This notice explains which personal data Kitwerk processes, for what purposes and legal bases, who receives them, and how long they are kept.
Robert Paul Kothe Video & Foto, proprietor Robert Paul Kothe, Proskauer Straße 25, 10247 Berlin, Germany, hello@kitwerk.app, German VAT ID DE274618728.
No data protection officer has been appointed. The business has fewer than 20 persons regularly engaged in automated personal-data processing, its core activities do not consist of extensive regular and systematic monitoring, and it does not extensively process special-category data. On that basis, no appointment duty under GDPR Article 37 or section 38 of the German Federal Data Protection Act has been identified. Contact the controller at hello@kitwerk.app for privacy questions.
Kitwerk is controller for account administration, its own contracts and billing, security, abuse prevention and its own operation of public features. The role for workspace contents depends on who determines the purposes, not merely the account label. Where an operator processes other people’s data outside exclusively personal or household activities, that operator is generally controller and Kitwerk processes workspace contents on documented instructions under the DPA. This includes business, association and other non-household use. Select the corresponding account type and accept the DPA before that processing; contact support before changing the purpose of an existing personal account.
For purely personal or household activities the user's processing may be exempt; this does not exempt Kitwerk’s own processing from data-protection law. Borrower contact data may also be entered in personal accounts. A workspace operator subject to the GDPR must provide its own information to borrowers under Article 13 or, for data obtained from someone else, Article 14. Kitwerk assists with access, correction, export and deletion; it does not replace that operator’s notice.
Sold through Link, LLC acts independently for merchant-of-record purposes such as payment, tax, fraud prevention, receipts, refunds and its legal obligations. Stripe entities may also act as processors for specific technical operations.
Account data (email address, display name, handle, language and workspace role) are used to run the account and perform the contract: GDPR Article 6(1)(b).
Content data (inventory, serial numbers, photographs, documents, packing lists, loans, maintenance, experience reports and offer text) are processed to provide the selected functions: Article 6(1)(b).
Borrower data (name, email, telephone, organisation, message and period) arise when an enquiry is made or a loan recorded. For Kitwerk’s own processing, Article 6(1)(b) applies only where necessary for a contract or requested pre-contractual steps with the data subject; otherwise the applicable basis must follow the purpose, for example Article 6(1)(f) for providing and protecting the requested enquiry function. For processing on behalf of a workspace, the operator determines and documents the lawful basis.
During onboarding you can voluntarily provide your country of residence or where your business is based. It is required before buying Pro. Kitwerk stores the country code on the workspace to check whether Pro is offered there. The basis is GDPR Article 6(1)(b). Stripe collects the full billing address only during Checkout.
Kitwerk does not store full card or bank-account details. For an order, billing and access activation we send Stripe/Link in particular email, customer and workspace identifiers, plan, price and contract metadata. Checkout collects name, billing address, payment method and, if necessary, tax information. Kitwerk receives payment and subscription status, price, transaction and customer identifiers, and billing-period end. The bases are Article 6(1)(b) for the contract, Article 6(1)(c) for statutory record-keeping, and Article 6(1)(b) or (f) for payment faults or claims. Stripe/Link also processes the data independently for its payment and legal purposes.
AI product images are generated only at your request. Kitwerk records time, category and background type to manage the monthly allowance. A generated image is stored only when you choose to adopt it. If you suggest a photograph for the product catalogue, a separate copy is stored, checked and, if approved, displayed there; your original private photograph is unchanged. Account identifier and confirmation time are recorded as evidence. Basis: Article 6(1)(b).
Acceptance records contain the exact document version, acceptance time and a checksum of the wording. If configured, salted hashes of IP address and browser identifier are also stored, not the original values. These hashes are pseudonymous, not anonymous. The basis is Article 6(1)(f), the legitimate interest in proving agreement.
A stolen-equipment report is published only on the owner's separate express action. Public fields are brand, model, category, serial number, report date and optionally broad region and first name. Third-party tips are stored privately and passed to the owner. Owners' contact details are not published. A report can be ended as “found”, removed if inaccurate and objected to. The basis is Article 6(1)(f): the interest in recovering stolen equipment, limited by publishing the object, not an accused person. Search requires a specific serial number and is not a browsable register. Closed reports and tips are deleted after six months unless an investigation or court case is known, in which case deletion follows its conclusion.
Technical logs are processed for security, abuse prevention and error diagnosis under Article 6(1)(f).
Some URLs can be opened without login by anyone who knows them. Share them only with intended viewers. Public equipment lists show information marked for publication, a display name and any published contact address. QR product passes show sections released to borrowers and any published owner contact address. Shared packing lists show title, items, quantities and display name, plus published profile contact details, website and logo. A calendar feed uses a token and sends loan periods, names and organisations to the calendar application in which it is entered; the token can be renewed, invalidating the old one. Guest enquiry access uses signed expiring links. Public catalogue pages contain no individual inventory; user contributions there are visible only to signed-in users.
Providers that act on Kitwerk's behalf are covered by their applicable Article 28 GDPR processing agreements. Some providers are separately responsible for parts of their service.
Supabase provides database, login and file references. The production database is configured for a European region; the deployment and applicable provider contracts determine processing locations. Supabase, Inc. is based in the United States; standard contractual clauses apply to support or operational access that cannot be confined to Europe.
Cloudflare stores media in R2 with EU jurisdictional restriction and provides Turnstile bot protection. It processes file storage on our behalf. For some bot-detection signals Cloudflare is independently responsible. Turnstile does not set a recognition cookie or create a usage profile. Standard contractual clauses apply where Turnstile processing is transferred outside the EU.
Stripe/Link provides hosted Checkout, Managed Payments, subscriptions, tax calculation in covered locations, receipts, invoices, refunds and payment support. Sold through Link, LLC is merchant of record; involved Stripe companies may include Stripe Payments Europe, Limited and Stripe, Inc. Stripe/Link receives the order and payment data described in section 3. It can act as processor for individual technical operations and independently as merchant of record for payments, tax, fraud prevention and its own legal duties. Data may be transferred to the United States. Stripe explains applicable transfer safeguards and rights at https://stripe.com/privacy. Link sends payment receipts and invoices directly to customers.
Vercel operates and delivers the web application. Vercel, Inc. is in the United States. The execution region depends on deployment configuration; operational and log data may be processed outside the EU. Vercel acts as processor for hosted content and independently for its own operational data. Standard contractual clauses apply to US transfers.
Resend sends the application's transactional emails. Resend, Inc. is in the United States. Account data, metadata, logs and messages may be stored there even when sent through a European region. Standard contractual clauses apply.
Photon, the public photon.komoot.io instance of komoot GmbH, Alte Jakobstraße 79/80, 10179 Berlin, provides optional address search. Typing in the address field sends the browser's IP address and query directly to Photon; Kitwerk receives only the selected result. Photon is independently responsible. Address suggestions are off until selected in the address field; manual entry without enabling them does not query Photon. The Kitfinder place-search function also sends its entered place query and browser IP to Photon.
OpenAI is used only on express invocation of an optional AI function: packing-list plausibility, CSV import assistance or creation of a product image. Text inputs are stripped of direct identifiers before transmission, but are not made anonymous. A selected equipment photo and background for image generation are resized and stripped of embedded metadata. Images are automatically checked to reject pictures of people. If configured, only a salted security value derived from the account ID is sent; the account ID itself is not sent to OpenAI. API inputs are not used for training unless the API customer explicitly opts in; Kitwerk does not authorise that use. Responses requests set store=false to avoid persistent response storage. This does not disable abuse monitoring: content may be retained for the standard period of up to 30 days and longer in applicable legal or safety cases. Safety checks themselves send images to OpenAI, including images subsequently rejected. Potential child-abuse imagery can be retained for review even under stricter retention controls. Kitwerk does not promise zero retention or EU-only processing. The provider is OpenAI Ireland Limited. Standard contractual clauses apply to transfers to the United States.
Essential storage: Supabase session cookies (`sb-<project>-auth-token`) support signed-in access until logout, at most one year. `kw-consent` records banner choices and time for 180 days. `kw-prefs` records view settings for one year. `NEXT_LOCALE` records the chosen language for one year. The first are available to Kitwerk's server and Supabase as needed; the others are read by Kitwerk, including in the browser where indicated. Vercel Web Analytics sets no cookie and loads only after consent.
Kitwerk stores recent searches, view settings, an offline input queue and local working documents, images and media caches for Setwerk, Scriptwerk and Syncwerk in local storage or IndexedDB to provide the functions you request. Synced content is also transferred to your workspace; local-only media is not automatically uploaded. They stay there until browser deletion; your queued inputs are sent when connectivity returns. This is storage of your own entries, not additional tracking.
You can withdraw consent at any time for the future. Processing before withdrawal remains lawful. Banner choices can be changed on the privacy page.
Account data and content are kept while the account exists. After deletion, legally required records, content lawfully received or taken over by others, and data needed for claims may remain. Backup copies are overwritten during their backup cycle. Tax invoices are retained for eight years; books, accounting records and some other documents for ten years; other records required by law for six years. Account-use acceptance evidence is kept while the account exists and for three years from the end of the year of closure. Pro order evidence is kept for three years from the end of the year the subscription ends. A documented legal hold may extend this only for an open claim; evidence is deleted after the hold and applicable period end. Order evidence includes the contact email, exact documents and prices and the confirmation; it is separate from tax records.
You may request access, correction, erasure, restriction, portability and objection to processing based on legitimate interests. Inventory export, accepted documents and account deletion remain available at /account without accepting new terms; copies of other data may be requested by email. You may complain to the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, Germany, +49 30 13889-0, mailbox@datenschutz-berlin.de, or to the authority of your habitual residence or workplace.
Vercel Web Analytics runs only after consent. It measures page, referrer, country and approximate region/city where supplied, device and browser without cookies, retained IP address or cross-device recognition. A one-day hash associates one visit and cannot be reversed. Basis: Article 6(1)(a) GDPR and section 25(1) TDDDG. Consent can be withdrawn on the privacy page.
Apple provides the optional “Sign in with Apple” login. On your request, authentication exchanges an account identifier, email (possibly an Apple relay address) and, where supplied, name with Supabase/Kitwerk. Apple processes its own login and security operations independently under its privacy notice at https://www.apple.com/legal/privacy/. Kitwerk uses the returned data to establish your account under Article 6(1)(b); Apple may process data internationally under its applicable safeguards.
Copies or details of the applicable transfer safeguards and provider processing agreements may be requested at hello@kitwerk.app, with confidential parts redacted where necessary.
Where processing occurs outside the EU, it relies on an EU adequacy decision or European Commission standard contractual clauses as applicable. Stripe's specific roles and safeguards are explained in its linked notice.