klixly

Privacy Policy

Last updated: 27.10.2026

This English translation is provided for your convenience. Only the German version is legally binding.

1. Controller

The controller responsible for data processing within the meaning of the General Data Protection Regulation (GDPR) is:

Heiko Stuhrmann
c/o Block Services
Stuttgarter Str. 106
70736 Fellbach
Email: hello@klixly.app

2. What data we process

2.1 When visiting public bio pages

  • View and click statistics: for each view of a bio page and each click on a link we store a timestamp, the page or link ID, the country of origin derived from your IP address, the referring page (referrer, shortened to the domain), the device type (mobile, desktop, tablet) and a hash (HMAC-SHA-256) of your user-agent string, which lets us recognise repeat visits on the same day. The hash is formed with a random key that is only valid for that day and is deleted afterwards. From then on nobody, including us, can reverse the hash, and entries from different days cannot be linked to each other. We ourselves do not store IP addresses in plain text, set no tracking cookies, and perform no fingerprinting.
  • Server logs: on every access the web server writes brief logs (time, path, status code). These are automatically deleted after a maximum of 14 days.

Legal basis: our legitimate interest in an operationally secure and analyzable platform (Art. 6(1)(f) GDPR).

2.2 When registering a klixly account

  • Email address, chosen password (stored only as a bcrypt hash)
  • Username (= default slug of your bio page)
  • Language setting, creation and last-update dates
  • Optional: 2FA secret (for TOTP), backup codes (bcrypt-hashed), passkey credentials

Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

2.3 When operating your bio page

  • Display name, bio text, profile picture, logo, background image
  • Links, embeds, newsletter/form configurations
  • Design customizations (theme, colors, fonts)

This data is generally publicly visible. You decide yourself what appears on your bio page. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

2.4 When visitors use your newsletter or contact form

  • Newsletter: email address + time of sign-up. Visible exclusively to you (the page owner) in the klixly dashboard.
  • Forms: the fields entered by the visitor (name, email, message, custom fields). Likewise visible only to the page owner.

Newsletter sign-ups use a double opt-in process: after entering their email address, the visitor first only receives a confirmation email with a link valid for 24 hours. The sign-up takes effect only once they click that link, i.e. only then does the address count as a subscriber, appear in the CSV export, and get forwarded to an external newsletter provider (if the page owner has connected one). Unconfirmed sign-ups are never forwarded. Until confirmation the address is merely held pending; if the visitor never confirms, it stays unused.

The respective page owner is responsible for the further processing of this data. klixly merely provides the infrastructure.

2.5 When someone reports a bio page (report form)

  • The reason for reporting you select + a free-text description.
  • Optional: your email address (only if you provide it, for follow-up questions).
  • A hash (HMAC-SHA-256) of your IP address, used to detect mass-report abuse. It is formed with a random daily key that is deleted at the end of the day; the IP address is not stored in plain text and cannot be recovered afterwards, not even by us.
  • Timestamp + status (open/handled/dismissed) as well as optional internal admin notes.

Legal basis: our legitimate interest in maintaining an abuse-free service (Art. 6(1)(f) GDPR).

2.6 For paid plans (Pro)

  • Handled via Polar as Merchant of Record. The operator is Polar Software, Inc., 548 Market St, PMB 99696, San Francisco, CA 94104, USA. Polar processes payment, invoicing, and tax data under its own responsibility; klixly receives only subscription IDs + status.
  • Because the provider is based in the USA, a transfer of personal data to a third country takes place. The legal basis is the EU Standard Contractual Clauses (SCC) within the scope of the data processing agreement.
  • Further documents: Privacy Policy, Data Processing Agreement (DPA). The list of the sub-processors used (including Stripe) is part of the DPA document.

2.7 For the referral program (referrals)

  • Click on a referral link(klixly.app/r/<username>): we set a first-party cookie klixly-ref containing the referring username, valid for 30 days, exclusively on our own domain. The cookie serves solely to attribute a later registration to the referring user. It contains no personal data about you and is not transmitted to third parties.
  • When registering via a referral link: we create a record that captures the referring user (referrer), the referred user (you), the time of registration, and the current status of the referral (open / qualified). Once you have confirmed your email and published a first bio page, the referral is deemed qualified.
  • Anti-abuse analysis: to detect organized account creation, we evaluate in aggregate and purely technically whether sign-ups cluster suspiciously. This analysis serves exclusively to maintain fair operation of the program. In addition, we limit the number of referral-cookie placements per IP address within a time window (in-memory counting, no persistence of the IP).
  • Reward: upon reaching the applicable threshold (currently 10 qualified referrals per Pro month), a time-limited Pro grant is automatically created for the referring user. A link between the referrer and an individual referred user is visible only internally in the database and is not disclosed publicly.
  • Retention period: referral records are kept until one of the accounts involved is deleted; the cookie automatically becomes invalid after 30 days or is deleted upon successful sign-up.

Legal basis: performance of a contract toward the referring user (Art. 6(1)(b) GDPR) as well as our legitimate interest in abuse-free operation of the program (Art. 6(1)(f) GDPR).

2.8 For connected social media accounts (Content Planner)

When you connect one of your own social media accounts in the Content Planner, we store the credentials for that connection (usually the access tokens issued by the platform via OAuth, see below for exceptions), the account identifier, and publicly visible profile information (e.g. display name, username, profile picture) so that you can create, schedule, publish, and view the associated metrics for your own account from within klixly. The tokens are stored encrypted (AES-256-GCM) and used exclusively for actions on your own account. When you disconnect, they are deleted. We never access third-party accounts. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR).

Depending on the connected platform, your data is transmitted to the respective provider; that provider’s own privacy terms additionally apply:

Comment inbox. For posts you published to Facebook, Instagram, Threads or Bluesky through the content planner, we fetch the comments below them so you can read and answer them in klixly. This involves data of the commenting persons: name, username, profile picture, comment text and time, as provided by the platform. The legal basis is, for you, the performance of a contract (Art. 6(1)(b) GDPR) and, for the commenting persons, our and your legitimate interest in being able to respond to reactions to your own posts (Art. 6(1)(f) GDPR). Comments are deleted automatically 12 months after they were published, and immediately when you disconnect the account or delete the post.

Instagram auto-DM.When you create an auto-DM rule in the content planner, we check new comments below your Instagram posts (from the comment inbox) for the keywords you set. If a comment matches, we send the commenting person a direct message from your account through Meta's Instagram interface, with the text and, if set, the link you defined. Instagram allows only one message per comment and only within 7 days. If the person doesn't follow your account, the message lands in their message requests. For each comment a rule matches, we only store the comment's identifier, its time and the outcome (sent, skipped or failed, with the reason), so that the same person never gets two messages and you can see statistics. We don't additionally store the comment text, the name or the username for this. These entries are deleted automatically after 90 days. If the message contains a link, it goes through a klixly redirect so you can see how often it was clicked. We only count the clicks per rule and store no data about the person clicking; to avoid counting repeated clicks twice, we briefly keep a daily-rotating hash of the IP address in memory, not in the database. The legal basis is, for you, the performance of a contract (Art. 6(1)(b) GDPR) and, for the commenting persons, your legitimate interest in answering a request they triggered themselves with their comment (Art. 6(1)(f) GDPR). You decide the content of the message.

Connections without central OAuth. Four platforms connect differently: for Mastodon you sign in via OAuth on your own instance; klixly registers itself as an app on that instance and receives read and write access to your account. For Bluesky we store an app password you create, for Telegramthe token of your own bot (created via @BotFather) and your channel's identifier, and for Discordthe webhook address of a channel on your server. These credentials are also stored encrypted (AES-256-GCM), used only for actions in your own account or channel, and deleted when you disconnect. Through the Discord webhook address, klixly can only send messages to that one channel and cannot read your server's messages or members.

YouTube. If you connect your YouTube account, klixly uses the YouTube API Services. By using this feature you agree to the YouTube Terms of Service; for data processing by Google, the Google Privacy Policy additionally applies.

Which YouTube API data we access and collect. klixly uses the scopes youtube.upload and youtube.readonly exclusively for your own account, in order to

  • identify your account upon connection: channel ID, channel title, and thumbnail;
  • upload videos you create to your own channel (you set the title, description, tags, category, visibility, and the “made for kids” designation yourself);
  • display, on a read-only basis, the statistics of your own videos and your channel (views, likes, comment count, subscriber count).

No data of other users and no content of third-party channels is read or modified.

What we store and for how long. Until you disconnect, we store the channel ID, the channel title, and the URL of the thumbnail as well as, encrypted (AES-256-GCM), the OAuth access and refresh tokens. The metrics of your channel and your videos (subscriber, view, like, and comment counts) we retrieve regularly and store as a time series, so that we can show you the development of your reach (e.g. subscriber growth) as a chart. This statistics history is continuously updated and automatically deleted after 180 days at the latest; if you disconnect the account, the stored metrics are removed immediately.

How we process and share the data. The YouTube API data is processed exclusively server-side, to provide you with the functions mentioned above (upload, display of your own statistics). We do not share this data with third parties, do not sell it, and do not use it for advertising, profiling, or the training of AI models. A transfer takes place only to Google itself (for API calls on your behalf) and to our hosting or infrastructure service provider, insofar as that is necessary for technical operation.

Handling of access tokens. The OAuth tokens are used only for the purposes you consented to upon connection. We retain them only for as long as the account connection exists. As soon as you disconnect within klixly, the tokens are immediately and irrevocably deleted. If you instead revoke access directly in your Google account, the stored token thereby becomes worthless; it is fully removed when you disconnect within klixly.

Revocation and deletion. You can disconnect an account at any time within klixly; the stored tokens are irrevocably deleted in the process. In addition, you can revoke klixly’s access to your Google/YouTube account at any time in the security settings of your Google account.

Contact. The controller responsible for processing this data and the point of contact for YouTube-API-related privacy requests is the provider named under section 1 (Controller), reachable at hello@klixly.app.

2.9 For donations / tips to creators (Stripe)

  • When a creator enables monetization, they can offer a donation/tip block on their bio page. The payment is processed by Stripe. klixly acts solely as the technical platform; the merchant of the transaction is the respective creator with their own Stripe account.
  • You enter the payment data (in particular card details) directly on Stripe’s hosted checkout page. klixly processes no card data; we only receive transaction metadata from Stripe (session ID, amount, platform fee, status) in order to show the creator their earnings. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR).
  • The contracting party for payment processing is Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland). Depending on the processing operation, data may be transferred to Stripe, Inc. (USA); the legal basis for this are the EU Standard Contractual Clauses (SCC). Further documents: Privacy Policy, Data Processing Agreement (DPA).

2.10 For digital products and paid links (creator shop)

Creators with monetization enabled can additionally sell digital files on their bio page („digital products“) or place individual links behind a one-time payment („paid links / paywall“). Payment is processed via Stripe just like for tips; the merchant and sole contracting party of the buyer is the respective creator (see § 5b of our T&C), not klixly.

  • Buyer email (digital products): When buying a digital product, Stripe collects the buyer’s email address at checkout. klixly receives this email solely to (a) send the download link to the buyer and (b) show the creator the sale in their earnings overview. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR).
  • No evaluation, no sharing: klixly does not evaluate buyer or customer data, does not build profiles from it, and does not use it for advertising. It is shared with third parties only insofar as technically required for delivery (email dispatch via the mail processor named in section 4), just as with payments, whose card data remains exclusively with Stripe.
  • Download link: Access to the purchased file is provided via a signed, time-limited link (valid for 7 days) that reveals neither the content nor personal data in the URL. The file itself is stored protected on our server (section 4) and is reachable only via that link.
  • Paid links (paywall): After a successful payment, klixly sets a technically necessary, signed cookie (kx-paid-<link-ID>, max. 30 days) that unlocks access to the paid destination. It contains no personal data, serves no tracking purpose, and is not transmitted to third parties (see section 3).
  • Retention: For each sale we store transaction metadata (session ID, amount, platform fee, status, and where applicable the buyer email) for settlement with the creator and to meet tax and commercial retention obligations (section 5).
  • Creator responsibility: The creator alone is responsible for the product itself, its description, the fulfilment of the purchase contract, and for any customer data the creator collects beyond this.

2.11 Audience measurement with Umami

To statistically analyze the use of our service (which pages are viewed how often, from which country and via which referrers visitors arrive, which device type or browser is used) we use Umami, open-source, privacy-friendly analytics software that we operate ourselves on our own infrastructure. Umami sets no cookies, performs no fingerprinting, and shares no data with third parties. Only aggregated statistics that cannot be traced back to you are collected; your IP address is merely processed temporarily to derive the country of origin and is not stored in plain text.

Because Umami neither stores nor reads information on your device (§ 25 TTDSG), no consent is required for this. The legal basis is our legitimate interest in a statistical evaluation and the needs-based improvement of our offering (Art. 6(1)(f) GDPR).

2.12 klixly newsletter

If you sign up for our newsletter in the footer, we process your email address and, if you provide it, your name in order to send you product updates, new features, and news about klixly. Delivery is handled via Listmonk, open-source newsletter software that we operate ourselves on our own infrastructure. Your data is not shared with external email-marketing services.

Sign-up uses a double opt-in process: after entering your address we first only send you a confirmation email. Your sign-up takes effect, and you start receiving the newsletter, only once you click the link it contains. The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time via the unsubscribe link at the bottom of every newsletter email; your address is then removed from the distribution list.

2.13 In the klixly app (Android)

When you sign in to the klixly app we create a device token: a random string tied to your account that identifies the app to our server. Alongside it we store a device name (which you can change), the app version, and the times of sign-in and last use. You can see every signed-in device in your account and revoke each one individually. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

The app can be locked and unlocked with your fingerprint, and you can sign in with a passkey. In both cases the check happens entirely on your device: fingerprint or face data stay in the device's secure hardware, never leave it, and are neither collected nor processed by us. All we learn is that your device passed the check. No processing of biometric data within the meaning of Art. 9 GDPR takes place on our side. Both features are optional, and signing in with e-mail and password remains available at any time.

Push notifications (Firebase Cloud Messaging). If you allow the app to send notifications, it tells you about posts from the content planner (published, partly or completely failed) and about expired account connections. To deliver them we use Firebase Cloud Messaging by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). For this we store the push tokenFirebase assigns to your device, the platform, and your setting for whether you also want success notices. Google receives the push token and the content of the notification: title and text with the names of the networks concerned, for expired connections also the account's username, plus the post's internal ID and status so the app can open it. Transfer to Google LLC (USA) is possible; Google is certified under the EU-US Data Privacy Framework, and the EU Standard Contractual Clauses (SCC) apply additionally. The Firebase data processing terms and the Firebase privacy information apply. We delete the push token when you sign out in the app or turn notifications off, and automatically as soon as Firebase reports it as invalid. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR); notifications are optional and can be turned off at any time in the app or in the Android settings.

2.14 AI drafts in the content planner (Anthropic)

In the content planner you can have an AI draft post texts (“captions”) and image descriptions (“alt texts”) for you. The feature is voluntary and only runs when you press the corresponding button. Without that click, no content is sent to the AI.

We use the Claude model by Anthropic PBC through their API. Only what the requested draft needs is transmitted: for an image description, a downscaled copy of the image you uploaded; for a post text, the short brief you typed, downscaled copies of up to four of the post's images (the cover image for videos), the character and hashtag limits of the platforms you selected and, if you set them up for the brand, the brand's name, the chosen tone and up to two sample posts. Your name, e-mail address, account data, connected social media accounts and statistics are not transmitted.

Anthropic processes the data as a processor on our behalf under a data processing agreement. Processing may take place outside the EU. The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR), to the extent you use the feature.

The result is a draft. It is shown in the editor, freely editable there, and is only published once you confirm it and schedule the post. For every draft we store which model produced it and when, and when you reviewed it – we need this as evidence of editorial control and to bill your credit balance. This record does not contain the generated text itself.

2.15 Appointment booking on bio pages

Creators can offer a booking block for their calendar at Cal.com (Cal.com, Inc., USA), Calendly (Calendly LLC, USA) or meetergo (meetergo GmbH, Monheim am Rhein, Germany) on their bio page. When this block runs as a native klixly block, our server fetches the available times from the booking provider. While you view the bio page and browse the times, your browser makes no connection to the booking provider; it neither receives your IP address nor sets cookies.

Only when you book an appointment do we pass the details from the booking form on to the booking provider: name, email address, chosen time, your time zone, the page language and, if the creator asks for them, phone number, location and answers to their additional questions. The booking provider uses them to create the appointment in the creator's calendar and sends you the confirmation. klixly does not store the booking; the details only pass through our server.

The respective creator is responsible for arranging the appointment; the booking provider processes the data on their behalf. With Cal.com and Calendly, the data may be transferred to the USA. The legal basis is taking steps towards the appointment you request yourself (Art. 6(1)(b) GDPR). To protect against automated fake bookings we limit the number of bookings per IP address; for this the IP address is held briefly in memory and not stored (Art. 6(1)(f) GDPR).

For Calendly and meetergo, the creator connects their account with the provider to klixly. For this we store the access key (encrypted), the account identifier, the address of their booking page and their name at the provider. The creator can disconnect at any time in the settings; we then delete the data and, for Calendly, also revoke access. The legal basis is the performance of our contract with the creator (Art. 6(1)(b) GDPR).

If a native block isn't possible, for example for paid appointments, the bio page shows the booking provider's calendar as embedded content instead. It only loads once you activate it with a click; from then on the booking provider's privacy notice applies.

2.16 Embedded content and profile cards on bio pages

Creators can embed content from other providers on their bio page. There are two kinds:

Players and calendars with two-click consent. Videos, music, live streams and booking calendars come straight from the respective provider: YouTube (Google Ireland Limited, Ireland; we use the privacy-enhanced mode, youtube-nocookie.com), Spotify (Spotify AB, Sweden), TikTok (TikTok Technology Limited, Ireland), Twitch (Twitch Interactive, Inc., USA), Kick (Kick Streaming Pty Ltd, Australia), Calendly (Calendly LLC, USA), Cal.com (Cal.com, Inc., USA), Zeeg (Zeeg GmbH, Berlin, Germany) and meetergo (meetergo GmbH, Monheim am Rhein, Germany). When the bio page opens, nothing is loadedfrom these providers; a placeholder takes their place. Only when you click “Load content from …” does your browser connect to the provider. From then on the provider receives, among other things, your IP address and may set cookies or store other data on your device; its privacy notice applies. Some providers are based outside the EU, in which case data may be transferred to the USA or Australia. The legal basis is your consent given by the click (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

If you tick “Always load … from now on”, your browser remembers this for that provider in local storage (klixly:embed-consent, not a cookie, never sent to us). You withdraw it by clearing klixly.app's site data in your browser.

Profile cards without a connection to the provider. Cards for YouTube channels, Spotify artists, Kick, Discord servers, GitHub and Steam profiles as well as the Twitch schedule are put together by our server: it fetches the public data (name, profile picture, follower count, live status and the like) through the providers' interfaces and also delivers the images via klixly. Your browser does not connect to the provider, and we pass none of your data to it. Only when you click a link in the card do you go to the provider.

The respective creator decides what appears on a bio page. Bookings through a native klixly block are described in section 2.15.

3. Cookies

klixly itself sets exclusively technically necessary or functional cookies. We set no tracking or analytics cookies of our own and no third-party cookies, which is why we show no cookie consent banner. For audience measurement we use cookieless Umami (see section 2.11), which works without cookies. Functional cookies (e.g. for language or the last-selected dashboard view) are only set when you use the respective feature. If you load embedded content on a bio page with a click, the respective provider may set its own cookies (see section 2.16).

Exception: if the owner of a bio page embeds their own analytics tool (e.g. Google Analytics or Meta Pixel), a consent notice appears on that specific page. The tracking scripts load only after your explicit consent; you can withdraw your decision there at any time via the cookie icon.

  • klixly_tracking_consent: stores your decision about the analytics tool embedded by the respective page owner; only set on bio pages with embedded tracking (technically necessary, 365 days)
  • __Secure-authjs.session-token: login cookie after sign-in (technically necessary, ~24 h)
  • sidebar_state / NEXT_LOCALE: UI preferences such as language (functional, only set when used)
  • bl-current-page-id: currently selected bio page in the dashboard (functional)
  • klixly-ref: referral attribution upon clicking a /r/<username> link. Contains exclusively the username of the referring user, valid for max. 30 days, deleted upon successful sign-up. See section 2.7 for details.
  • kx-paid-<link-ID>: unlocks access to a paid link after a successful payment (technically necessary, signed, max. 30 days). Contains no personal data; see section 2.10 for details.
  • calendly_oauth: only while connecting a Calendly account in the settings; security values for signing in to Calendly (technically necessary, max. 10 minutes)

4. Hosting and processors

  • Own server: klixly is operated on a dedicated machine in Germany. The database and application server are located in the same place; no data leaves the EU for regular operation.
  • bunny.net (BunnyWay d.o.o.): DNS resolution for our domains is handled via bunny.net, operated by BunnyWay, informacijske storitve d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia (EU). For klixly.app itself, bunny.net provides only the authoritative DNS records; no proxy is placed in front here, all HTTP traffic runs directly through our own server, and only DNS-typical request metadata arises (including the IP address of the requesting DNS resolver and the queried domain name). If a Business customer uses their own domain (custom domain), that domain’s traffic is additionally routed through the bunny CDN so that bunny can issue the TLS certificate and handle delivery; in that case bunny, acting as a processor, also processes the HTTP request data of that domain’s visitors (including IP address and requested URL). In both cases the registered office is within the EU, so no third-country transfer takes place.
  • Strato: for sending email (verification emails, password reset, newsletter confirmations) we use the SMTP relay of Strato AG (Pascalstr. 10, 10587 Berlin). A data processing agreement under Art. 28 GDPR exists with Strato ( strato.de/agb/avv).
  • Polar: billing as “Merchant of Record” by Polar Software, Inc., 548 Market St, PMB 99696, San Francisco, CA 94104, USA. Data transfer to the USA on the basis of supplementary EU SCC. Data processing agreement: polar.sh/legal/data-processing-addendum. See section 2.5 for details.
  • Stripe: payment processing for donations/tips, digital products, and paid links on bio pages (creator marketplace) by Stripe Payments Europe, Ltd. (Dublin, Ireland), with possible transfer to Stripe, Inc. (USA) on the basis of the EU SCC. Data processing agreement: stripe.com/legal/dpa. See sections 2.9 and 2.10 for details.
  • Anthropic: AI drafts in the content planner by Anthropic PBC (USA), only when you request them; based on a data processing agreement, processing may take place outside the EU. See section 2.14 for details.
  • Google Firebase: delivery of push notifications to the klixly app by Google Ireland Limited (Dublin, Ireland), with possible transfer to Google LLC (USA) on the basis of the EU-US Data Privacy Framework and the EU SCC. See section 2.13 for details.

5. Retention period

  • Account and profile data: until you delete the account.
  • Raw click data: a maximum of 30 days, then aggregated (no more user-agent hash, no more daily salt).
  • Webhook events (Polar and Stripe): 90 days for replay safety.
  • Auto-DM entries (comment identifier and time, outcome): 90 days.
  • Sales transaction data (tips, digital products, paid links: amount, platform fee, session ID, status): insofar as they concern our own bookkeeping, up to 10 years under tax and commercial retention obligations. We keep the buyer email only for as long as needed for delivery and handling any follow-up questions.
  • Server logs: a maximum of 14 days.
  • Referral records: until one of the accounts involved is deleted. The attribution cookie klixly-ref expires automatically after 30 days at the latest.

6. Your rights

Under the GDPR you have, in particular, the following rights vis-à-vis us:

  • Access (Art. 15 GDPR)
  • Rectification (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection (Art. 21 GDPR)
  • Withdrawal of consent given (Art. 7(3) GDPR)

A copy of all data stored about you (access + data portability, Art. 15 / Art. 20 GDPR) you can download yourself at any time as a logged-in user under Account → Export your data as a machine-readable JSON file. For other matters, write us an email at hello@klixly.app.

In addition, you have the right to lodge a complaint with a supervisory authority. For us this is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.

7. Changes to this privacy policy

We adapt this policy as needed, for example when new features are added or processors change. The respective current version is available here; the “Last updated” date stated above indicates the most recent change.