This notice applies to the knot.tools marketing website, the commercial portal license.knot.tools, and the commercial Knot Migration module installed on the Customer’s Dolibarr instance. Further regulatory disclosures for the portal: license.knot.tools/legal · Publisher identity on knot.tools: legal notice.
In short
Knot Tools™ uses no advertising cookies and no advertising pixels on its marketing website, and no external web fonts. Cookieless audience measurement is provided by Cloudflare Web Analytics (see section 2).
If you use the commercial products Knot Pro Pack or Knot Migration, additional processing occurs to manage your licence, process payments, and—if you opt in—supply strictly bounded technical telemetry. All such processing is described in sections 2 to 8 below.
No business data from your Dolibarr instance leaves your server. Snapshots and reports produced by Knot Migration are anonymised at collection and remain stored with you.
1. Data controller
The controller is Mr Sébastien Lucien AUDEL, sole trader trading as EXIATIS, registered office at Quartier Monnerot, 97231 Le Robert, Martinique, France (SIREN 798 027 397, establishment SIRET 798 027 397 00024).
No data protection officer (DPO) has been appointed, as French and EU law do not require it in this situation (GDPR Article 37). Questions about this policy may be emailed to contact at knot dot tools or sent by post to the registered-office address.
2. Processing related to the knot.tools marketing website
The marketing site is static. It uses no advertising cookies, no advertising pixels, and no external fonts. Cookieless audience measurement is provided by Cloudflare Web Analytics (see below). Other site-related processing (demo, documentation, downloads, beta form, email) is described in the following subsections.
If you email us at contact at knot dot tools: your email address and message contents are delivered to mailbox hosting provided by IONOS SE (Germany, EU/EEA). They are processed on the basis of responding to your request (legitimate interest, GDPR Article 6(1)(f)) and retained for no more than three years from your last correspondence. You may request erasure at any time by replying to our email thread.
Audience measurement — Cloudflare Web Analytics
The Cloudflare dashboard injects a Cloudflare Web Analytics beacon (Cloudflare Inc., United States) on knot.tools. This service is cookieless: no cookie is set for this measurement. Cloudflare may process the IP address (and technical request metadata) to produce aggregated audience statistics.
Purpose: audience measurement for the marketing site. Legal basis: legitimate interest (GDPR Art. 6(1)(f)). Transfer: processing by Cloudflare Inc. under the European Commission’s Standard Contractual Clauses (Decision 2021/914) and the Cloudflare DPA, already cited for Cloudflare in this policy. No consent banner is required for this measurement, because no advertising cookies are set.
2.1 Self-service Knot Core demo accounts (/try/)
The /en/try/ page lets you generate temporary access to the shared demo.knot.tools environment without opening a commercial account and without collecting your email address on knot.tools.
Data processed by Knot Tools™ (controller)
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
SHA-256 hash of IP address (with secret salt, never disclosed), creation timestamp, pseudonymous identifier (demo-XXXX) |
Abuse prevention on the shared demo (per-connection quotas) | Legitimate interest (GDPR Art. 6(1)(f)) | Account lifetime (24 hours) plus seven days for quota consistency, then automatic deletion |
These fields are pseudonymous: visitors cannot re-identify their own IP hash. Objection requests may be sent to contact at knot dot tools; practical effect remains limited while knot.tools collects no direct identity on /try/.
knot.tools sets no cookies on /try/ (optional theme preference may use browser local storage only, not advertising trackers).
Anti-bot verification — Cloudflare Turnstile (processor)
Before an account is issued, a Cloudflare Turnstile widget checks that the request is not automated. Cloudflare may process:
- the visitor’s IP address;
- the User-Agent string;
- technical anti-bot signals (no advertising profiling on knot.tools).
Purpose: automated-attack prevention. Legal basis: legitimate interest (Art. 6(1)(f)). Transfer: processing by Cloudflare Inc. (United States) under the European Commission’s Standard Contractual Clauses (Decision 2021/914) and the Cloudflare DPA. Cloudflare states that Turnstile does not use advertising tracking cookies: Turnstile announcement. If that practice changes, this policy will be updated and explicit consent sought where required.
2.2 Documentation centre docs.knot.tools
The docs.knot.tools subdomain hosts static end-user documentation for Knot Tools™ (guides, FAQ, troubleshooting).
- No cookies are set by docs.knot.tools: no session, no analytics, no advertising trackers.
- Browser local storage (
localStorage): Starlight may store only your light/dark display preference (starlight-theme). This stays on your device and is never sent to our servers; it is not a cookie under GDPR/ePrivacy rules. - Pagefind search: the search index is downloaded and queried entirely in your browser. Search queries are not sent to a third-party service and are not logged by Knot Tools™.
- No third-party CDN at launch: fonts, scripts, and assets are served from docs.knot.tools (Plesk hosting, EU).
No personal data is collected when you simply browse the documentation, except standard hosting logs (IP address, timestamp, requested URL) for security and availability.
2.3 Knot Core download (/downloads/knot-core/)
Links such as /downloads/knot-core/latest (or a pinned semver X.Y.Z) serve the Knot Core module ZIP (GPL). No account is required.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
IP address, User-Agent, Referer, Accept-Language, timestamp, requested/served version, ZIP SHA-256 fingerprint |
Download statistics, publisher notification, abuse prevention (per-IP quota) | Legitimate interest (GDPR Art. 6(1)(f)) | 12 months rolling, then automatic purge |
| Approximate geo (country, region, city, ASN) via ipinfo.io or, as fallback, a self-hosted MaxMind database | Understand geographic distribution of downloads | Legitimate interest (Art. 6(1)(f)) | Same retention as above |
ipinfo.io (Cloudflare Inc., United States) may process the IP during geo lookup, under Standard Contractual Clauses (Decision 2021/914) and the Cloudflare DPA. knot.tools sets no cookies during download.
Abuse quota: 10 non-bot downloads per IP address per hour. Obvious automated clients (curl, crawlers) are flagged as bots: the ZIP may still be served, but they do not trigger instant notifications and do not consume the human quota.
2.4 Extension beta access request (/beta/)
The page /en/beta/ lets you request private beta access to commercial extensions Knot Pro Pack and Knot Migration. Knot Core is downloaded separately with no form.
Data is sent to license.knot.tools (Knot Tools™ backend) after anti-bot validation.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email, full name, company (optional), profile, requested products, Dolibarr version (if Migration), free-text message | Qualification and manual processing of the beta request | Legitimate interest (Art. 6(1)(f)) and pre-contractual steps (Art. 6(1)(b)) | 2 years from the request unless an ongoing commercial relationship exists |
| Salted SHA-256 hash of IP address (anti-abuse, never stored in clear text by Knot Tools™) | Automated submission prevention and quotas | Legitimate interest (Art. 6(1)(f)) | Life of the request + 90 days |
A Cloudflare Turnstile widget protects the form (same safeguards as section 2.1). No marketing cookies are set by knot.tools on /beta/.
3. Processing related to license.knot.tools (commercial portal)
The license.knot.tools portal supports purchase, renewal, activation, and downloads for the Knot Pro Pack and Knot Migration commercial extensions. Additional portal disclosures: license.knot.tools/legal · knot.tools publisher details: legal notice.
3.1 Order and billing data
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Professional email address, company name, contact identity | Contract performance (sales, support, invoicing) | GDPR Art. 6(1)(b) | For the contractual term plus 10 years (accounting obligations under French Commerce Code Article L.123-22) |
| Billing identifiers (EU VAT number where applicable; SIREN/SIRET) | Lawful invoicing | GDPR Art. 6(1)(c) (legal obligation) | 10 years |
| Payment data (last four card digits; card scheme; Stripe transaction identifiers) | Payment reconciliation and fraud mitigation | GDPR Articles 6(1)(b) and 6(1)(f) | 10 years for accounting records underlying the invoice; 13 months for detailed Stripe artefacts |
Full card details are never available to us. They are collected and processed by Stripe Payments Europe Ltd, our PCI DSS Level 1 payment processor (see section 7).
3.2 Licence and activation data
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
Unique licence identifier (activation_code) |
Activation and periodic validation | GDPR Art. 6(1)(b) | Licence term plus three years |
| Dolibarr-instance fingerprint (SHA-256 hash) | Technical identification of the instance (not inherently personal data) | GDPR Art. 6(1)(b) | Licence term plus three years |
| Activation, transfer, and deactivation timestamps | Licence audit trail and misuse prevention | GDPR Articles 6(1)(b) and 6(1)(f) | Licence term plus three years |
The instance fingerprint is a cryptographic digest computed locally from deployment parameters (URL, entity identifier, locally held salt). The publisher cannot reverse it back to the original URL.
3.3 Administrative session cookie
The portal uses one strictly necessary session cookie for Customer administrator authentication. Under French telecoms and privacy law (Article 82 of the Informatique et Libertés Act), that cookie falls outside prior consent obligations. It:
- does not contain profiling payloads;
- expires when the browser session ends or after 24 hours of inactivity;
- is neither linked with third-party cookies nor reused for analytics.
4. Processing related to the Knot Migration module installed on-premises
4.1 Anonymisation and minimisation built into the product
Knot Migration is designed to analyse the structure of your Dolibarr deployment only—table names, column names, PHP classes, installed modules—and never reads or transmits business payloads off your server.
Aggregates produced by scanners (such as approximate invoice counts) are bucketed into orders of magnitude (10; 100; 1 000; 10 000…) prior to further processing or any transmission, aligning with GDPR data minimisation (Article 5(1)(c)) and privacy by design (Article 25).
Analysis artefacts remain stored entirely inside your Dolibarr instance unless you voluntarily share an excerpt while requesting assistance.
4.2 Pseudonymisation of custom module names
Technical names of bespoke modules that might indirectly identify a customer undergo pseudonymisation (deterministic digest plus sequence number via ModuleNamePseudonymizer) prior to inclusion in exported PDF telemetry or Tier 2 opt-in telemetry.
4.3 First-PDF acknowledgement modal
The first time a Dolibarr user exports a migration report PDF, we show an explanatory modal. Acceptance is logged in llx_knot_migration_pdf_export_acks for traceability.
4.4 Six-month pseudonymisation audit
We conduct a semi-annual review of pseudonymisation rules to ensure snapshots or transmissions do not accidentally contain personal data. Records of each review are retained internally for five years.
5. Knot Migration product telemetry
Telemetry spans three independent tiers, engineered for privacy-by-design (GDPR Article 25).
Tier 1 — Strictly necessary to deliver the service (default on; no consent prompt)
This tier covers solely:
- Periodic licence validation—transmitting
activation_code, instance fingerprint, a timestamp, and a cryptographic integrity token; - Critical error breadcrumbs—machine-readable diagnostic codes (e.g.
E_LICENSE_EXPIRED,E_SCANNER_TIMEOUT) together with Knot Migration and PHP runtime versions—no stack traces, no free-form user text, no business data, and no nominative IP address.
The processing is indispensable to uphold contractual uptime and incident response obligations. Legal bases combine contract necessity (GDPR Article 6(1)(b)) with legitimate-interest security (Article 6(1)(f)). No supplementary consent banner is triggered. Maximum retention: 12 months.
Tier 2 — Product-improvement insights (opt-in; off by default)
If you enable Tier 2 in the Knot Migration administrator “Privacy & Telemetry” panel, transmissions may include:
- Dolibarr version, PHP version, Knot Core version;
- Third-party Dolibarr modules detected (technical name plus version only—pseudonymised when the slug could indirectly identify);
- Analysis duration benchmarks;
- Aggregated organisational scale (rounded record counts without identifiers).
No module configuration payloads, secrets, or business payloads are emitted. Legal basis: consent (GDPR Article 6(1)(a)). Maximum retention: 24 months. You may revoke consent at any time without degrading Tier 1 functionality.
Tier 3 — Collaborative catalogue (opt-in; off by default; independent from Tier 2)
Freetext compatibility notes (“works”, “minor issues”, “incompatible”) help build an opt-in communal module catalogue shared across Knot Migration customers. Legal basis: consent (GDPR Article 6(1)(a)). Maximum retention: 36 months. Revocable anytime.
GDPR Article 7(4) safeguards
Withdrawing Tier 2 or Tier 3 consent has no adverse effect on Tier 1 processing or baseline product functioning. GDPR Article 7(4) forbids tying contract performance on optional analytics consent.
Consent auditing
Each toggle change records an entry—including acting Dolibarr user id; tier impacted; grant or withdrawal; UTC timestamp; UI component revision; embedded policy revision; hashing proof-of-notice—for five years.
6. Voluntary module submissions
Knot Migration lets you voluntarily submit stripped metadata describing an unknown Dolibarr module so the collaborative catalogue improves.
Every upload requires a contemporaneous explicit consent action (unchecked checkbox, plain-language synopsis). Blanket retrospective consent is neither requested nor implied.
Payload: JSON metadata containing the editable technical slug, declared version graph, hooks, declared SQL tables — no bespoke configuration blobs, secrets, or business payloads.
Optional notifier email: you may submit a mailbox so we confirm follow-ups. Stored separately solely for fulfilment announcements; deleted earlier on request if idle for two years.
Dedicated deletion right: email contact at knot dot tools with the submission ticket; we strive to complete removals within 30 days.
7. Sub-processors
| Sub-processor | Role | Region | Assurances |
|---|---|---|---|
| IONOS SE | Hosts knot.tools marketing surfaces, inbound mailboxes for contact at knot dot tools, and the license.knot.tools portal backend stack |
Germany (EU/EEA) | GDPR Article 28 processing agreement executed; ISO 27001 certification |
| Stripe Payments Europe Ltd | Payment capture and reconciliation for Knot Pro Pack and Knot Migration; subscription tooling | Ireland (EU/EEA), with onward transfers governed for Stripe Inc. (USA) by Standard Contractual Clauses (Commission Decision 2021/914), and where certified, the EU–US Data Privacy Framework | PCI DSS Level 1; GDPR Article 28 DPA executed |
| Cloudflare Inc. | Web Analytics (cookieless audience measurement) on knot.tools; Turnstile (anti-bot) on /try/ and /beta/ |
United States (transfers under EU SCCs 2021/914 and Cloudflare DPA) | GDPR Art. 28 DPA; cloudflare-customer-dpa |
The register is maintained as live documentation. Material changes trigger an update to this policy.
8. Transfers outside the European Union
Processing substantially remains within the EEA:
- IONOS SE (Germany) — marketing content, mailbox, licence portal backends — no envisaged onward transfers beyond the bloc for the foregoing purposes.
- Stripe Payments Europe Ltd — primary payment processing anchored in Ireland.
Transfers to the United States may occur for:
- Stripe — onward routing to Stripe Inc. under Standard Contractual Clauses (Decision 2021/914) and, where certified, the EU–US Data Privacy Framework;
- Cloudflare (Web Analytics on knot.tools; Turnstile on
/try/and/beta/) — processing by Cloudflare Inc. under Standard Contractual Clauses (Decision 2021/914) and the Cloudflare DPA (link).
No other deliberate cross-border disclosures are contemplated by Knot Tools™ for the purposes described in this notice.
9. Your rights
Under GDPR Articles 15–22 you benefit from:
- Access—receive a readable copy of your personal data on file;
- Rectification—correct inaccuracies;
- Erasure, subject to legal retention mandates (particularly 10‑year bookkeeping archives);
- Restriction of processing;
- Objection where legitimate interest is asserted;
- Portability;
- Consent withdrawal where processing hinged on consent, without retrospective invalidation;
- The right to lodge a complaint with the French CNIL: 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr.
Submit requests to contact at knot dot tools, describing the right invoked. We respond within one calendar month, extendable by two months when complexity or volume warrants advance notice.
10. Security
We implement appropriate technical and organisational measures, including:
- Encryption in transit: client-to-
license.knot.toolstraffic uses TLS 1.2 or newer. - End-to-end encryption: reference snapshots delivered to you are sealed with your public key material.
- Segregation: licence, telemetry, and submission datasets reside in isolated storage domains.
- Backups: encrypted and retained within the EEA.
- Access control: least-privilege admin accounts with auditable access logs.
- Semi-annual anonymisation assurance review (see section 4.4).
Should a personal-data breach likely affect your rights, we notify the CNIL within 72 hours (GDPR Article 33) and inform data subjects without undue delay when Article 34 criteria are met.
11. Changes to this policy
We may amend this notice to reflect regulatory, product, or vendor changes. Any material change affecting Tier 2/3 telemetry or key sub-processors will be communicated by email to impacted commercial customers.
Each published version is archived with a version token; historical copies are available on request from contact at knot dot tools.
12. Contact
For questions about this policy or to exercise your rights:
- Email: contact at knot dot tools
- Post: Sébastien AUDEL — EXIATIS, Quartier Monnerot, 97231 Le Robert, Martinique, France.
You may also file a complaint with the CNIL: www.cnil.fr/en/complaints.