Privacy policy

The German version at /de-de/legal/datenschutz/ is authoritative; this English version is provided for convenience.

1. Controller

The controller within the meaning of the EU General Data Protection Regulation (GDPR) is:

Kuno Intelligence GmbH
Neuhoffweg 13b
82229 Seefeld
Germany
Email: [email protected]

2. General principles

We process personal data of our users only insofar as necessary to provide a functional website together with our content and services. Processing occurs either with the user's consent (Art. 6(1)(a) GDPR) or where a legal basis under Art. 6(1)(b), (c) or (f) GDPR applies.

3. Hosting

This website is served by Cloudflare Pages, operated by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, and delivered through Cloudflare's global edge network. When the site is accessed, server and security logs are processed temporarily (IP address, timestamp, requested URL, browser, operating system, referrer URL). The legal basis is our legitimate interest in providing a secure and stable website and in defending against attacks (Art. 6(1)(f) GDPR).

A data processing agreement under Art. 28 GDPR is in place with Cloudflare. Because Cloudflare is based in the USA, personal data may be transferred there; Cloudflare relies on the EU Standard Contractual Clauses under Art. 46(2)(c) GDPR for such transfers.

We use technically necessary cookies to remember your cookie preferences. Analytics cookies, heatmaps, session recordings, marketing cookies, and tracking events are activated only after your explicit consent pursuant to § 25(1) TDDDG and Art. 6(1)(a) GDPR. You can withdraw consent at any time via the cookie banner. For a full inventory see our cookie policy.

5. Web analytics with Google Analytics 4

With your consent we use Google Analytics 4 for pseudonymous reach and usage analysis to improve Kiolo. The Google tag is present in consent mode with analytics and advertising storage denied by default; GA4 cookies and page-view analytics are activated only after statistics consent.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Purpose: pseudonymous reach and usage analysis to improve Kiolo.
Legal basis: Art. 6(1)(a) GDPR (consent) and § 25(1) TDDDG.
Processor: a data processing agreement under Art. 28 GDPR is in place with Google.
IP anonymisation: enabled. Google processes the IP address inside the EU/EEA and truncates it before further processing.
Third-country transfers (US): data may be transferred to Google LLC in the United States. Transfers rely on the EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR and on Google's certification under the EU-US Data Privacy Framework (adequacy decision of the EU Commission, Art. 45 GDPR).
Retention: the GA4 cookies _ga and _ga_<ID> have a lifespan of up to 24 months.
Withdrawal: you can adjust or withdraw your consent at any time via “Cookie settings” in the footer, or by deleting the localStorage entry kuno-consent-v2.

For more information on data processing by Google, see Google's privacy policy: https://policies.google.com/privacy.

6. Microsoft Clarity

With your statistics consent, we load Microsoft Clarity to understand how visitors use the site through aggregated analytics, heatmaps, and session recordings. Clarity is not loaded unless statistics consent has been granted. When Clarity is loaded, we send Microsoft's Consent API v2 signal: analytics storage is granted for statistics consent, while ad storage remains denied unless marketing consent is also granted.

Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.
Purpose: heatmaps, session recordings, and aggregated usability analytics to improve Kiolo.
Data categories: page interactions, clicks, scrolling, device/browser information, referrer, pseudonymous identifiers, and IP address. Sensitive content is intended to be masked in Clarity.
Legal basis: Art. 6(1)(a) GDPR (consent) and § 25(1) TDDDG.
Third-country transfers: data may be processed by Microsoft group companies outside the EU/EEA. Microsoft states that it uses safeguards such as the EU Standard Contractual Clauses and the EU-US Data Privacy Framework.
Withdrawal: you can adjust or withdraw statistics consent at any time via “Cookie settings” in the footer. On withdrawal, we send a denied consent signal to Clarity and expire Clarity's first-party cookies where possible.

For more information on data processing by Microsoft, see Microsoft's privacy statement: https://privacy.microsoft.com/privacystatement.

7. Google Tag Manager

With your marketing consent, we load Google Tag Manager as a tag management container for advertising and retargeting tags. Without marketing consent, GTM is not loaded. Meta Pixel can be loaded through this container only after marketing consent. No Google Ads remarketing tag, LinkedIn Insight Tag, or TikTok Pixel is currently configured in the container.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Purpose: consent-gated delivery and management of marketing and retargeting tags.
Legal basis: Art. 6(1)(a) GDPR (consent) and § 25(1) TDDDG.
Third-country transfers (US): data may be transferred to Google LLC in the United States. Transfers rely on the EU Standard Contractual Clauses and Google's EU-US Data Privacy Framework certification.
Withdrawal: you can adjust or withdraw marketing consent at any time via “Cookie settings” in the footer.

8. Meta Pixel

With your marketing consent, we may use Meta Pixel through Google Tag Manager to measure Kiolo advertising on Facebook and Instagram, build anonymous website audiences for retargeting, and record successful waitlist signups as a Lead event. Without marketing consent, Meta Pixel is not loaded.

In the initial configuration, we do not send email addresses and do not use browser-side advanced matching. Data that may be processed includes page views, referrer, browser and device information, IP address, cookie or pixel identifiers, and the events PageView and Lead for successful waitlist signups.

Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.
Purpose: Meta ad measurement and optimisation, retargeting audiences, and conversion measurement.
Legal basis: Art. 6(1)(a) GDPR (consent) and § 25(1) TDDDG.
Third-country transfers (US): data may be transferred to Meta Platforms, Inc. in the United States. Meta states that it uses safeguards such as EU Standard Contractual Clauses and EU-US Data Privacy Framework certifications.
Withdrawal: you can adjust or withdraw marketing consent at any time via “Cookie settings” in the footer.

For more information on data processing by Meta, see Meta's privacy policy: https://www.facebook.com/privacy/policy/.

9. Attribution measurement on our own infrastructure

In addition to the third-party services described above, and only with your consent to the statistics category, we measure on our own infrastructure which channel a visitor arrived through. The purpose is to be able to answer which content and which channels actually lead to orders, without involving further third parties to do so.

The only data processed for this purpose are:

origin of the visit: referrer domain, campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content) and the first page opened,
a pseudonymous device identifier and, for signed-in people, a pseudonymous user identifier,
for orders, the order value and currency,
the country of the visit (ISO country code), but no finer location.

Expressly not processed in this context is any content arising from your use of kiolo — recordings, transcripts, summaries, prompts or participants — nor any free text, email address, name, or access or order token. This separation is a binding rule and cannot be relaxed by configuration.

Where it is stored: our own data warehouse built on Google BigQuery, operated in the EU region. The provider is Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland; a data processing agreement under Art. 28 GDPR is in place.
Legal basis: Art. 6(1)(a) GDPR (consent) and § 25(1) TDDDG. Without statistics consent, this collection does not take place.
Retention: 26 months, then deletion.
Withdrawal: at any time via “Cookie settings” in the footer.

When you sign up for launch info, we process your email address to inform you about the launch of Kiolo. The legal basis is your consent under Art. 6(1)(a) GDPR. We use a single opt-in process: your email address is stored as soon as you submit the form, and you do not receive a separate confirmation email.

Email delivery is handled by Amazon Simple Email Service (Amazon SES), operated by Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, 1855 Luxembourg, with processing in the Europe (Frankfurt) region. A data processing agreement under Art. 28 GDPR is in place with Amazon Web Services. You may withdraw consent at any time, e.g. via the unsubscribe link in every email or by contacting [email protected].

11. Contact

If you contact us by email we process the data you submit in order to handle your request (Art. 6(1)(b) or (f) GDPR). Requests are kept for as long as necessary, and at most for the periods required by commercial and tax law.

12. Fonts (Google Fonts)

We currently load the “Inter” typeface from Google Fonts (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Your IP address is transmitted to Google in this process. We plan to self-host the font shortly to avoid this transmission.

13. Your rights

You have the right to:

access your personal data (Art. 15 GDPR),
have inaccurate data corrected (Art. 16 GDPR),
have your data erased (Art. 17 GDPR),
restrict processing (Art. 18 GDPR),
data portability (Art. 20 GDPR),
object to processing (Art. 21 GDPR),
withdraw consent at any time, with effect for the future (Art. 7(3) GDPR),
lodge a complaint with a supervisory authority (Art. 77 GDPR).

14. Competent supervisory authority

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18, 91522 Ansbach, Germany
www.lda.bayern.de

15. Updates

This privacy policy reflects the state as of the date noted above. As our site evolves or legal requirements change, we may need to update it.