Kipti
Back to legal overview

This English translation is provided for convenience only. The legally binding version of this document is the German original. In case of any discrepancy, the German version prevails.

Privacy Policy

Last updated: 25.09.2026

1. Controller

The controller for the processing of personal data in connection with the app.kipti.app application is:

Kipti GmbH
Hermann-Glüsenkamp-Straße 5
49086 Osnabrück
Germany

Email: info@kipti.app

2. Data protection officer

Our data protection officer can be reached at:

Kipti GmbH
attn. Data Protection Officer
Hermann-Glüsenkamp-Straße 5
49086 Osnabrück
Germany

Email: datenschutz@kipti.app

3. Subject matter of this privacy policy

This privacy policy applies to the use of the application at app.kipti.app and to the information and legal pages that are publicly accessible there. Insofar as Kipti refers to this privacy policy on publicly accessible product or landing pages at kipti.app or www.kipti.app, it applies to those pages as well. This privacy policy does not apply to other external websites.

The contractual details concerning the use of the platform, data processing on behalf of the customer, and permitted uses are set out in Kipti's GTC (Allgemeine Geschäftsbedingungen – general terms and conditions), the DPA (Auftragsverarbeitungsvertrag – data processing agreement) and the Acceptable Use Policy.

4. What data we process

The following data in particular may be processed within the application:

  • account and registration data, for example name, email address, organisation and role,
  • usage and log data, for example login times, technical events and security notices,
  • consent record data, in particular the point in time, the document version and the checksum of the accepted document as well as the user agent at the time consent was given, in order to comply with the obligation to demonstrate consent under Art. 7(1) GDPR; no IP address is stored for this purpose,
  • content data that users record in the application, in particular notes, observations, reports, profiles, chat histories and other documentation data,
  • data of documented persons, insofar as such data is entered into the platform by customers or users,
  • payment and billing data, insofar as chargeable features are used,
  • technical data for error analysis, security and availability of the application,
  • technical retrieval data when embedded product, onboarding or documentation videos are played, for example IP address, user agent, location data roughly derived from the IP address, and technical delivery logs.

Responsibility for the lawfulness of entering and processing data of documented persons lies in principle with the respective customer as the controller under data protection law. Where the application is used in a school context, in particular where it is used via VIDIS, this is regularly the respective school or the competent school authority as the controller. Kipti processes such data as a processor under the DPA.

We process personal data in particular for the following purposes:

  • provision, operation and safeguarding of the application,
  • registration, login and administration of user accounts,
  • provision of the documentation, communication and AI features,
  • technical maintenance, error analysis and improvement of stability,
  • payment processing and billing,
  • compliance with statutory obligations,
  • communication with users and customers.

Insofar as Kipti is itself the controller, the processing takes place, depending on the individual case, on the basis of Art. 6(1)(b) GDPR for the performance of a contract, Art. 6(1)(c) GDPR for compliance with legal obligations, Art. 6(1)(f) GDPR on the basis of legitimate interests in the secure and reliable operation of the application, or Art. 6(1)(a) GDPR on the basis of consent, in particular for analytics cookies.

Insofar as Kipti processes personal data on behalf of the customer, this takes place on the basis of the DPA pursuant to Art. 28 GDPR.

6. AI features and transcription

Kipti provides AI-supported features, in particular for structuring, summarising and preparing information that has been entered. The AI features serve to support users. AI-generated content must be reviewed by users and does not replace the user's own professional assessment.

Customer data is not used to train or improve AI models.

For AI features and transcription we use, in particular, Scaleway S.A.S., Inceptron AB and Lyceum Technology Germany GmbH, insofar as this is necessary for the provision of the application. Personal data of documented persons is processed exclusively within the EU or the EEA. Personal data of documented persons is neither transferred to nor processed by non-European model or platform providers.

7. Hosting, storage and technical service providers

The application is operated on European infrastructure. For hosting, databases, storage and backups we use, in particular, Hetzner Online GmbH and Scaleway S.A.S. Data of documented persons is processed and stored exclusively within the EU or the EEA.

For individual technical functions we engage further service providers, in particular:

  • Stripe Payments Europe, Limited and Stripe Technology Europe, Limited, both Ireland, for payment processing and billing (details in section 10),
  • PostHog, Inc. for product analytics subject to consent,
  • Functional Software, Inc. (Sentry) for error monitoring,
  • Mux, Inc. for video delivery,
  • Cloudflare, Inc. for DNS and technical certificate validation,
  • Attio Limited for CRM data on business and sales contacts, not for data of documented persons.

Where required, data processing agreements or comparable data protection arrangements are in place with the service providers engaged.

8. Product analytics with PostHog

Details of the cookies and similar technologies used can be found in our Cookie Policy.

We process usage data for product analytics only on the basis of consent.

For product analytics we use PostHog. In doing so, features for reducing personal data are applied, in particular masking of text input, deactivation of session recording and heatmaps, and IP suppression. The analytics serve to improve the application technically and functionally.

Consent that has been given may be withdrawn at any time with effect for the future.

8a. Video delivery with Mux

For product, onboarding and documentation videos, Kipti may use Mux, Inc. During playback, the browser retrieves media files and streaming segments from Mux or its delivery networks. This gives rise to technical retrieval data such as IP address, user agent, roughly derived location, time of retrieval and delivery logs.

Kipti uses Mux without Mux Data tracking, without Mux cookies and without personal user, organisation, role or email metadata. Video delivery does not serve analytics or advertising purposes; no separate cookie or analytics consent is required for it. Mux Data is used for analytics purposes only following a separate data protection assessment and, where required, consent.

The legal basis is Art. 6(1)(f) GDPR (secure, stable and user-friendly video delivery) or, in the case of platform functions provided under the contract, Art. 6(1)(b) GDPR. Insofar as Kipti processes personal data on behalf of a customer, this takes place on the basis of the DPA pursuant to Art. 28 GDPR.

9. Error monitoring with Sentry

To detect and remedy technical errors we use Sentry. In doing so, technical information such as error events, timestamps, browser/device information, technical identifiers and the affected program locations may be processed.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and stable operation of the application.

10. Payment processing

For the processing of payments, subscriptions and invoices we use Stripe. Kipti's contractual partners in this respect are Stripe Payments Europe, Limited and Stripe Technology Europe, Limited, both established in Ireland. Stripe Technology Europe, Limited provides the regulated payment services as an e-money institution supervised by the Central Bank of Ireland. Since 3 January 2026, the main establishment of the Stripe group in Europe for data protection purposes has been Stripe Technology Company Limited, likewise established in Ireland.

The data processed comprises, in particular, name, email address, billing address, VAT identification number, details of the selected subscription as well as payment and transaction data. Payment means data, for example card data, is entered exclusively with Stripe and processed there; Kipti does not receive complete payment means data. Personal data of documented persons is not transferred to Stripe.

Stripe acts in a dual role. Insofar as Stripe executes payments on our behalf and on our instructions, Stripe acts as a processor within the meaning of Art. 28 GDPR; a data processing agreement with Stripe Payments Europe, Limited is in place for this purpose. Insofar as Stripe processes personal data for fraud prevention, for compliance with its own regulatory, financial and anti-money-laundering obligations, and for the security and further development of its own services, Stripe determines the purposes and means independently and is itself a controller in this respect. The controller for this is Stripe Technology Company Limited; in the case of regulated payment services it is a joint controller together with Stripe Payments Europe, Limited and Stripe Technology Europe, Limited. Stripe's privacy notices then apply.

Stripe transfers personal data to affiliated companies outside the EU or the EEA, in particular to Stripe, LLC established in the USA. This transfer takes place primarily on the basis of the adequacy decision on the EU-U.S. Data Privacy Framework pursuant to Art. 45 GDPR, for which Stripe, LLC is certified, and additionally on the basis of the European Commission's standard contractual clauses pursuant to Art. 46(2)(c) GDPR.

The legal basis is Art. 6(1)(b) GDPR insofar as the processing is necessary for the performance of the contract, Art. 6(1)(c) GDPR insofar as statutory retention, record-keeping and anti-money-laundering obligations exist, and Art. 6(1)(f) GDPR with regard to fraud prevention and the security of payment transactions.

The sub-processors engaged by Stripe are available at https://stripe.com/service-providers/legal. Further information on data processing by Stripe: https://stripe.com/privacy.

11. Sending of emails

For transactional emails, for example registration, authentication and system notifications, we use Scaleway. In doing so, the email address, the content of the respective system message and technical dispatch data in particular are processed.

The legal basis is Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR.

12. Storage period and erasure

We store personal data only for as long as this is necessary for the respective purposes. The determining factors are, in particular, the duration of the contractual or usage relationship, statutory retention obligations, security and record-keeping requirements, and the contractual provisions on the return and erasure of data, in particular in the DPA.

We store the IP address from which a sign-in takes place exclusively for security purposes, in particular to detect unauthorised sign-ins, and erase it no later than seven days after the sign-in.

13. Recipients and transfers to third countries

Personal data is disclosed to service providers only insofar as this is necessary for the operation of the application, the performance of the contract, security or statutory obligations.

Data of documented persons is processed exclusively within the EU or the EEA.

In the case of individual technical service providers, in particular payment, CRM, analytics, error monitoring or video delivery services, processing of other customer data outside the EU or the EEA cannot be entirely ruled out. This does not concern data of documented persons. In such cases the transfer takes place only on the basis of the GDPR, in particular on the basis of an adequacy decision or appropriate safeguards such as EU standard contractual clauses. Further information on the relevant safeguards can be requested at datenschutz@kipti.app.

14. Data subject rights

Under the GDPR, data subjects have, in particular, the right of access, the right to rectification, the right to erasure, the right to restriction of processing, the right to data portability and the right to object to certain processing operations.

Insofar as Kipti processes data on behalf of a customer, the respective customer is in principle responsible for handling data subject requests. Kipti supports the customer in accordance with the DPA.

Requests can be addressed to datenschutz@kipti.app.

Insofar as processing is based on consent, that consent may be withdrawn at any time with effect for the future. The lawfulness of the processing carried out up to the withdrawal remains unaffected.

15a. Necessity of providing data

The provision of certain personal data is necessary in order to create a user account, provide the application, perform contracts or comply with statutory obligations. Without this data, individual features or the use of the application as a whole cannot be provided.

16. Right to lodge a complaint

Data subjects have the right to lodge a complaint with a data protection supervisory authority. The authority competent for Kipti is, in particular:

Die Landesbeauftragte für den Datenschutz Niedersachsen (the State Commissioner for Data Protection of Lower Saxony)
Prinzenstraße 5
30159 Hannover
Website: https://lfd.niedersachsen.de

17. No automated decision-making in individual cases

Kipti does not take any automated decisions within the meaning of Art. 22 GDPR concerning documented persons. The AI features serve exclusively to support users and require human review.

18. Changes to this privacy policy

We may adapt this privacy policy where technical, legal or organisational changes occur. The version made available in the application from time to time applies.