Scores are signals. Not verdicts.

In short: the scores on your dashboard are advisory signals that show you where to focus, not automated decisions used against you. The logic is deterministic and published, you can see every input, dispute it, or turn scoring off, and no score leaves your dashboard.

These are the scores you see in your Privacy Exposure Score dashboard.

Why this page exists

KnytX surfaces several numeric signals on user dashboards. The previous version of our Privacy Policy said we did not run automated decisions and would update the policy if that changed. It has changed. This page exists so the disclosure is concrete, not generic.

GDPR Article 22 gives a data subject the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Our scores do not meet that threshold — they are advisory signals shown to you, not adjudicative outputs used against you — but we want to be explicit about that distinction rather than rely on it as a defense.

The four scores in production

1. Privacy Risk Score (all tiers)

• What it is: A single number, 0–100, summarising your overall digital exposure. Higher means more exposed.
• Inputs: Number of brokers listing you, number of breaches your identifiers appear in, severity of each breach, presence of stealer-log entries (Pro+), dark-web mentions (Pro+).
• Logic: A weighted sum, with the weights published below. Not a machine-learning model — a deterministic scoring rubric you can audit.
• What it is used for: Sorting the dashboard. Highlighting which remediation to do next. Tracking your improvement over time.
• What it is not used for: Pricing. Insurance. Hiring decisions. Anything outside of your KnytX dashboard. We do not share the score with any third party.

Weights (published):

The weights are public. Future changes to the weights are versioned, and your dashboard shows which version produced the displayed score.

2. Privacy Maturity Level (Pro and above)

• What it is: A discrete progression — Beginner, Foundational, Intermediate, Advanced, Hardened — describing how much of the KnytX feature set you have engaged with and how much risk you have mitigated.
• Inputs: Completion of broker removals, breach remediation actions, password rotation, biometric enrollment (where applicable), open-source-app installation, 2FA enrollment for the KnytX account itself.
• Logic: Threshold-based. Each level requires a set of completed actions. The list is visible in the dashboard.
• What it is used for: Gamification. Helping you see progress. Suggesting the next action.
• What it is not used for: Anything outside the dashboard.

3. Scam Vulnerability Score (Pro and above)

• What it is: A number, 0–100, estimating how easy it would be for a scammer to construct a convincing pretext against you using exposed data.
• Inputs: Combinations of exposed data that are particularly useful for social engineering — name + DOB + employer, name + phone + last-four of SSN, voice sample exposure, family-member identifier exposure (where you have authorised family-plan visibility).
• Logic: Combinatorial. Specific high-value combos add more points than the sum of their parts (because a scammer with three correlated facts is meaningfully more dangerous than one with three uncorrelated facts).
• What it is used for: Prioritising remediation. Highlighting “preemptive scam warning” coverage.
• What it is not used for: Anything beyond your dashboard.

4. Pro 4-Dimension Score (Pro, Family, Team, Executive)

• What it is: Four sub-scores, each 0–100, for financial risk, identity-theft risk, physical safety risk (relevant when home address is broadly exposed), and reputation risk.
• Inputs: Categorised subsets of the inputs to the overall Privacy Risk Score, plus impersonation findings for the reputation dimension.
• Logic: Deterministic weighting per dimension, with the weights published in your dashboard.
• What it is used for: Letting you see which kind of risk is largest, so you can prioritise.
• What it is not used for: Anything beyond your dashboard.

What the scores are not

None of the four scores is, in our view, a “solely-automated decision producing legal or similarly significant effects” under GDPR Article 22, because:

1. The scores are shown to you, the data subject. They are inputs to your own decisions.
2. The scores do not determine the price of KnytX, the features you get, or whether you can use the service. KnytX pricing is tier-based and posted publicly.
3. The scores are not shared with insurance companies, lenders, employers, landlords, or any other third party. We have no commercial relationship with any such party.
4. The logic is deterministic and disclosed. There is no opaque ML model whose reasoning we cannot explain.

If a regulator concluded that one of the scores does fall within Article 22, we have a documented fallback: turning the score into an explicitly opt-in feature with a human-review path. We are prepared to switch to that posture on short notice.

DPDPA Draft Rules 2025

India’s draft DPDPA Rules contemplate disclosure obligations for “significant” automated decisions. We treat scoring as in-scope for that disclosure even though the scores are advisory, and we will update this page if the final Rules change the threshold or the disclosure format.

Your rights, specifically about scoring

• Right to see the inputs. Your dashboard shows the contribution of each input to each score. If a finding is incorrect (e.g. a broker listed under your name is actually a different person), use the in-product flagging control or email legal@knytx.com to dispute the input. Disputed inputs are excluded from your score while the dispute is open.
• Right to a human review. Email legal@knytx.com with subject line “Score review” and a member of our team will manually review the score, the inputs, and the logic and either explain or correct as appropriate. This is free and not rate-limited.
• Right to opt out of scoring. Account settings → “Disable scoring dashboard”. The scoring engine still runs (your findings are still there), but the numeric and level outputs are hidden. You will see raw findings instead.
• Right to delete the score history. Account settings → “Delete score history” removes the time-series record. Current scores will rebuild on the next scan; prior history is gone.
• Right to portability. The score history is part of your data export.

Inputs we do not use, on principle

The following are NOT inputs to any KnytX score:

• Your IP address or geolocation history
• Your browsing behaviour on knytx.com
• Your device or browser fingerprint
• Your demographics inferred from any data we hold
• Your subscription tier, payment history, or how long you have been a customer
• Any data from sister companies (Stalten, XRTE) or any external commercial source

We score what you are exposed to, not who you are.

Changes to the scoring logic

When we change a weight, add an input, or retire a model, we:

1. Publish the new weights in this page, with a dated revision note.
2. Show both the old and new score on the dashboard for at least 14 days so you can see the impact.
3. Allow you to opt out of the new model in the meantime if you disagree with the change.

Material model changes are included in the annual transparency report.

Questions

Scoring questions, disputes, and human-review requests: legal@knytx.com, subject line “Scoring”.

For the broader controller-of-record details, see Section 1 of the Privacy Policy.