys, entitlement dates, and order references.
Support correspondence — three years from the last message in the thread.
General enquiries that do not become orders — two years, or sooner if you ask.
Sanctions and restricted-party screening records — five years, which is the retention period US export regulations require of us.

We do not hold payment details at all, so there is nothing to retain: our payment processor is the seller of record for the transaction and holds that data under its own policy.

Your rights

Depending on where you live, you may have the right to ask what we hold about you, to have it corrected, to have it deleted, or to receive a copy. Ask us and we will do it — there is no form and no process to navigate. Because we hold so little, these requests are usually answered the same week.

Where data lives

Knurlsoft is based in the United States, and the records described above are held there. If you contact us from outside the US, your message is transferred to the US by the act of sending it.

Changes

If this notice changes materially, we will update the date at the top of this page. We do not make quiet changes.

Contact

Questions about this notice, or any request about your data: privacy@knurl.io.
Security vulnerability reports: security@knurl.io (see also security.txt).