Privacy notice
Last updated: September 25, 2026
1. Controller
The controller responsible for this website is Kipti GmbH, Hermann-Glüsenkamp-Straße 5, 49086 Osnabrück, Germany. Contact us at info@kipti.app. For data protection questions, contact datenschutz@kipti.app.
2. Scope
This privacy notice applies to the kipti.app website. A separate privacy notice applies to the Kipti application and is available at app.kipti.app/legal.
3. Hosting and server logs
We host and operate this website with Vercel Inc. in the United States. When you access the website, technical server logs are processed, in particular the IP address, user agent, time of access, and pages requested. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and stable operation of the website.
Where providers process personal data on our behalf, we enter into data processing agreements under Article 28 GDPR. Transfers to the United States are protected through appropriate safeguards, in particular Standard Contractual Clauses and, where available, the EU-U.S. Data Privacy Framework.
5. Analytics tools
After consent, we use PostHog's EU Cloud to analyze page views, clicks, scroll depth, and navigation paths. This can include heatmaps and Session Replay. Replay runs only on this marketing website, masks input fields, and excludes the signed-in Kipti application. The provider is PostHog Inc.
The connection runs through the managed reverse proxy e.kipti.app. PostHog uses Cloudflare as a subprocessor and does not guarantee exclusively European edge termination. Requests may terminate outside the EEA; according to PostHog, they are neither logged nor cached there.
5a. Product videos with Mux
For product videos on this website we use Mux, Inc., USA. A video loads only when you start it; before that, your browser does not connect to Mux. During playback, the browser retrieves media files, captions, and streaming segments from Mux or its delivery networks. This produces technical retrieval data such as the IP address, user agent, roughly derived location, time of retrieval, and delivery logs.
We use Mux without Mux Data tracking, without Mux cookies, and without personal metadata; no separate cookie or analytics consent is required for this. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is secure, stable, and user-friendly video delivery. Transfers to the United States are safeguarded by appropriate guarantees, in particular Standard Contractual Clauses and, where available, the EU-U.S. Data Privacy Framework.
6. Contact by email
When you contact us by email, we process the information you provide to respond to your request. Depending on the subject, the legal basis is Article 6(1)(b) GDPR or Article 6(1)(f) GDPR.
7. CRM (Attio)
We use Attio Ltd., London, United Kingdom, to manage business contacts and inquiries. The United Kingdom is covered by an EU adequacy decision. The legal basis is Article 6(1)(f) GDPR and, for contract-related inquiries, Article 6(1)(b) GDPR.
8. Retention
We keep personal data only as long as necessary for the relevant purpose. We retain PostHog analytics events described in section 5 for no more than 36 months and Session Replay recordings for no more than 30 days. Statutory retention duties remain unaffected.
9. Recipients and international transfers
Recipients of personal data include service providers used for hosting, analytics, video delivery, communications, and CRM. Where required, they act as processors under Article 28 GDPR. Transfers to third countries take place only on the basis of an adequacy decision or appropriate safeguards such as Standard Contractual Clauses. Request details at datenschutz@kipti.app.
10. Your rights
Under the GDPR, you have rights of access, rectification, erasure, restriction of processing, data portability, and objection. Where processing is based on consent, you can withdraw that consent at any time with effect for the future.
You also have the right to lodge a complaint with a data protection supervisory authority. The authority particularly relevant to Kipti is the State Commissioner for Data Protection of Lower Saxony, Prinzenstraße 5, 30159 Hannover: lfd.niedersachsen.de.
11. Changes
We update this privacy notice when the services we use, technical processes, or legal requirements change.