Privacy Policy
Status: January 2026
1. General information
1.1 Scope
This Privacy Policy applies to the use of our website and web app (“KIsy”), including all related pages, features and content, in particular registration, login and the use of AI-based learning chats.
1.2 Controller
The controller within the meaning of the GDPR is:
KIsy Coaching GmbH i. G.
Am Dornbusch 17
37297 Berkatal
Hesse, Germany
Email: info@kisy.io
Note: “i. G.” means “in formation”. Once registered with the commercial register, we will update the company details accordingly.
1.3 Privacy contact / Data Protection Officer
We are currently not legally required to appoint, or have not (yet) appointed, a Data Protection Officer. You can contact us for any privacy-related request at:
Privacy contact: datenschutz@kisy.io
1.4 Updates
We continuously improve KIsy. This may require updates to this Privacy Policy. We always publish the latest version on this page.
2. What data do we process when you use KIsy?
2.1 Account, contract and usage data
When you register, subscribe and use the web app, we may process the following data (depending on your usage):
- Account data: email address, password (hashed), optional display name/profile info, settings.
- Subscription/contract data: plan/term, status (active/cancelled), timestamps, payment status, invoices/receipts.
- Chat and content data: your inputs (“prompts”), uploaded content (e.g., images), generated answers (“outputs”) and metadata (timestamps, selected coach, technical assignment).
- Quota/usage budget data: progress of a usage/quota budget (e.g., 0–100%), notification status (e.g., warning at 80%).
- Support/communication data: emails/support requests and related metadata.
Purposes: providing the service, account management, contract performance, billing, support, abuse/security prevention, quality assurance and product improvement.
Legal bases: Art. 6(1)(b) GDPR (contract/pre-contract), Art. 6(1)(c) GDPR (legal obligations), Art. 6(1)(f) GDPR (legitimate interests, e.g., security and product improvement). Where we ask for consent, Art. 6(1)(a) GDPR applies.
2.2 Retention and deletion (especially chats)
We store personal data only as long as necessary for the respective purposes or as required by law.
- Chats: chat histories are generally stored until you (or a parent/guardian) delete them in the web app or the account is deleted. Deleted chats are removed server-side as well.
- Account/contract data: stored for the duration of the account/contract; billing records may be kept longer due to statutory retention obligations.
- Support communication: until final processing and, where necessary, for documentation.
Backups: we do not create separate “chat archives” as dedicated backups of chat content. However, technical infrastructure redundancy/backups may exist for short periods (e.g., for resilience) and will be overwritten according to defined cycles.
2.3 Server logs
When you access the website/web app, we automatically process technical log data: IP address, date/time, requested resource, referrer URL, user-agent (browser/OS) and status codes.
Purpose: technical delivery, stability, IT security, troubleshooting/attack prevention. Legal basis: Art. 6(1)(f) GDPR (legitimate interests).
Retention: typically up to 14 days (unless a security incident requires longer retention).
2.4 Payments (Stripe)
We use Stripe for payment processing. Stripe processes the data necessary for the payment (e.g., name, email, payment details, transaction and invoice information). Depending on the chosen method (e.g., card, SEPA, Apple Pay, Google Pay), additional data may be required.
2.5 Product analytics (Matomo – as anonymous as possible)
We want to understand and improve KIsy (e.g., which features/coaches are used, returning users, coarse location such as country/city). For this purpose, Matomo (self-hosted) may be used.
Important: we intend to configure Matomo in a way that does not set marketing/tracking cookies (“cookieless”), anonymises IP addresses and does not build cross-site profiles.
Purpose: product analytics, performance and error analysis, service improvement. Legal basis: Art. 6(1)(f) GDPR (legitimate interests) where no device storage/access is involved. If consent becomes required in the future, we will ask for it upfront (Art. 6(1)(a) GDPR).
Opt-out: where technically available, we will provide an opt-out and/or respect “Do Not Track” depending on configuration.
3. Contacting us
3.1 Contact channels
If you contact us (e.g., by email or via a support feature), we process the data you provide to handle your request.
3.2 Data categories
Depending on the request: name, email, message content, attachments, and technical metadata (e.g., timestamp, IP address for forms).
3.3 Retention
We store communication data only as long as necessary to process your request and as long as no statutory retention obligations apply.
3.4 Obligation to provide data
You are not obliged to contact us. However, without the necessary information we may not be able to respond.
4. Minors
4.1 Minimum age
KIsy is intended for users aged 13+. If you are under 13, you must not use KIsy. If we become aware that we processed data of a child under 13 without valid consent, we will delete such data as required by law.
If you are a parent/guardian and believe a child under 13 submitted data without permission, please contact: datenschutz@kisy.io.
4.2 Parental/guardian consent
Minors may only use KIsy with the consent of their parent(s)/guardian(s). We may take reasonable steps to verify such consent where appropriate.
5. Data sharing / recipients
5.1 Principle
We share personal data only where required for contract performance, where legally required, where you have consented, or where we have legitimate interests and no overriding interests oppose it. We also use processors under Art. 28 GDPR.
5.2 OpenAI (AI functionality)
For AI functionality we use OpenAI services. Your inputs (text, images) are transmitted to OpenAI to generate an answer. Depending on the technical setup, technical metadata may also be processed.
Purpose: providing AI responses (contract performance).
Legal basis: Art. 6(1)(b) GDPR and, where necessary, Art. 6(1)(f) GDPR (security/quality).
5.3 Stripe (payments)
We use Stripe to process payments. Stripe processes payment and billing data for this purpose. Stripe’s privacy information also applies.
5.4 Hosting (AWS – EU)
We use Amazon Web Services (AWS) for hosting and operating the service. Processing is configured to take place in an EU region (e.g., Frankfurt), to the extent we configure it accordingly. AWS processes data as a processor under Art. 28 GDPR.
5.5 Transfers to third countries
For certain service providers, processing outside the EU/EEA may occur or cannot be excluded. Where required, we ensure appropriate safeguards (e.g., adequacy decision, Standard Contractual Clauses). If this is not possible, transfers may exceptionally rely on your explicit consent.
5.6 Necessity
Without certain processing activities (e.g., hosting, AI provider, payment provider) we cannot provide KIsy. You cannot opt out of these if you want to use the service.
6. Cookies and similar technologies
6.1 General
For operating the web app, technically necessary cookies or similar technologies may be used. You can delete or disable cookies in your browser settings. If you disable cookies, functionality may be limited.
6.2 Technically necessary cookies
We use only cookies that are necessary for secure operation and core functionality (e.g., session/login cookie, security/CSRF cookie, language settings).
6.3 Optional cookies / tracking cookies
At present, we plan not to use optional tracking or marketing cookies. If we introduce optional cookies in the future, we will obtain consent where required.
6.4 Consent banners
Our goal is a smooth user experience without recurring cookie pop-ups. If consent prompts are legally required, consent will be stored so that you are not asked again on every visit, and you can change/withdraw your choice at any time.
7. Your rights
7.1 Data subject rights
You may have the following rights (depending on requirements):
- Access (Art. 15 GDPR)
- Rectification (Art. 16 GDPR)
- Erasure (Art. 17 GDPR)
- Restriction (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection (Art. 21 GDPR)
- Withdrawal of consent at any time (Art. 7(3) GDPR)
7.2 Right to lodge a complaint
You have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority competent for us is, in particular:
The Hessian Commissioner for Data Protection and Freedom of Information (HBDI)
Gustav‑Stresemann‑Ring 1
65189 Wiesbaden
Germany
Email: poststelle@datenschutz.hessen.de
8. How to exercise your rights
8.1 Contact
For privacy requests (access, deletion, objection, etc.), please contact us preferably via: datenschutz@kisy.io.
8.2 Identity verification
To prevent misuse, we may request reasonable identity verification for sensitive requests. Please include information that allows us to match your request to your account (e.g., your registered email address).
8.3 Quick note
In many cases, a short email with your request and your registered email address is sufficient. A single email to datenschutz@kisy.io is generally enough.