Legal

Privacy Policy

Contents

The following privacy policy informs you about the nature, scope, and purposes of the collection and use of personal data when using this website and our mobile app “KudTax” (iOS and Android), as well as your rights.

I. Responsible for Data Processing (hereinafter: "we")

KudTax GmbH

Mertensstr. 26

13587 Berlin, Germany

Further details and contact options can be found in our provider identification (in the so-called imprint).

II. Personal Data, Purposes of Their Processing, and Legal Bases

Personal data are all information relating to an identified or identifiable natural person (hereinafter referred to as "data subject"). An identifiable natural person is considered to be one who can be directly or indirectly identified, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more specific features that express the identity of that natural person.

Personal data is processed on our website when this is necessary for the following purposes:

⦁ based on your request and given consent (Legal basis: Article 6(1)(a) of the General Data Protection Regulation – hereinafter: GDPR),

⦁ for the use of the website (Legal basis: Article 6(1)(b) GDPR),

⦁ to safeguard our interest in improving user experience, promoting our services, and/or maintaining the security of use (Legal basis: Article 6(1)(f) GDPR),

⦁ for the use of the services offered on the website as well as for pre-contractual measures, particularly for your inquiries (Legal basis: Article 6(1)(a) and/or Article 6(1)(b) GDPR),

⦁ for concluding and executing a contract (Legal basis: Article 6(1)(b) GDPR) and/or

⦁ to fulfill a legal obligation to which we are subject (e.g., tax or data protection regulations and retention obligations, Legal basis: Article 6(1)(c) GDPR).

Further details on data processing can be found below under the corresponding headings:

1. Access Data / Server Logfiles

When you visit our website, the servers of our website host automatically store the information that your browser sends, so-called server logfiles. Further information from our hoster on this can be found here: https://docs.hetzner.com/de/general/general-terms-and-conditions/data-privacy-faq/

The information includes the following: ⦁ Referrer (previously visited website) ⦁ Requested website or file ⦁ Browser type and browser version ⦁ Operating system used ⦁ Amount of data transferred ⦁ Type of device used ⦁ Time of access ⦁ IP address

The temporary processing of this data by the system is necessary to enable the delivery of the website to your device. For this, the IP address must be processed in particular. A combination of this data with other data sources does not take place. The information is used exclusively to monitor our own website traffic and to maintain the technical operation of the servers and network of our host, as well as to prevent abuse. For the storage period of technical logs, see IV below. The legal basis is Article 6 Paragraph 1 Sentence 1 Letter f GDPR.

2. Cookies

Our website uses technically necessary cookies to provide the basic functions of the website (§ 25 Abs. 2 Nr. 2 TDDDG, Article 6(1)(f) GDPR). Optional services in the categories Statistics (Google Analytics 4) and Marketing (Google Ads conversion tracking, LinkedIn Insight Tag, OpenAI Ads pixel, attribution) are loaded solely after your consent in the cookie banner. Which cookies and services are used in detail, with which lifetimes and on which legal basis, is described in our Cookie Policy. Other technologies such as local storage or similar storage techniques are not used unless explicitly mentioned below.

Name

Provider Domain

Purpose

Legal basis

Duration

Info

Insofar as you give consent for optional services, non-essential cookies, the legal basis is § 25 Abs. 1 TDDDG, Article 6(1)(a) GDPR (consent). For this and for the cookies or services used, you can find further information in our Cookie Policy; you can withdraw your consent at any time, freely and without disadvantage, with effect for the future via the "Cookie settings" link in the footer. Please note, however, that our website does not always function as intended without the cookies used.

Most browsers also have an option that restricts or completely prevents the saving of cookies. However, it is pointed out that the use and particularly the user experience will be limited without cookies.

Instructions for the most common browsers:

Mozilla Firefox: https://support.mozilla.org/en/kb/Blocking%20cookies

Google Chrome: https://support.google.com/accounts/answer/61416?hl=en

Apple Safari: https://support.apple.com/de-at/HT201265

Microsoft Edge: https://support.microsoft.com/de-de/help/4468242/microsoft-edge-browsing-data-and-privacy-microsoft-privacy

3. Contact via email or other means as well as registration

If you send us inquiries via email or other means, your information, including the data you provide (such as name, email address, message content), will be processed for the purpose of handling the inquiry and, if necessary, for follow-up questions.

If you register on our website, we additionally process the data you provide, such as username, password (in encrypted form), and possibly other voluntary information (e.g., phone number, address) for the creation and management of your user account. This data is required for the provision of the service and for the execution of the contract. The legal basis is Article 6(1)(b) GDPR. Optionally provided data is processed based on your consent, Article 6(1)(a) GDPR. The legal basis is Article 6(1)(b) GDPR and/or in the case of consent Article 6(1)(a) GDPR.

Registration for the KudTax platform (application for use): When you register via kud.tax we process your mandatory details (name, business e-mail address, company name), voluntary details (VAT ID, website/shop URL, sales platforms used, monthly order volume), technical data (IP address, time of registration and e-mail confirmation, country of request, user agent) and consent records (accepted versions of the GTC and the DPA with timestamps, and any consent to receive product news). Legal bases are Art. 6(1)(b) GDPR (review of the application, pre-contractual steps), Art. 6(1)(f) GDPR (prevention of abuse, bots and fraud; IT security) and, where given, Art. 6(1)(a) GDPR (revocable at any time).

To prepare the decision we use supporting technical checks: Cloudflare Turnstile spam protection, e-mail domain checks (e.g. MX records, disposable addresses), reachability checks of a provided website, and validation of a provided VAT ID via the European Commission's VIES system. These checks produce an internal assessment that assists our staff; no decision is based solely on automated processing within the meaning of Art. 22 GDPR — activation is always decided by a human. Recipients in the context of registration are our hosting provider (Hetzner Online GmbH, Germany), Cloudflare, Inc. (spam protection/CDN), our e-mail delivery service (Google Ireland Limited) and — only where a VAT ID is provided — the European Commission (VIES). Unconfirmed registrations are deleted no later than 30 days after receipt; rejected applications are deleted or anonymised no later than 6 months after the decision; upon activation the details become part of your contract and account data.

Attribution at registration: To understand how prospective customers find us, we additionally record the context of your visit when you submit the registration or demo form: the campaign parameters of the address you arrived on (utm_source, utm_medium, utm_campaign, utm_term, utm_content, any partner code ref, and advertising-network click identifiers such as gclid, msclkid, fbclid, li_fat_id, oppref), the page you arrived on, and the referring website. This information forms part of your application and is used solely to measure our own advertising and to process the application; the legal basis is Art. 6(1)(f) GDPR (legitimate interest in measuring the success of our own advertising). For this attribution capture itself, no third-party services are involved, no cross-device recognition takes place, and no profile about you is created. Separately from this — and only with your consent to the Marketing category in the cookie banner — we use Google Ads conversion tracking, the LinkedIn Insight Tag and the OpenAI Ads pixel to attribute the completion of a registration or demo request to a Google Ads, LinkedIn or ChatGPT advertisement; details can be found in our Cookie Policy.

Your device is only accessed (a cookie stored) for this purpose if you consented in the cookie banner: in that case we store the context of your first visit for 90 days in a single first-party cookie (_ktx_attr, SameSite=Lax) so that a later visit can be attributed to its original source; the legal basis for that storage is § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. Without your consent nothing is stored on your device — only the context of the visit in which you submit the form is evaluated. If you withdraw your consent, the cookie is deleted on your next page view. The recorded information is subject to the same deletion periods as the rest of the application.

4. Integration of Services and Content from Third Parties

It may occur that within our online offering, content and services from third parties are integrated or loaded from other websites. This always requires that the providers of these contents perceive the users' IP addresses. Because without the IP address, they could not send the content to the user's browser. The IP address is therefore required for the display of this content. We strive to use only those contents whose respective providers use the IP address solely for the delivery of the content. Third-party providers may store the IP address, for example, for statistical purposes.

We partially integrate the following services and content from third parties, for which you can also view additional service providers and information at any time in our consent tool (icon/footer) and revoke consents:

Consent management (cookie banner)

We manage your consent to optional services with our own cookie banner hosted on our website. No external consent service is embedded; your decision is stored solely in the cookie "CookieConsent" on your device (lifetime 150 days) and is not transmitted to third parties. None of the optional services is loaded before your decision. You can change your selection at any time via the "Cookie settings" link in the footer.

The legal basis is our legitimate interest in consent management and the obligation to demonstrate consent, Article 6(1)(f) and (c) GDPR, § 25(2) TDDDG.

Content Delivery Network (CDN)

We use the Content Delivery Network (CDN) from Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (https://www.cloudflare.com). A content delivery network is a network of regionally distributed servers connected via the internet, used to deliver content – particularly media files, scripts, and stylesheets. This allows us to display our content on our website faster and more reliably, optimizing the user experience. The following categories of data are processed: IP address, timestamp, time and date, user agent, visited website, amount of data transferred. Legal basis is Article 6(1)(f) GDPR (legitimate interest in optimizing website performance and security). If you give your consent, the legal basis is Article 6(1)(a) GDPR. You can revoke your consent at any time via the "Cookie settings" link in the footer with effect for the future. The data transfer to the USA is based on the EU-US Data Privacy Framework (https://www.dataprivacyframework.gov). For more information, please refer to Cloudflare's privacy policy: https://www.cloudflare.com/privacypolicy/.

JavaScript Libraries

We use the following JavaScript libraries to enhance the functionality and user-friendliness of our website:

Framer Motion

The legal basis is Article 6(1)(f) GDPR (legitimate interest in providing a functional and user-friendly website).

Statistics and Evaluation

We use the following tools to analyze and evaluate user behavior in order to optimize our website:

We use Google Analytics (version: Google Analytics 4), a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"), to analyze user behavior and optimize our website. The following data is processed:

IP address (anonymized by truncation before storage), visited pages, duration of stay, click paths, device information (e.g., browser type, operating system), approximate location (at city level)

The data is stored for a maximum of 14 months and then automatically deleted. IP anonymization is activated, so your IP address is shortened within the EU/EEA before it is further processed. A transfer to the USA only takes place based on the EU-US Data Privacy Framework (https://www.dataprivacyframework.gov).

Legal basis: Your consent in accordance with Article 6(1)(a) GDPR and § 25(1) TDDG. You can revoke your consent at any time via the "Cookie settings" link in the footer or prevent data collection by Google Analytics by installing the browser add-on to disable Google Analytics (https://tools.google.com/dlpage/gaoptout).

For more information, please refer to Google's Privacy Policy: https://policies.google.com/privacy.

Google Tag Manager

We use Google Tag Manager, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"), to manage tracking and analysis tools (e.g., Google Analytics) as well as other services on our website. The Google Tag Manager loads the corresponding scripts, which are only activated after your consent. Your IP address is transmitted to Google to deliver the scripts. A transfer to the USA only takes place based on the EU-US Data Privacy Framework (https://www.dataprivacyframework.gov).

Legal basis: Your consent in accordance with Article 6(1)(a) of the GDPR and § 25(1) of the TDDDG. You can withdraw your consent at any time via the "Cookie settings" link in the footer.

For more information, please refer to Google's Privacy Policy: https://policies.google.com/privacy.

Google Ads conversion tracking

We use Google Ads conversion tracking, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"), to measure whether a registration or demo request originated from a Google Ads advertisement placed by us. The tracking is loaded via the same Google tag as Google Analytics and only becomes active after your consent; without consent, no Google service is loaded and no conversion is transmitted. In doing so, information about the ad click (e.g. a click identifier), device and browser information as well as the fact of completion (registration or demo request) may be processed, in particular. A transfer to the USA only takes place based on the EU-US Data Privacy Framework (https://www.dataprivacyframework.gov).

Legal basis: Your consent in accordance with Article 6(1)(a) of the GDPR and § 25(1) of the TDDDG. You can withdraw your consent at any time via the "Cookie settings" link in the footer.

For more information, please refer to Google's Privacy Policy: https://policies.google.com/privacy.

LinkedIn Insight Tag

We use the LinkedIn Insight Tag, a service of LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland ("LinkedIn"), to measure whether a registration originated from an advertisement we placed on LinkedIn, and to address visitors of our website on LinkedIn as an audience for our advertisements (retargeting). The Insight Tag is only loaded after your consent to the Marketing category; without consent no connection to LinkedIn is established. Once loaded, the page accessed, the referring page, your IP address (truncated or hashed according to LinkedIn), device and browser information, a timestamp and – for LinkedIn members – LinkedIn cookies may be processed, in particular. We receive only aggregated reports from LinkedIn with no reference to individual persons. A transfer to LinkedIn Corporation in the USA takes place on the basis of the EU-US Data Privacy Framework (https://www.dataprivacyframework.gov).

Legal basis: Your consent in accordance with Article 6(1)(a) of the GDPR and § 25(1) of the TDDDG. You can withdraw your consent at any time via the "Cookie settings" link in the footer. LinkedIn members can additionally disable advertising based on website visits here: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

For more information, please refer to LinkedIn's Privacy Policy: https://www.linkedin.com/legal/privacy-policy.

OpenAI Ads pixel (advertising in ChatGPT)

We use OpenAI's measurement pixel, a service of OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland ("OpenAI"), to measure whether a registration or a demo request originated from an advertisement we placed in ChatGPT. The script is only loaded after your consent to the Marketing category; without consent no connection to OpenAI is established.

After consent, the script reads a click identifier ("oppref") from the address through which you reached our site and stores it in the first-party cookie __oppref on kud.tax. Only the events we trigger are transmitted to OpenAI — a completed registration or a demo request — together with that click identifier, the timestamp and the origin of the page, as well as the data technically associated with the request (in particular IP address, device and browser information). Page views are not reported. OpenAI's automatic advanced matching is, however, active: the script reads information you enter into forms on this website — in particular e-mail address, telephone number, first and last name, region and postal code — and derives a SHA-256 hash from it in your browser, which is transmitted together with the event; the plain-text values do not leave your browser. OpenAI can match that hash against its own user data in order to improve attribution to an advertisement. A hash remains personal data and is transmitted solely on the basis of your consent. We receive only aggregated reports. Processing in the USA takes place on the basis of OpenAI's Ad Tools Data Processing Addendum (standard contractual clauses).

Legal basis: Your consent in accordance with Article 6(1)(a) of the GDPR and § 25(1) of the TDDDG. You can withdraw your consent at any time via the "Cookie settings" link in the footer; the __oppref cookie is deleted in the process.

For more information, please refer to OpenAI's privacy policy: https://openai.com/policies/eu-privacy-policy/.

5. Payment Service Provider

For processing payments, we use the service Stripe, provided by Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland ("Stripe"). Stripe processes the following data that you provide during the payment: name, email address, billing address, payment data (e.g., credit card or bank account information), order number, transaction amount, date and time of the transaction.

Stripe acts as an independent controller for payment processing, and we have concluded a data processing agreement (DPA) with Stripe for processing related to our platform. Data transfer to the USA (Stripe Inc.) is carried out based on the EU-US Data Privacy Framework (https://www.dataprivacyframework.gov).

Legal basis: Article 6(1)(b) GDPR (performance of a contract) and Article 6 paragraph 1 subparagraph letter c GDPR (legal obligations).

For more information, please refer to Stripe's privacy policy: https://stripe.com/de/privacy

The following payment options can be enabled through the service provider Stripe:

⦁ PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (https://www.paypal.com/de/webapps/mpp/ua/privacy-full),

⦁ Giropay, paydirekt GmbH, Stephanstraße 14-16, 60313 Frankfurt am Main (https://www.giropay.de/agb/);

⦁ Apple Pay, Apple Inc., Infinite Loop, Cupertino, CA 95014, USA, (https://www.apple.com/de/legal/privacy/data/de/apple-pay/ / https://www.apple.com/legal/privacy/de-ww/)

⦁Google Pay by Google. Google refers to Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA, and its affiliated companies. (https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=de / https://policies.google.com/privacy)

⦁ VISA from Visa Inc.; for the EU/EEA area, Visa Europe Services Inc., 1 Sheldon Square, London W2 6TT, GB, is responsible (https://www.visa.de/legal/privacy-policy.html / https://www.visa.de/nutzungsbedingungen/visa-globale-datenschutzmitteilung/mitteilung-zu-zustandigkeitsfragen-fur-den-ewr.html)

⦁ Mastercard, Mastercard Europe SA, Chaussée de Tervuren 198A, B-1410 Waterloo (https://www.mastercard.de/de-de/datenschutz.html) In this regard, we refer to the privacy notices and the terms and conditions provided there. The chosen payment service receives the information you provide during the payment process. This generally includes your name, your payment details (e.g., credit card or account information), the order number, and the transaction amount, as well as any additional information such as transaction IDs or device data, depending on the provider. For data processing in the context of payment processing, the payment service provider is the responsible entity.

Legal basis is Article 6(1)(b) GDPR (pre-contractual measures, contract fulfillment) as well as 6 paragraph 1 subparagraph 1 letter f and c GDPR (legitimate interest and legal proof obligations). We fulfill a contract with you and have a legitimate interest in the payment functionalities, to be able to offer you effective, widespread, and secure payment options and a modern online shop functionality, Article 6(1)(f) GDPR.

We only receive the minimum necessary data for confirmation and processing (e.g., last four digits of card numbers).

6. Use of our mobile app "KudTax" (iOS and Android)

This section applies to our mobile app KudTax (package identifier com.kudtax.app), available from the Apple App Store and Google Play. It supplements the preceding sections; unless stated otherwise, those sections apply accordingly.

The app is an entry point to the same user account you use in your browser. It processes no business data other than the web application does — it additionally offers features that require your device's camera, photo library and microphone. Those forms of access are explained individually below.

a) Camera

The app requests access to the camera so that you can photograph invoices and receipts or scan them with the built-in document scanner (VisionKit on iOS, ML Kit on Android). Access occurs only when you invoke the corresponding feature yourself; the camera is never activated in the background. The capture is processed on your device and then transmitted to our servers in the same way as a receipt you upload yourself (see letter f).

Legal basis: Article 6(1)(1)(b) GDPR (use of the service you have requested).

b) Photo library

If you wish to upload a receipt you already have, the app opens your operating system's picker. We receive only the file you select there, together with its file name. We do not access, browse or index your entire library. On Android the app does not request permission to read the media library for this purpose.

Legal basis: Article 6(1)(1)(b) GDPR.

c) Microphone and speech recognition

In the AI assistant you may dictate your question instead of typing it. The microphone is activated only while you have started dictation yourself, and recording ends automatically after a pause in speech.

To convert speech into text the app uses your operating system's speech recognition service (Apple or Google). Whether that recognition takes place on your device or on the respective provider's servers is decided by the operating system depending on device, system version and selected language; in the default configuration transmission to the provider is possible. The respective provider is the controller for that processing and its privacy notices apply.

We ourselves store no audio recordings. Only the recognised text reaches our servers, and only once you send the question. Please do not dictate content you would not want to disclose to a speech recognition provider; you may type instead at any time.

Legal basis: Article 6(1)(1)(a) GDPR (your consent by granting the permission and starting dictation); you may withdraw the permission at any time in your system settings (see letter j).

d) Data stored on your device

After sign-in the app stores your session credentials (access and refresh tokens together with their expiry) in your operating system's protected key store — the Keychain on iOS, the Android Keystore on Android. These credentials leave your device only as proof of identity towards our servers and are deleted when you sign out. The app additionally stores local preferences such as your chosen language and the client you last selected.

This storage is strictly necessary for the operation of the app you have expressly requested; without it you would have to sign in again on every launch.

Legal basis: Article 6(1)(1)(b) GDPR; Section 25(2) no. 2 TDDDG.

e) Sign-in

Sign-in takes place either through a form in the app or through the standard OAuth 2.0 procedure with PKCE, which runs in your device's system browser (not in an embedded window). Your email address and password are processed for the purpose of authentication. A password is not stored persistently on the device.

Legal basis: Article 6(1)(1)(b) GDPR.

f) Processing of uploaded receipts

Before uploading, the app reduces the capture on your device (longest edge 2,500 pixels) and combines multi-page scans into a single PDF file there. Receipts you photograph or select are then stored on our servers and then pass through an automated processing chain: format conversion, text extraction, thumbnail generation, optical character recognition (OCR) and automatic detection of invoice fields (such as amount, date, invoice number and counterparty). The text recognition runs on a service we operate ourselves; the image of your receipt is not transmitted to a third-party OCR service for this purpose.

For the automatic detection of invoice fields we transmit the content of the receipt, or the text obtained from it, to a language model provider (see letter g). If you do not want this, please enter the receipt manually.

Legal basis: Article 6(1)(1)(b) GDPR.

g) AI assistant and transmission to language model providers

The AI assistant answers questions about your accounting data. For this purpose your input, the history of the respective conversation and those of your client's data that are necessary to answer are transmitted to a language model provider and processed there. The same applies to the automatic invoice recognition described under letter f.

The transmission may involve processing outside the European Union. We will inform you of the providers used, the legal basis for the respective transfer and any standard contractual clauses on request at info@kud.tax; Section III applies in addition.

Legal basis: Article 6(1)(1)(b) GDPR.

h) What the app does not collect

When you use the app's document scanner (Android only), Google's "ML Kit" library transmits usage and performance metrics to Google. This happens only when the scanner is invoked – not when the app starts and not during normal use. According to Google and to our own analysis of the library, the following are transmitted: the app's package name and version, the version of the library used, the device's language settings, an identifier assigned per installation, and the type, result and duration of the scanning operation. The contents of your receipts are not transmitted in this process. Transmission happens in the background, delayed and in batches. The library provides no opt-out; you can avoid the transmission by not using the document scanner and uploading receipts as a file instead. The recipient is Google Ireland Limited or Google LLC (USA); the legal basis is Article 6(1)(b) GDPR. The iOS version of the app does not use this library.

For the avoidance of doubt: beyond this, the app contains no analytics or usage measurement software of our own and no crash reporting software. It does not read an advertising identifier (IDFA or Advertising ID), processes no location data, does not access contacts or calendars, sends no push notifications and contains no advertising. We do not sell or share personal data for advertising purposes.

i) Deleting your account

You may request deletion of your account at any time. The page provided for this is reachable without the app installed:

https://app.kud.tax/account-deletion/

It describes in detail which data is deleted and which data we must retain due to statutory retention obligations — in particular accounting records under Section 147 of the German Fiscal Code (Abgabenordnung) and Section 257 of the German Commercial Code (Handelsgesetzbuch), as well as Section 132 of the Austrian Federal Fiscal Code (Bundesabgabenordnung). Section IV applies in addition.

j) Withdrawing permissions

You may withdraw permissions granted for camera, photos, microphone and speech recognition at any time with effect for the future in your operating system's settings (iOS: Settings → KudTax; Android: Settings → Apps → KudTax → Permissions). The respective feature will then no longer be available; the remaining use of the app is unaffected.

k) Technical information sent with each request

With every call to our servers the app transmits its version number and an identifier containing the device model and operating system version. We store this information as an attribute of the respective session so that you can see in your account which device a session originates from and end it specifically. The app's traffic is also routed through our service provider Cloudflare (see section 4).

Legal basis: Article 6(1)(1)(f) GDPR (security of use, session management).

l) Connecting portals, and logos

When you connect a sales portal (such as Amazon, Shopify or TikTok Shop), the app opens that provider's authorisation page in your system browser. The processing that takes place there is the responsibility of that provider. Portal credentials cannot be entered in the app, and our server does not return credentials already stored to the device.

The app loads portal logos from https://kud.tax/cdn/portal-logos/; your IP address and technical details of your device are transmitted in the process (see section 1).

m) No sign-up, no cookies, no tracking in the app

A user account cannot be created in the app; registration takes place exclusively via our website. The app sets no cookies — the consent banner used on the website does not apply there. No cross-device tracking takes place, which is why no App Tracking Transparency prompt appears on iOS.

7. AI product advisor on our website

You may voluntarily use our AI product advisor to ask questions about KudTax, its features, integrations and offers. The answers are generated automatically on the basis of the product information we provide and may contain errors.

The advisor has no access to your KudTax customer account or your accounting data. It does not register you, does not carry out bookings and does not arrange appointments for you; where appropriate, it refers you to the relevant pages instead. No individual tax or legal advice is provided.

The controller for the processing described here is KudTax GmbH as named under I. above.

Which data we process

When you send a message or select a predefined question, we process the text of your message, the previous conversation needed for the answer, the page language and the path of the KudTax page you are currently viewing. This information is transmitted via our server to the OpenAI API in order to generate an answer.

We do not transmit your IP address, browser cookies or a device identifier to OpenAI as additional information. However, personal information that you write into your message yourself may form part of the transmitted content.

Please therefore do not enter passwords, API keys, payment data, confidential customer documents or other sensitive information. Technical filters are intended to detect certain sensitive entries but cannot reliably prevent every such entry.

A message is only transmitted to OpenAI after you send it. Merely displaying or opening the advisor does not trigger a request to the AI model.

Service provider and international processing

We use the OpenAI API to generate answers. The service provider is OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland.

Processing may take place outside the European Union or the European Economic Area, in particular in the USA. The data processing agreement (Data Processing Addendum, https://openai.com/policies/data-processing-addendum/) incorporated into OpenAI's contractual terms (https://openai.com/policies/services-agreement/) governs the processing of personal data. For onward transfers, its section 4.1 provides for agreements based on the European Commission's standard contractual clauses or a relevant adequacy decision. Further details on these safeguards can be found in the linked agreement; you can also request information from us using the contact details given in this privacy policy.

According to its published information, OpenAI does not use API content to train its models by default. We do not opt in to sharing our advisor content for training purposes.

Conversation history and retention

KudTax does not keep a permanent archive of your chat messages and answers. For the ongoing conversation, the history is kept temporarily in the memory of the open page. It is not stored in cookies or in persistent browser storage. The local history is discarded when you click "Start over", reload or close the page, or move to another page.

Our API requests disable the storage of retrievable responses at OpenAI. Independently of this, OpenAI may in principle retain content in security and abuse-monitoring logs for up to 30 days. According to the provider, longer periods are possible where required by law or where necessary for protective measures. OpenAI provides further information at https://developers.openai.com/api/docs/guides/your-data.

Deleting the local history does not remove any security logs that may already exist at the service provider.

Protection against misuse and technical logs

To limit automated mass requests and excessive use, we process the IP address for time-limited usage counters. In the counter database we store a derived identifier that changes daily, not the IP address in clear text. This identifier is pseudonymised, not anonymous.

The counters apply to a ten-minute window or until the end of the respective UTC day. Expired entries are removed by the automatic clean-up on subsequent requests. In addition, we keep overall counters to limit usage and costs.

Operating the website also generates technical access and error logs, which may in particular contain IP addresses, time, requested address and response status. The logs of our application and of an upstream proxy are rotated and overwritten based on their size. The storage period therefore depends on the volume of logs generated. A further upstream proxy rotates its logs daily and keeps up to 30 archive files; on days without new entries, no rotation takes place. This does not involve a fixed deletion of all logs after seven days. In the plan we use, Cloudflare provides data for security and traffic analytics for up to 31 days. This information refers to the corresponding analytics records (https://developers.cloudflare.com/waf/analytics/security-analytics/). Sections 1 (Access Data / Server Logfiles) and 4 (Content Delivery Network) of this privacy policy apply in addition.

Purposes and legal bases

We base the answering of voluntarily asked product questions on Article 6(1)(f) GDPR. Our legitimate interest is to offer interested parties an easily accessible way to find out about KudTax.

Processing to prevent misuse and secure availability is likewise based on Article 6(1)(f) GDPR. Our legitimate interest is to protect our offering against automated or excessive use.

You are not obliged to use the advisor or to provide information in it. Without transmitting your message, the AI advisor cannot answer. The rest of the website and our other contact options remain available to you.

Statistical evaluation

Only if you have consented to statistical evaluation do we record selected usage events via our existing analytics system, for example opening the advisor, selecting a predefined question, the technical status of an answer or a click on an offered link.

Chat messages and answer texts are not transmitted as analytics events. There is no assignment to comparison groups and no linking of the conversation with your registration.

The legal basis for this optional evaluation is your consent pursuant to Article 6(1)(a) GDPR. Further information on Google Analytics, on access to your device and on how to withdraw consent can be found in section 4 under "Statistics and Evaluation".

You can use the advisor without consenting to statistics.

External appointment scheduling

The advisor may offer a link to our scheduling page at Calendly. Calendly is not embedded in the chat. We do not append conversation content or personal data to this link.

When you open the link, the Calendly website is called up. Technical access data may already be processed there at that point. You then provide any information for booking an appointment on that website. For organising appointments, Calendly's privacy notices and our information on handling contact requests (section 3) also apply.

Clicking an appointment link does not mean that an appointment has been booked.

Your rights

The rights described in this privacy policy apply (see V. and VI.), in particular the rights of access, rectification, erasure and restriction of processing as well as the right to lodge a complaint with a supervisory authority, in each case subject to the statutory requirements.

Where we process data on the basis of legitimate interests, you may object on grounds relating to your particular situation. You can withdraw your consent to statistical evaluation with effect for the future via the cookie settings.

For data protection enquiries, please use the contact options given in this privacy policy. The advisor does not make any decisions about you that have legal or similarly significant effects.

III. Recipients of Personal Data and Transfers to Third Countries

Personal data is shared with the following categories of recipients: Our employees and our processors to the necessary extent, in particular the website and hosting provider of our website, Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany, (https://docs.hetzner.com/de), and, if applicable, its respective sub-processors, depending on the service you use, as well as, if applicable, individual named service providers when using the website, see above under II. 4, 5 and 7. Furthermore, your personal data will not be disclosed to third parties without your explicit consent, unless we are legally obligated to do so or the data transfer is absolutely necessary for the performance of a contractual relationship.

A transfer to a third country may be considered when using the following services: Google (Google Analytics, Google Tag Manager, Google Ads conversion tracking, ML Kit – see section 6 h above), LinkedIn (LinkedIn Insight Tag), OpenAI (OpenAI Ads pixel, AI product advisor – see section 7 above), providers of language models for the AI features and invoice recognition (see section 6 g above), Stripe, Cloudflare (CDN, Browser Insights), Apple (Apple Pay), PayPal, Visa, Mastercard, see above under II.4 and 5 or as indicated. The data transfer is based on the EU-US Data Privacy Framework or Standard Contractual Clauses, as described for the respective services and below:

We process personal data in a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)) when it is necessary to fulfill our (pre)contractual obligations, based on your consent, due to a legal obligation, or based on our legitimate interests. The same applies to processing by third parties on our behalf, the disclosure of personal data to third parties, as well as their transfer to third parties. Service providers who process personal data on our behalf in a third country will only be engaged if there is an "adequacy decision" by the European Commission for that third country (Article 45 GDPR), "appropriate safeguards" (Article 46 GDPR), "standard contractual clauses" (Article 46 paragraph 2 letter c GDPR) are agreed upon and/or "binding corporate rules" (Article 47 GDPR) are in place at the recipient. General information on adequacy decisions can be found at https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en, regarding US tools: www.dataprivacyframework.gov, on suitable guarantees as internal regulations at https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/binding-corporate-rules-bcr_en, and on standard contractual clauses at https://commission.europa.eu/publications/standard-contractual-clauses-international-transfers_de.

For further information, you can contact us.

IV. Duration of Storage

We delete personal data after the purpose has been achieved and the legal basis has ceased to exist, as well as in the absence of a retention obligation. Technical access and error logs (server log files), including IP addresses, are not deleted after a fixed period but rotated: the logs of our application and of an upstream proxy are overwritten based on their size, so the storage period depends on the log volume; a further upstream proxy keeps up to 30 archive files from daily rotation. Details, including on Cloudflare, can be found above under II. 7 ("Protection against misuse and technical logs").

Session cookies are also automatically deleted after the session ends. In addition, cookies with an expiration date are stored on your device, and you also have control over the use and deletion of cookies, as mentioned above. We process personal data from your inquiries via email or other means until your inquiry is fully processed and completed. Afterwards, the information will be deleted if there is no legal retention obligation, for example, also data protection documentation and retention obligations under Article 5 Paragraph 2 GDPR or Article 6(1)(c) GDPR. Please note that due to a legal transaction with you, certain data may be subject to commercial and tax retention obligations of at least six (§ 257 HGB) or ten (§ 147 AO) years, which can also apply to the content of contact inquiries and emails. For example, personal data collected by us is generally stored after the termination of a contractual relationship until the expiration of the statutory three-year regular limitation period (§ 195 BGB) (protection of legitimate interests: defense and enforcement of claims, Article 6(1)(f) GDPR).

In the case of registration data, we store your data as long as your user account is active. After the deletion of your account, the data will be deleted within 30 days, provided there are no legal retention obligations. A permanent deletion of customer data is possible. The users can send an e-mail to info@kud.tax herefor.

Furthermore – also with regard to all tools used and the aforementioned – an annual review will be conducted to determine whether data deletion is possible. This is the case when the purpose of processing and the conditions of the legal basis for processing have ceased to exist, and there is no longer a legal obligation to retain the data, there is no legitimate interest in defending and enforcing claims, Article 6(1)(f) GDPR applies, and you have not consented to any further storage under Article 6(1)(a) GDPR.

V. Provision of Personal Data and Rights of the Data Subjects

You are not legally obligated to provide personal data. However, providing the information may be necessary for concluding a contract or for the functions of the website. In the event of non-provision, a contract or a function on the website may therefore not be offered.

No automated decision-making or profiling takes place on our website.

The rights of affected persons arise in particular from Articles 15 to 23 and Article 77 GDPR as well as from Sections 32 to 37 of the Federal Data Protection Act (new).

You have the right, with regard to your personal data, to

∙ Access, Article 15 GDPR,

∙ Rectification, Article 16 GDPR,

∙ Erasure, Article 17 GDPR,

∙ Restriction of processing, Article 18 GDPR,

∙ Data portability, Article 20 GDPR, provided the legal requirements are met. If you have given consent for the processing of personal data, you have the right to withdraw it, Article 7 GDPR, with effect for the future. The legality of the processing carried out based on the consent until the withdrawal remains unaffected.

You also have the right to object to the processing of personal data

∙ Objection, Article 21 GDPR

see further information separately below under VI.

Please direct all inquiries, requests, and communications to us, see above under I.

If you believe that the processing of your personal data violates data protection law, you always have the

∙ right to lodge a complaint

with the competent supervisory authority, cf. Article 77 GDPR. Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, particularly in the member state of your residence, your workplace, or the place of the alleged infringement, if you believe that the processing of your personal data violates the GDPR.

The contact details of the data protection officers in the federal states, the supervisory authorities for the non-public sector, broadcasting, churches, in Europe and the rest of the world, as well as the Virtual Data Protection Office can be found here:

https://www.bfdi.bund.de/DE/Service/Anschriften/anschriften_table.html

VI. Information on the Right to Object under Article 21 GDPR

  1. You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Article 6(1)(f) (data processing based on a balancing of interests). If you file an objection, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.

  2. If personal data is processed for the purpose of direct advertising, you have the right to object at any time to the processing of your data for such advertising purposes. If you object to the processing for the purposes of direct advertising, we will no longer process your personal data for these purposes.

The objection can be made without formal requirements and should preferably be addressed to us (see section I).

Version:1.3 Status: 10.10.2026