Privacy Policy

Knack is operated by Knack Limited (New Zealand company number 9444632, NZBN 9429053814234), based in Auckland, New Zealand. In this policy, “Knack”, “we”, and “us” mean Knack Limited, and “personal information” has the meaning given in the Privacy Act 2020. Our Privacy Officer can be reached at joe@knackapp.co.nz.

This policy covers two groups: contractors — the tradespeople and businesses who hold a Knack account — and the customers of those contractors, the people a contractor quotes for.

If you are a contractor's customer, most information about you is entered into Knack by your contractor, not by you. Your contractor is usually the best first point of contact about your information, but you can also contact us directly (see “Your rights”).

If you are a contractor: your name and email, your business details (business name, trading name, contact details, GST/NZBN, and trade licence where you provide it), the content you create (customers, quotes, notes, photos, and voice recordings), and — if you enable notifications — an encrypted push subscription for your browser, or a device push token if you enable notifications in our iPhone or Android app. If you subscribe, our payment provider collects your billing details; we store only a billing identifier and your plan status, and never see or store your card number.

If you are a member of a contractor's team and you choose to connect another calendar of your own — your personal Google or Outlook calendar, say — Knack fetches it from time to time and keeps only when you are busy: the start and end of each block, and nothing else. Titles, locations, and who else is involved are never read into Knack, so what an appointment is stays in your own calendar. Everyone on the team sees the same thing you do — a block marked busy — and disconnecting removes the stored times.

If you email a supplier invoice to your account's private capture address, we store that email and its attachments as part of the job record, including the sender's name and email address.

If you set up a private lead address and forward your work enquiries to it, we store each forwarded email: the sender's name and email address, the subject, the message text, and any photos or PDF documents attached to it (up to five, each up to 8 MB; other kinds of attachment are recorded by name only, and location data is removed from photos when they arrive). We also pick out contact details found in the message, such as a phone number or a site address, so you don't have to retype them. A contractor can also link a Knack-hosted enquiry form from their website; what you type into it — your name, email, phone, job address and message — is held as an enquiry for that contractor in exactly the same way. A contractor can also save a message they received somewhere else — a text, a WhatsApp message, or a note from another app — as an enquiry. What they save, and any name, phone or email they add, is held as an enquiry for that contractor in the same way, including the 60-day rule. Because these are enquiries about work, they may contain personal information about someone who is not yet a customer; that information is held for the contractor the enquiry was sent to, under this policy.

If you are a contractor's customer, we collect directly from you — when you accept, decline, or request a change to a quote — your name and email, a record that you agreed to the quote's terms, and the date and time. If the link you open has been replaced by a newer version or has expired, you can ask that contractor for an up-to-date quote; we record that you asked, along with any note you write with it, and pass both to them. When you open a quote link we record that it was opened and the kind of browser you used, so the contractor can see you received it; we do not store your IP address for ordinary page views. As evidence of your acceptance, we also record your IP address and browser type at the moment you accept or decline.

As a job goes on, a contractor can send you further private links of the same kind: one to approve or decline an extra that came up on site, and one to sign off that the work is finished. If you answer through one, we record the name you type, your decision, the wording you agreed to, any note you add, and the date and time, together with a copy of what you were shown when you decided. A contractor can also record a sign-off on your behalf — for example if you told them in person — and the record says which of the two happened, so the two are never confused. Once a job is signed off, a contractor who has turned this on can have Knack send you one email asking you to leave them a public review, with a button to their own review page (for example on Google); it is sent once per job, never if you said something wasn't right, never to an address that has bounced or asked that contractor to stop emailing, and Knack does not learn whether you clicked it or what you wrote.

As a job goes on, a contractor can send you further private links of the same kind: one to approve or decline an extra that came up on site, and one to sign off that the work is finished. If you answer through one, we record the name you type, your decision, the wording you agreed to, any note you add, and the date and time, together with a copy of what you were shown when you decided. A contractor can also record a sign-off on your behalf — for example if you told them in person — and the record says which of the two happened, so the two are never confused. In the same way, a contractor may ask you to sign a record they filled in about the job — a handover sheet, say — either through a private link or on their own device in front of you; we store the name you type, your drawn signature and the time, and the record says which way it was signed.

A contractor can also share a plan drawing for review by sending someone a private link — for example a builder they're working with. If you give feedback through such a link, we collect the name, email address, and notes you enter — including in-progress feedback saved automatically as a draft, so you can leave and come back to it — and hold them for that contractor as part of the job record, handled the same way as a change request on a quote. A draft is deleted when you send the feedback or the contractor closes the link. The same automatic draft saving applies when a contractor's customer marks up a quote's plan.

Before visiting, or while answering your enquiry, a contractor can also send you a private link asking for photos of your job — for example your switchboard, or the spot where you'd like something installed. Photos and any note you send through such a link go to that contractor and are stored with your enquiry or job, handled like any other job photo (photos sent on an enquiry follow the enquiry's 60-day rule unless a job is started from it). Location data embedded in a photo is removed automatically when it is uploaded. The link stops working when the contractor closes it or after two weeks, and if you send something by mistake you can ask the contractor to remove it.

A contractor who has texting turned on can also text you from Knack about your job — 'running late', 'are you home?' — to the mobile number they hold for you, and anything you text back is stored with that job so the whole crew can read it. Reply STOP and Knack will not text you again unless you text them first. Texts are sent and received through our SMS provider, named on our Subprocessors page.

A contractor can also give you a private link to a page about your own job. It shows you where the job is up to, the visits booked in, the updates and photos your contractor has posted for you, anything waiting on your approval, and the compliance documents filed for the job; it carries no pricing, and no one's information but your own job's. A separate link can be used to share just the compliance documents for the products installed. These links show you information — they do not collect anything from you — and they stop working if the contractor revokes them. Treat a link like a key: anyone you forward it to can open the same page.

We also collect information about a customer indirectly, from the contractor: your name, email, phone, and physical or postal address; the work site address; notes, voice recordings, and photographs the contractor records about the job, which may mention or depict you or your property; and any other personal information the contractor chooses to enter about a customer or a job. We collect this from the contractor so we can provide the quoting service to them.

To provide the quoting and job-management service; to generate draft quotes, transcripts, and summaries using the AI features described below; to take payment for subscriptions; to keep the service secure and record acceptance of quotes; and to respond to your requests.

We also send email on a contractor's behalf, in their business name: the quote itself and its receipt; confirmation that a visit is booked, and notice if that visit is moved or cancelled; updates the contractor writes about the job, with any photos they attach; requests for you to approve an extra or to sign off completed work; the contractor's own reply to an enquiry you sent them; requests for photos of the job; and, for electrical work, the compliance certificate and any handover pack. If the contractor sends a purchase order from Knack, we email that order to the supplier they nominate, in their business name. Where a contractor has texting turned on, we also send the text messages they type to you about the job, in their business's name, and store your replies with the job.

Forwarded work enquiries are sorted automatically by rules that run within Knack, so likely work enquiries surface above newsletters and notifications — every email stays visible to the contractor; nothing is hidden or deleted by the sorting. Knack emails the sender of an enquiry only when the contractor writes a reply inside Knack and chooses to send it; that reply — with any photos or documents the contractor attaches — goes out through our email provider under the contractor's name, and a copy is kept with the enquiry as part of the job record. Nothing is sent to an enquirer automatically, and an enquiry becomes a customer and job record only when the contractor confirms it. A contractor can also teach the sorting to always show, or always set aside, mail from a specific sender; that stores the sender's email address as a rule until the contractor removes it.

Most of those emails go out because the contractor did something — sent the quote, booked the visit, posted the update. Two are sent by the clock instead, and only where the contractor has turned them on: a single follow-up about a quote that has had no response, and a single reminder ahead of a booked visit. Both are about the contractor's own quote or booking — they are not marketing from us. Every automated follow-up includes a working unsubscribe link; if you unsubscribe, we stop sending you that contractor's automated follow-ups.

Where a contractor issues a compliance certificate for electrical work, Knack builds the certificate from the job record, emails a copy to the customer, and keeps a copy on file. A certificate carries the site address, the customer's name, and the certifying person's name and registration details, because the law requires them to appear on it. Knack produces and stores the document; the certification itself is the contractor's, not ours.

We do not sell personal information, and we do not use it for advertising.

Knack uses third-party AI services to make quoting faster: voice notes are sent to a speech-to-text service to produce a transcript; transcripts and job details are sent to an AI service to draft quote lines and summaries; supplier invoices you forward to us are sent to be read; and work enquiries you forward to your private lead address are read — to sort uncertain mail into the right section of your enquiry queue and, when you start a job from one, to draft the job form. When the automatic sorting cannot decide whether a forwarded email is a work enquiry, a short excerpt of the subject and message is sent to the AI service to place it in the right section of the queue — every email still stays visible to the contractor. Separately, when a contractor chooses to start a job from a forwarded work enquiry, the enquiry's subject and message text are sent to an AI service to pick out the sender's name, phone number, email address and site address as a draft for the contractor to check — that extraction happens only on that action, never on receipt. To help the speech-to-text service recognise names and product terms correctly, a transcription request may also include a short list of terms from the contractor's own account — brand and product names and, for job-capture recordings, customer names — sent only as recognition context.

These providers process the content outside New Zealand (see “Where your information is stored”). The content may include personal information a contractor has entered about a customer — for example, a name or address spoken aloud in a voice note. Our AI providers process the content to return a result and do not use it to train their models; depending on the provider, content may be retained briefly — generally up to about 30 days — for security and abuse monitoring before deletion, and we enable zero- or short-retention controls where a provider offers them.

AI output is always a draft for the contractor to review — we do not treat it as final or authoritative. We delete the original captured voice recording within 30 days of it being transcribed; the transcript is kept as part of the contractor's job record. Voice messages a contractor attaches to a quote for their customer are not transcribed and stay with the quote as part of the job record.

We share personal information only with the service providers we rely on to run Knack — for hosting, file storage, email, text messages, payments, authentication, AI processing, address lookup, roof and site mapping, and error monitoring. Each may use the information only to provide its service to us, under our instructions, and we put data-processing terms in place with these providers as we bring them on. The current list is on our Subprocessors page.

Separately, a contractor can choose to connect their own business software — currently the Xero accounting system or the Fergus job management system — to Knack. If they do, we send information to it at that contractor's direction: typically the customer's name and email address and the line details of an accepted quote, so the contractor can raise their invoice or run the job there. Fergus is one-way: Knack does not read information back from it. From Xero, Knack also reads back the status of the invoices it drafted there — whether each is awaiting payment, part paid or paid, how much is still due and when it is due — so the contractor can see it on the job. Knack does not read payment details, bank information or any other invoice, keeps only each invoice's current status, and deletes those statuses if the contractor disconnects Xero. Once received, information sent to either provider is governed by that provider's own terms and privacy policy. The contractor can disconnect the integration at any time.

An electrical contractor can also connect a CertPilot instance — certification software they run and control themselves — so a job can be handed to it for certifying. If they do, we send that instance the job's identity and site address, the customer's name, email and phone, a description of the work, and which installed products the job's compliance documents rely on. We send no pricing and no test results. The same fence applies: the transfer is one-way, it happens only at the contractor's direction, and they can disconnect at any time. Because the contractor hosts the instance themselves, the information goes to a system they are responsible for, not to a provider of ours.

A member of a contractor's team can also subscribe to their Knack schedule from their own calendar app — for example Google Calendar, Apple Calendar or Outlook — using a private feed link. This works the other way round from the integrations above: Knack does not send anything, the calendar app fetches the feed on its own schedule for as long as the subscription exists. What it fetches is that member's bookings — the job and customer name, the site address, the visit notes, and any non-job time such as leave — which their calendar provider then stores and syncs to that member's devices under its own terms and privacy policy. The feed link can be revoked at any time from the schedule, which stops future fetches; anything a provider has already stored is subject to that provider's own retention.

A contractor can also connect their own AI assistant — for example Claude, ChatGPT, Grok or Cursor, on a subscription they hold themselves — to their Knack account, using a token they create in Settings, or by signing in to Knack from the AI app and allowing the connection. This works the same way round as the calendar feed: Knack does not send anything to the AI provider, and adds no provider of its own; the contractor's tool fetches from Knack, with that token, for as long as the token exists. What it can fetch is the working material for a quote — a job's name, customer name and site address, the job's site notes, drawings and site photos (photos with their location data removed), the contractor's own catalogue, prices and standard terms, the quotes the contractor has already sent (their wording, their lines and prices, and whether each was accepted — never the customer's contact details on that read), the contractor's point recipes, plan-symbol links, playbooks and quote templates, and the draft quote as it stands — and what it can write back is a draft quote for the contractor to review, together with customer records, jobs, new price-book items and changes to the contractor's own pricing (price-book prices, default markup and labour rates, point recipes and their confirmation, plan-symbol links, other names for price-book items, playbooks, and quote templates, including a template saved from one of their quotes without its customer details) when the contractor asks it to set up or correct work in Knack — it can add and amend customers and jobs, and add or change price-book items and the contractor's pricing when asked, but it can never delete anything, and it can never send a quote to a customer; the contractor does that themselves. Where the tool then sends what it read is governed by that AI provider's own terms and privacy policy, exactly as when the contractor types the same details into it by hand. The token or connection can be revoked at any time from Settings, which stops future fetches; anything a provider has already stored is subject to that provider's own retention.

The calendar import described in section 1 runs the same way round: Knack fetches from the address the team member supplied, and sends that provider nothing but the request. We keep only busy times from what comes back.

A contractor can also choose to connect their own Google Drive so that copies of the electrical compliance certificates they issue (which include the site address, the customer's name, and the certifying electrician's details) are saved into a folder in their own Drive. This uses the narrowest Google permission available — Knack can only see and update files it created, never anything else in the Drive — the transfer is one-way, and the contractor can disconnect at any time. Files already saved to their Drive remain theirs.

We may also disclose personal information if required by law, or to protect our rights, our users, or the public.

Our primary database and application hosting are in Australia (Sydney). Our file storage — voice recordings, photos, plan documents, and PDFs — uses Cloudflare R2, which stores data across Cloudflare's global network. Some of our other providers — in particular our email, SMS, payment, authentication, AI, and error-monitoring providers — are based in the United States, and our address-lookup provider is based in Europe. When we use them, personal information is disclosed to those providers overseas.

We take reasonable steps to ensure overseas providers protect personal information with safeguards comparable to the New Zealand Privacy Act, including through data-processing agreements. By using Knack, or by accepting a quote sent through Knack, you acknowledge that your information may be processed by these overseas providers for the purposes described here.

Data is hosted with reputable providers and is access-controlled by account, so one contractor cannot see another's data. Sensitive delivery material and quote links are encrypted or hashed at rest, and access to production systems is limited to authorised personnel. No system is perfectly secure, but we take reasonable steps to protect your information.

Authorised Knack staff can access an account's information to provide support and to investigate problems — for example, to see why an email did not send or why a feature is unavailable. That access is limited to a small, named group of Knack staff; by default it covers account state such as settings, statuses, delivery records and error messages rather than the content of quotes, notes, photos or messages; and every such access is logged, with the log kept permanently. Knack staff never sign in as you or act in your name.

Knack uses only the cookies needed to run the service: our authentication provider sets cookies to keep contractors signed in and to protect accounts against forged requests, and we use similar browser storage on your device to remember interface preferences. We do not use advertising cookies, and we do not run third-party analytics or tracking cookies anywhere on Knack — including on the public pages customers open from a link.

So that a contractor can keep working in a basement, a new build, or anywhere out of coverage, Knack also keeps a copy of the account information it has recently shown them — jobs, quotes, customer details, and photos — in their own browser's storage on that device, and holds any change they make while offline there until it can be sent. This copy stays on the contractor's device; it is not a disclosure to anyone else. Signing out clears the stored copy of the account's information from that device. A change queued while offline is deliberately kept, because it belongs to the person who made it and is sent only when they sign back in — so a shared or lost device should be signed out of, and, if a queued change matters, signed back into once to let it go through.

Original voice recordings are deleted 30 days after transcription; the transcript is kept as part of the job record.

Forwarded work enquiries are deleted 60 days after Knack receives them (measured from when the forward reaches Knack, not from the email's own date), whether or not anything was done with them. If the contractor starts a job from an enquiry, the details they confirm — name, contact details, address, and what was asked for — are carried into their customer and job records and kept as part of those records, along with any photos or documents from that enquiry conversation — including ones sent in a later reply, which are filed onto the job as they arrive and kept with it; the original enquiry email — and its attachments, if no job was started — is still deleted at 60 days. Taught sender rules are kept until the contractor removes them.

Contractor account data — customers, quotes, notes, photos, transcripts, and PDFs — is kept for the life of the contractor's account. Quote-acceptance records, including the acceptance IP and browser, are kept as a commercial record of the accepted quote.

Compliance certificates, and the job records they were issued from, are kept for at least seven years — the period the law requires of the person who issued the certificate. This is one of the legal-obligation records referred to below, so it is kept even after the contractor's account is closed.

After an account is closed, we delete its data within 90 days, unless we must keep specific records to meet a legal obligation. We can also delete your information earlier on request.

Under the Privacy Act 2020 you have the right to ask for access to the personal information we hold about you and to request correction of anything that is wrong. We will usually respond within 20 working days. You may also ask us to delete your information; we will action verified deletion requests unless we reasonably need to retain particular records for legal, security, or commercial-record reasons.

Signed-in Knack users can request account deletion under Settings → Account & data, or at knackapp.co.nz/delete-account. You can also contact joe@knackapp.co.nz. We verify requests, action them manually within 30 days, and confirm when the work is done. If you are a contractor's customer, you can also ask the contractor directly, as they entered and control most of your information.

If you are not satisfied with how we have handled your personal information, contact us at joe@knackapp.co.nz. You also have the right to complain to the Office of the Privacy Commissioner (www.privacy.org.nz).

We may update this policy from time to time. We will change the “last updated” date above and, for material changes, take reasonable steps to notify account holders.