Privacy Policy

1. Controller and Contact

The controller for the processing described in this Privacy Policy is:

Mustafa Serhat Dündar, trading as Konfidant
Bergstraße 70
10115 Berlin, Germany
Email: hello@konfidant.app

We are not legally required to appoint a data protection officer. For all privacy questions and requests, please contact us at the address above.

2. Our Role: Controller or Processor

Processor for share content. The texts and files that our customers share through Konfidant, and the metadata relating to those shares (such as expiry times, access times and audit log entries), are processed by us on behalf of the customer organization under a Data Processing Agreement (Art. 28 GDPR). The customer is the controller for this data. If you are a recipient of a share or a member of a customer organization and have questions about such data, please contact the organization that shared it with you; we will support it in responding.

Controller for everything else. We are the controller for data relating to visits to our website, accounts, billing, communication with us, and the technical operation and security of the Services. This is what the following sections describe.

3. Visiting Our Website: Hosting, Logs and Cloudflare

Hosting and server logs

Our web application and database are hosted by Hetzner Online GmbH on servers in Germany. When you access the website, the dashboard, a download page or the API, our servers record the following data in log files: IP address, date and time, requested URL, HTTP method and status code, amount of data transferred, referring URL, and user agent (browser and operating system). Application logs additionally record technical errors.

We process this data to deliver the Services, to keep them secure and stable, and to detect and fix errors and misuse. The legal basis is our legitimate interest in the secure and reliable operation of the Services (Art. 6 (1) (f) GDPR). Server and application logs are deleted after 14 days at the latest, unless specific entries are needed for longer to investigate a security incident.

Cloudflare

All traffic to our domains, including download pages on customer domains, passes through the network of Cloudflare, Inc. Cloudflare terminates the encrypted (TLS) connection, delivers content, and protects the Services against attacks such as DDoS. Encrypted shares are stored and delivered via Cloudflare R2 and Workers. For this, Cloudflare processes your IP address, request data and technical connection data, and keeps technical logs of our Workers for up to 7 days. The legal basis is our legitimate interest in fast and secure Services (Art. 6 (1) (f) GDPR) and, for share processing, the performance of our contract with the customer (Art. 6 (1) (b) GDPR).

4. Cookies and Consent Management

We store information on your device or access information stored there only where this is strictly necessary to provide a service you have requested, or where you have consented (§ 25 TDDDG).

• Strictly necessary: session cookies of our login provider Clerk (such as __session and __client_uat), which keep you signed in and protect your account; the cookie konfidant-theme, which stores the dashboard theme you selected (1 year); and the cookie cookieyes-consent, which stores your consent choices (1 year). These are permitted without consent under § 25 (2) No. 2 TDDDG. The legal basis for the related processing is Art. 6 (1) (b) GDPR (providing the requested service) and, for consent records, Art. 6 (1) (c) GDPR in conjunction with Art. 7 (1) GDPR.
• Analytics: cookies and similar technologies of Google Analytics and Microsoft Clarity (see Section 5). These are only used after you have consented (§ 25 (1) TDDDG, Art. 6 (1) (a) GDPR).
• Advertising: the Google Ads conversion cookies _gcl_au and _gcl_aw, and our own cookie konfidant_ad_click (see Section 5). They are only used after you have consented to the "Advertisement" category (§ 25 (1) TDDDG, Art. 6 (1) (a) GDPR).

We use the consent management platform CookieYes to obtain and document your consent. CookieYes processes your consent choices, a consent ID, the date and time, and the URL and browser information. You can change or withdraw your consent at any time with effect for the future by clicking the cookie icon or Cookie Settings on our website.

5. Google Analytics, Google Ads and Microsoft Clarity

Google Analytics

If you consent, we use Google Analytics 4, provided by Google Ireland Limited, to understand how our website is used, for example which pages are visited, how long visits last, the referring website, approximate location (country or city) and the device and browser used. Google Analytics sets cookies (such as _ga and _ga_*, stored for up to 2 years). Google Analytics 4 does not log or store IP addresses of users in the EU. We have not enabled Google signals or ad personalization. Analytics data is stored for 14 months.

Google Ads conversion measurement

We advertise Konfidant with Google Ads, provided by Google Ireland Limited. When you reach our website through a Google ad, the address contains a click ID that identifies that ad click. If you consent to the "Advertisement" category, we use it to learn which ads lead to sign-ups and paid subscriptions:

• If you have also consented to "Analytics", Google Analytics stores the click ID in the cookies _gcl_au and _gcl_aw (90 days) and reports to our linked Google Ads account when you click a link to sign up.
• We store the click ID in our own cookie konfidant_ad_click (90 days). If you then create an account, we store the click ID with your user account when you first open the dashboard. Our server reports to Google Ads that this ad click led to a completed sign-up and, if you buy a paid plan for your organization, to a purchase. For each of these we send Google only the click ID, the time of the sign-up or purchase, and for purchases the amount, currency and a subscription reference.

We use Google Ads for conversion measurement only: we do not use remarketing, audience lists or personalized advertising based on your visit, and Google signals and ad personalization are disabled. We do not send Google your name, email address or any other account data. We delete the stored click ID 90 days after the ad click, or earlier when your account is deleted. If you withdraw your consent to "Advertisement", we delete the konfidant_ad_click cookie and no longer use the click ID stored with your account: we delete it right away if you are signed in, and otherwise when you next start a checkout, before any purchase could be reported. Already reported conversions remain with Google Ads.

Microsoft Clarity

If you consent, we use Microsoft Clarity, provided by Microsoft Ireland Operations Limited, to understand how visitors interact with our marketing pages. Clarity records mouse movements, clicks, scrolling and page interactions, and creates heatmaps and session replays. Clarity sets cookies (such as _clck, stored for 1 year, and _clsk, stored for 1 day). Clarity data is stored for up to 13 months; session recordings are generally kept for 30 days.

The legal basis for these tools is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). Data may be transferred to the USA (see Section 15). Further information: Google Privacy Policy, Microsoft Privacy Statement.

6. Account Registration, Login and Organizations

To use the dashboard, you need an account. Registration, login and organization management are handled by Clerk, Inc. We and Clerk process your email address, name (if provided), profile picture (if provided), a password hash (stored by Clerk only), your user and organization IDs, your organization's name and your role in it, and technical session data such as IP address, browser and login times. Clerk sends verification codes and invitations by email.

If you sign in with a third-party account (for example, Google or GitHub), the provider sends us your name, email address, profile picture and a user ID, as permitted by your settings with that provider. These providers process data under their own responsibility.

The legal basis is the performance of the contract with you or the organization you belong to (Art. 6 (1) (b) GDPR) and, where you use the Services as an employee or member of a customer organization, our legitimate interest in providing the Services to that organization (Art. 6 (1) (f) GDPR). Measures to protect accounts against misuse are based on our legitimate interest in secure Services (Art. 6 (1) (f) GDPR).

7. Creating and Opening Shares

Creating a share

When you create a share, the text or file is encrypted on your device with AES-256-GCM before it is sent. The key is generated on your device and is only part of the share link (after the "#" sign, which browsers do not send to servers); we never receive it. We therefore cannot read the content, the file name or the file type. We store the encrypted content: files in Cloudflare R2 in the US, or in the EU if your organization has selected the EU storage region (available on paid plans); texts in our key management system in Germany. For each upload, we record the organization, user, size of the encrypted content, time and source (web or API) to apply plan limits and quotas. We also keep a running count of how many shares each user and each organization has created. The count records nothing about the individual shares; we use it to decide whether to send the reminders described in Section 11.

The content of shares and their metadata are processed on behalf of the customer (see Section 2). Usage records for quotas and billing are processed by us as controller on the basis of the contract (Art. 6 (1) (b) GDPR).

Opening a share as a recipient

You do not need an account to open a share. When you open a link, we process your IP address, user agent and the request data in our server and Cloudflare logs as described in Section 3. We do not store your identity, IP address or user agent in connection with the share, and we do not use analytics on download pages. If the sending organization has enabled verified burn, we record the time at which the share was opened. The legal basis is our legitimate interest in delivering the share securely and preventing misuse (Art. 6 (1) (f) GDPR) and, for the content and access time, the instructions of the sending organization.

Opening a share consumes its single-use access token; the encrypted content is then deleted. The content is decrypted in your browser with the key from the link, which is never sent to us. Shares that are not opened become inaccessible when they expire; encrypted texts are deleted at expiry, and encrypted files at the latest 30 days after upload.

8. API Usage

When you use the API, we process your API keys (stored only as a hash, with a visible prefix), their scopes and the time they were last used, and for each request the endpoint, method, status code, response time and the API key used. If a request exceeds the rate limit, we also record the IP address to detect abuse. We use this data to authenticate requests, enforce limits, bill usage-based fees and show usage in the dashboard. The legal basis is the performance of the contract (Art. 6 (1) (b) GDPR) and our legitimate interest in protecting the Services against abuse (Art. 6 (1) (f) GDPR).

9. Audit Logs and Verified Burn

Konfidant records security-relevant events of an organization, such as account and membership changes, subscription changes, changes to organization settings and API shares, together with the acting user and the time. Where an organization has enabled audit logs, further events such as file shares are recorded, and administrators can view the log in the dashboard. Audit logs serve the security and traceability of the organization's use of the Services and are processed on behalf of the customer (Section 2). Entries we need for our own security, billing or the defense of legal claims are additionally based on our legitimate interest (Art. 6 (1) (f) GDPR).

Audit logs and verified burn are only available on certain plans. If an organization's plan no longer includes them, for example after a cancellation or a downgrade, we turn the feature off: no new events or access times are recorded from then on. Existing audit log entries are kept as described in Section 16, unless an administrator deletes them by turning audit logs off in the settings.

10. Payments and Subscriptions

Payments are processed by Stripe Payments Europe, Limited ("Stripe"). You enter your payment details directly on Stripe's checkout page or customer portal; we never receive your full card details. Stripe processes your name, email address, billing address, company name and tax ID (if provided), payment method details, transaction data and data for fraud prevention. We receive and store your customer and subscription data from Stripe (customer ID, plan, number of seats, status, billing periods) and report API usage to Stripe for usage-based billing. Stripe processes some data as an independent controller, for example to comply with financial regulations and prevent fraud; see the Stripe Privacy Policy.

We store the notifications (webhooks) we receive from Stripe and Clerk to process them reliably and to be able to trace account and billing events.

The legal basis is the performance of the contract (Art. 6 (1) (b) GDPR), our legal obligations under tax and commercial law (Art. 6 (1) (c) GDPR), and our legitimate interest in traceable billing (Art. 6 (1) (f) GDPR).

11. Emails, Support and Notices

If you contact us by email, for example for support, privacy requests, content notices or security reports, we process your email address, name and the content of your message to handle your request. We send contract-related notices (such as changes to the Terms or the Services) to the email address of the account.

We send service emails about your account: a welcome email when you create an organization, and a confirmation with your organization's name and your role when you join one. We also send service notifications about the use of an organization's account to its administrators, for example when the organization has more members than paid seats. Such a notice contains the organization's name, the number of seats and, for each affected member, their email address and the number of their active API keys, so that administrators can decide whether to add seats or remove members. We send these emails through Resend (Plus Five Five, Inc., see Section 15).

The legal basis is the performance of the contract or pre-contractual measures (Art. 6 (1) (b) GDPR), our legal obligations, for example under the Digital Services Act (Art. 6 (1) (c) GDPR), and our legitimate interest in answering inquiries and in informing administrators about the state of their organization's account, including the members it affects (Art. 6 (1) (f) GDPR).

Reminders, share notifications, usage alerts and account activity

To help you get started and get the most out of Konfidant, we send these emails:

• Reminders: if you haven't created a share within a day of signing up; to the administrators of an organization that still has only one member a few days after it was created; and to the administrators of an organization on a plan that includes a custom download domain, once it has created several shares without setting one up. Depending on the plan, a reminder may point out the paid plans or features that would help, such as additional seats. When an organization's paid subscription is canceled, we email its administrators a link to a short, voluntary survey about why they canceled. The survey is anonymous: the link is the same for everyone, and the survey doesn't ask for your name or email address. Please don't include personal data in free-text answers. The survey is hosted on Google Forms; when you open it, Google receives technical data such as your IP address, and Google's privacy policy applies.
• Share notifications: only where the organization has enabled verified burn, when the first of your shares has been opened, and the first time one of your shares expires without being opened. These emails contain whether the share was a text or a file and the times it was created, opened or expired. They never contain the content, the file name or the recipient.
• Usage alerts: to the administrators of an organization when it has used 80% or all of a monthly upload quota or of the API shares included in its plan (including when further API shares are billed as overage), and when a new member takes its last paid seat; and to you, when a request of yours was rejected by a plan limit (maximum file size, maximum link expiry or number of API keys) that a higher plan would allow. These emails contain the usage figures, the limit and, for a rejected request, the size or expiry time you requested. If the dashboard rejects a file before uploading it, your browser tells us its size for this purpose; the file itself is not sent.
• Account activity: to the administrators of an organization when its settings (such as verified burn, audit logs, whether members can create API keys, or the datacenter) are changed, and when a custom domain is added or removed, so that every administrator notices changes made by another administrator or through a compromised account. These emails contain the setting with its old and new value or the domain, the time of the change and the email address of the administrator who made it. When a plan change turns settings off, the email says so instead of naming an administrator.

Reminders and share notifications are sent at most once per person (and, for reminders about an organization, once per organization). Usage alerts are sent at most once per threshold and quota period or seat count, plan limit alerts at most once a month per limit, and account activity emails once per change. To ensure this, we record which email we sent to you and when. We decide whether an email is due based on your account's creation time, the number of members and seats of your organization, its plan and settings, the share counts described in Section 7, its monthly upload and API usage, the size or expiry time of a rejected request, changes to its settings and custom domain and who made them and, for share notifications, the creation, access and expiry times of tracked shares. We do not use this data for any other purpose.

You can turn off each category of these emails at any time, free of charge, on the Notifications page of the dashboard or via the unsubscribe link in every such email. We store your choice, how you made it (settings or unsubscribe link) and when. Service emails about billing, seats and the security of your account are not affected by these settings.

The legal basis is our legitimate interest in helping our customers use the Services they signed up for, in keeping their organizations' accounts secure, and in informing them about our own similar services (Art. 6 (1) (f) GDPR, § 7 (3) UWG). You can object at any time (Section 17), for example by turning these emails off as described above or by writing to hello@konfidant.app.

12. Product Updates and Newsletter

On our website you can sign up for product updates and new articles. We use the double opt-in procedure: after you enter your email address, we send you a confirmation link, and we only add your address to our mailing list once you click it. Until then, your address is only used to send this one confirmation email. When you confirm, our email provider records the time of your confirmation so that we can prove your consent. The legal basis is your consent (Art. 6 (1) (a) GDPR).

To protect the sign-up form against bots and abuse, we use Cloudflare Turnstile (Cloudflare, Inc., see Section 3). It only loads when you interact with the form, and then processes technical data about your browser and device, such as your IP address and browser characteristics, to tell people from automated requests. It does not use cookies for this. The legal basis is our legitimate interest in protecting our services and mailing list against misuse (Art. 6 (1) (f) GDPR).

When you register an account, we add your email address and name to our list of customers, to which we send information about our own similar services, such as new features and changes to Konfidant. The legal basis is our legitimate interest in direct marketing to existing customers (Art. 6 (1) (f) GDPR, § 7 (3) German Act Against Unfair Competition, UWG).

You can withdraw your consent or object to these emails at any time, free of charge and with effect for the future, via the unsubscribe link in every email or by writing to hello@konfidant.app. We manage these contact lists and send the emails through Resend (Plus Five Five, Inc., see Section 15).

13. Booking a Demo

On our website you can book a demo with us. The booking page at cal.com/konfidant is operated by the scheduling service Cal.com (Cal.com, Inc., see Section 15), which processes the booking on our behalf. Our website only links to it: no data is sent to Cal.com until you open the booking page.

When you book a demo, we process your name, email address, the time slot you choose, your time zone and any information you enter voluntarily, such as your company or what you would like to see. Cal.com sends you a booking confirmation, reminders and a calendar invitation with the link to the video call, and processes your IP address and technical request data to deliver the booking page. For cookies or similar technologies that Cal.com uses on its own pages, Cal.com's privacy policy applies.

We hold demos as video calls via Google Meet (Google Ireland Limited, with Google LLC, see Section 15). When you join, Google processes your name or display name, email address (if you join with a Google account), IP address, device and browser data, and the audio, video, screen sharing and chat you choose to share in the call, in order to provide the call. You decide whether to turn on your camera and microphone. We do not record demos.

The legal basis is the performance of pre-contractual measures taken at your request (Art. 6 (1) (b) GDPR) and our legitimate interest in presenting our Services to interested businesses and answering their questions (Art. 6 (1) (f) GDPR). Booking a demo is voluntary and not required to use the Services. You can cancel or reschedule a booking via the link in the confirmation email.

14. Documentation and Status Page

Our documentation at docs.konfidant.app is published with the documentation platform Fern (Birch Solutions, Inc., USA), and our status page at konfidant.openstatus.dev is operated by OpenStatus (see Section 15). When you visit them, these providers process your IP address and technical request data to deliver the pages. The legal basis is our legitimate interest in providing documentation and service status information (Art. 6 (1) (f) GDPR).

15. Recipients and Transfers Outside the EU

We only share personal data with the service providers listed below, to the extent necessary for the purposes described in this Privacy Policy. Where they act as our processors, we have concluded data processing agreements with them (Art. 28 GDPR). We disclose data to authorities only where we are legally required to do so; we review each request for its legal basis. We do not sell personal data.

For transfers to companies certified under the EU-U.S. Data Privacy Framework, the European Commission has determined that an adequate level of data protection exists (adequacy decision of 10 July 2023, Art. 45 GDPR). In addition, or where a recipient is not certified, transfers are based on the Standard Contractual Clauses adopted by the European Commission (Art. 46 (2) (c) GDPR). You can check certifications at dataprivacyframework.gov and request a copy of the Standard Contractual Clauses from us.

16. Retention Periods

We delete personal data as soon as it is no longer required for the purposes for which it was collected, unless statutory retention obligations apply. In particular:

• Share content (encrypted): until it is opened or its expiry time is reached (at most 30 days, depending on the plan); it is then deleted. Encrypted files that have not been opened are deleted at the latest 30 days after upload.
• Account, organization, API key and usage data, audit logs: for as long as the account or organization exists; deleted when it is deleted, unless retention obligations apply.
• Invoices and accounting records: for the statutory retention period of up to 8 years (§ 147 German Fiscal Code, AO; § 14b German VAT Act, UStG).
• Business correspondence: up to 6 years (§ 147 AO, § 257 German Commercial Code, HGB).
• Server and application logs: 14 days at the latest; Cloudflare Worker logs up to 7 days.
• Analytics data: Google Analytics 14 months; Microsoft Clarity up to 13 months; Google Ads conversion cookies and stored ad click IDs 90 days after the ad click.
• Product update and newsletter contacts: until you unsubscribe or object, or, for registered users, until the account is deleted; after unsubscribing we may keep your address on a block list so that we don't email you again.
• Demo bookings: up to 6 months after the demo, unless a contract results from it or we have to keep the correspondence under the statutory retention periods for business correspondence.
• Email preferences, records of sent reminders and notifications, and share counts: for as long as the account or organization exists.
• Consent records: for as long as we need to be able to prove consent.

17. Your Rights

Under the GDPR, you have the right to:

• access the personal data we hold about you (Art. 15 GDPR);
• have inaccurate data corrected (Art. 16 GDPR);
• have your data erased (Art. 17 GDPR);
• restrict processing (Art. 18 GDPR);
• receive your data in a structured, commonly used and machine-readable format (Art. 20 GDPR);
• withdraw any consent at any time with effect for the future (Art. 7 (3) GDPR); for cookies, via the cookie settings on our website.

To exercise your rights, email hello@konfidant.app. For data we process on behalf of a customer (Section 2), we will forward your request to the customer and support it in responding.

18. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state of your habitual residence, place of work or the place of the alleged infringement. The authority responsible for us is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61, 10555 Berlin, Germany
www.datenschutz-berlin.de

19. Further Information

Obligation to provide data: You are not legally required to provide personal data. Without the data required for registration and payment, we cannot conclude or perform a contract.

No automated decision-making: We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

Security: We protect personal data with technical and organizational measures appropriate to the risk (Art. 32 GDPR). They are described in Annex 2 of our Data Processing Agreement.

Children: The Services are intended for businesses and are not directed at children.

20. Changes to This Privacy Policy

We update this Privacy Policy when our processing or the legal requirements change. The current version is always available on this page. Postal address for privacy requests: Mustafa Serhat Dündar, Bergstraße 70, 10115 Berlin, Germany.