How KnytX Acts as Your Authorised Agent

Effective: 22 May 2026.

How enrollment works

1. You sign the enrollment form. Tick the unticked box and click “I authorise KnytX to file removal requests on my behalf.” We record the audit fields CCPA Reg §7063 requires — see Section 3 for the full list.
2. KnytX generates your signed permission letter. We create an auditable record confirming KnytX as your agent. Any data broker who challenges it can verify with us — see Section 3.
3. KnytX files requests on your behalf. We submit deletion, correction, opt-out, and right-to-know requests to data brokers under CCPA, GDPR, DPDPA, and other applicable laws. Each covers all verified identities on your account in a single unified request per broker. (California DELETE Act filings are the one exception — you submit those yourself; see Section 2.)
4. You track progress in the dashboard. Every request, response, and status change is logged. Download your full audit trail at any time from account settings (“Export my removal history”).

1. What an “authorised agent” is, and what we are not

California’s Consumer Privacy Act defines an authorised agent at §1798.140(i). The California Privacy Protection Agency’s regulations at CCPA Reg §7063 set out the exact terms under which one may act. In plain English:

• An authorised agent is a person or business you have given written permission to file consumer-rights requests on your behalf.
• The agent must be able to prove the authorisation if the responding business asks.
• The agent cannot use the relationship for any purpose other than the requests you authorised.

KnytX, as a service of NCRYPTO Labs Private Limited, acts as an authorised agent under these rules and the parallel rules in other jurisdictions (see the legal-framework matrix). We are explicitly not:

• Your attorney. We do not give legal advice. We do not litigate on your behalf. We do not represent you in court.
• A debt collector, repossession agent, or anything resembling one. We file privacy requests, not financial claims.
• The State of California. The DELETE Act’s DROP portal is operated by the CPPA and has no agent-submission API. KnytX prepares your verified deletion request and walks you through submitting it yourself. Legal authority for the underlying request comes from the DELETE Act (SB 362) itself.

If a broker tells you that KnytX is “not really your agent” or that “only attorneys can file these requests”, they are wrong. CCPA §1798.140(i) was drafted precisely so that ordinary consumers can use a service to exercise their rights without hiring a lawyer.

2. What you authorise when you sign up

The KnytX subscription agreement and the in-product confirmation flow grant KnytX a limited, revocable agency to:

1. Submit requests to data brokers, websites, and other businesses for the deletion, correction, opt-out of sale or sharing, and right-to-know rights conferred by:

   • California CCPA / CPRA (§§1798.100, 1798.105, 1798.106, 1798.115, 1798.120)
   • EU GDPR (Articles 15, 16, 17, 21)
   • UK GDPR
   • DPDPA, 2023 (§§11, 12, 13)
   • Swiss FADP
   • Other state, federal, or national equivalents listed in the legal-framework matrix.

   The California DELETE Act (Civ. Code §1798.99.80 et seq.) works differently. It grants KnytX authority to prepare, verify, and format your deletion request. But the CPPA’s DROP portal accepts no agent submissions — the final click is yours. See DELETE Act filing for that flow.

2. Identify you to the responding business using the identifiers you have provided to KnytX (your name, the email addresses on your account, your phone number, your postal address where available).

3. Receive responses from the responding business and surface them to you in the KnytX dashboard.

4. Re-file or escalate where statutory exceptions are improperly invoked.

The authorisation is scoped: it covers privacy requests of the categories above. It does not let us:

• Make purchases or financial decisions on your behalf
• File complaints in your name beyond reporting non-compliance to supervisory authorities
• Disclose your data to third parties beyond the bare minimum needed to identify you to the responding business
• Re-sell, monetise, or otherwise commercialise the agency relationship

3. The “signed permission” requirement

CCPA Reg §7063 requires the agent to “obtain signed permission” from the consumer. We satisfy this by:

1. Account creation. When you create a KnytX account, you accept the Terms of Service, which incorporate this Authorised Agent disclosure by reference.
2. Click-through authorisation. Before we file the first request on your behalf, the in-product flow shows you the authorisation text. You must tick an unticked box and click “I authorise KnytX to file removal requests on my behalf”. We record:
   • the exact authorisation text shown
   • the timestamp
   • the user account
   • the IP address (for the audit trail required by §7063)
3. On-demand re-confirmation. Sometimes you significantly expand what you have authorised us to do — for example by adding a new identity, or by asking us to prepare a DELETE Act request for you to submit. When that happens, we re-confirm authorisation for the expanded scope. We do not silently expand what we are authorised to do.

A broker who challenges the authorisation can write to legal@knytx.com. We will provide a redacted confirmation showing the timestamp, authorisation version, and that the authorisation remains in force; we will not provide the broker with any data beyond what they already have.

4. The unified-deletion mechanic

KnytX accounts support multiple identities — up to 3 emails on Basic, 5 on Pro, 25 on Family (5 per family member), 3 per employee on Team, 10 on Executive. A single broker often holds records under more than one of those identities, sometimes without realising they belong to the same person.

When we file a CCPA §1798.105 deletion request to a broker on your behalf, we include all verified identities in one request. That lets the broker cross-reference and remove the complete profile. The request body says, in substance:

“Pursuant to CCPA §1798.105, [Customer Name], acting through their authorised agent KnytX (a service of NCRYPTO Labs Private Limited), requests deletion of all personal information associated with the following identifiers:

• [primary email]
• [secondary email]
• [tertiary email]
• Phone: [phone]

This request covers all records, profiles, and data listings associated with [Customer Name] at [postal address]. Please confirm deletion within the 45-day statutory window.“

One unified request beats three separate ones. A broker that deletes “john.smith@gmail.com” alone may keep a record under “john.smith@yahoo.com”. Without the unified identifier set, the broker cannot cross-reference the two. The unified request closes that loophole.

Identical mechanics apply to GDPR Art. 17, DPDPA §13, and other regimes — see the legal-framework matrix for per-jurisdiction citation language.

5. Verification — how brokers know it is you

CCPA Reg §7063 lets the responding business verify both the agent’s authorisation and the consumer’s identity. We support verification in three ways:

1. Agent verification. Brokers can write to legal@knytx.com and we will confirm that KnytX represents the named individual under a current authorisation. We will not give the broker more data than they already have; we will not let them turn the verification into a fishing exercise.
2. Consumer identity verification. Where the broker insists on verifying the consumer directly (some statutory exceptions permit this for sensitive requests), we coordinate a verification email loop. The consumer is in the loop; we do not impersonate the consumer.
3. Document verification. Some brokers require a signed authorisation document. This is rare, and CCPA Reg §7063 does not require it for ordinary deletion requests. Where a broker insists, we will generate and counter-sign one for the affected request only.

We will refuse verification demands that:

• Require the consumer to surrender data the broker should not need (e.g. a driver’s licence to delete an email address from a marketing list).
• Are designed to delay the 45-day window rather than verify identity.
• Demand notarisation, government photo ID, or in-person attendance for routine deletion requests, where the underlying statute does not authorise such demands.

We document refusals in your dashboard with the broker’s exact words, so you can see the pattern.

6. The audit trail

For each request we file, we keep:

• The full text of the request as submitted
• The submission timestamp and channel (email, web form, API, postal mail where relevant)
• The broker’s acknowledgement and any reference number
• Every subsequent communication from the broker
• Any escalation to a supervisory authority
• The final status (Completed, PartiallyCompleted, Refused with cited exception, Non-responsive)

You can download your audit trail at any time from the in-product account settings (“Export my removal history”). The export is a portable archive: JSON plus the underlying request and response artefacts. You can move it to a different service or hand it to a regulator, without us in the loop.

We retain audit trails for 7 years from the date of the request, which is longer than statutory limitation periods in any of the regimes we operate in. After 7 years, the audit trail is purged or anonymised. You can ask for earlier deletion if you have no pending matter; we will honour the request unless we believe retention is required to defend an ongoing dispute.

7. Revocation

You can revoke our agency at any time:

• Cancel your KnytX subscription, in which case the agency ends on cancellation.
• Email legal@knytx.com with subject line “Revoke agency”, which terminates the agency within 24 hours without cancelling your account.
• Use the in-product “Stop filing requests on my behalf” control, which has the same effect.

Revocation:

• Does not retract requests already filed. Those are filed under your authority and remain in force; if a broker fails to respond, the failure is between you and the broker after revocation.
• Does prevent any new requests from being filed.
• Does not by itself delete your KnytX account data. To delete account data, use the right-to-erasure flow in the Privacy Policy.

8. Limits we want to be clear about

• We are not a guarantor. Statutory exceptions exist; not every removal succeeds. We surface refusals; we do not pretend they did not happen.
• We do not sue brokers. If a refusal warrants litigation, you need an attorney. We will hand you the audit trail; that is what it is for.
• We do not represent businesses against consumers. KnytX only acts on behalf of natural persons (consumers, data subjects, data principals). If you receive a removal request from KnytX, it is on behalf of a consumer; you cannot retain us to push back on a consumer’s behalf.

9. Questions

Authorisation, scope, or verification questions: legal@knytx.com, subject line “Authorised Agent”.

For the cross-regime statutory basis, see the legal-framework matrix. For the California-specific DELETE Act mechanic, see /transparency/delete-act/.