Privacy Policy

Last updated: February 2026

Kikiform is a product of Technotetis UG (haftungsbeschränkt), Pohlstr. 70, 10785 Berlin, Germany. This policy explains what information we collect when you use Kikiform, why we need it, and what we do with it.

We aim to keep things simple and honest. If you have questions, write to us at info@kikiform.de.

What data we collect

Account data

When you sign up or sign in, we store your email address. That is the minimum we need to give you access to your account.

Invoice and business data

Kikiform stores the invoices you create and the client records you add. This includes your business details (name, address, VAT ID, IBAN) and your clients' details. You enter all of this yourself. We store it so you can access and manage it.

Session data

When you are signed in, we keep a session in our database. This session is linked to a secure cookie set on your browser — it contains only a session identifier, nothing personal. We do not derive any tracking or advertising data from sessions.

How you can sign in

Kikiform supports two ways to sign in:

Magic link (email): We send you a single-use sign-in link by email. We never store a password.

Google Sign-In: This is entirely optional. You will only see it as an option on the sign-in screen if you choose to use it. If you do, Google processes your sign-in under Google's own privacy policy. We receive only the email address associated with your Google account. No other data is shared between Kikiform and Google unless you actively initiate a Google sign-in.

Where your data is stored

All data is stored on servers operated by Hetzner Online GmbH, a German company. Infrastructure is located within the European Union (Germany and Finland). Your data does not leave the EU.

Cookies

Kikiform sets one cookie that is always needed, and one that is only set if you opt out of analytics:

Cookie Purpose Type Duration
authjs.session-token Keeps you signed in First-party, HttpOnly, Secure Until you sign out
analytics_optout Remembers that you opted out of analytics, so our server does not record events First-party, Secure One year, and only if you use the opt-out toggle

We do not use advertising cookies, tracking pixels, or any third-party cookies.

Analytics

We use Umami, a privacy-first web analytics tool, to understand how Kikiform is used: which pages visitors land on, how many people complete sign-up, and where the product could be clearer. We host Umami ourselves on our own infrastructure in Germany, so this analytics data stays with us and is never shared with an external analytics provider.

You can opt out at any time: use the opt-out toggle further down this page.

Umami is designed to be privacy-first:

  • It sets no tracking cookies and uses no localStorage for analytics purposes, so no tracking data is stored on your device
  • If you use the opt-out toggle to disable analytics, two small flags are stored on your device so your choice can be honored: a local flag (localStorage.umami.disabled) that tells the page tracker to stay silent, and a first-party cookie (analytics_optout, valid for one year) that tells our server not to record conversion events. They contain only your objection and are set only when you use the toggle. Switching analytics back on removes both. If you opted out earlier, the cookie is added automatically on your next visit
  • No cross-site tracking, no advertising profiles, no data sold to third parties
  • Your IP address is used only to derive an approximate location and a short-lived, regularly rotating hash that tells visits apart. The raw IP address is never stored
  • The page tracker and our server-side conversion events follow the same single control, the opt-out toggle below. We do not read your browser's Do Not Track or Global Privacy Control signals

Legal basis: Our legitimate interest in measuring how the product is used to improve it (Art. 6(1)(f) GDPR). Umami stores nothing on your device for analytics, so no consent under § 25 TTDSG / ePrivacy is required. The opt-out flag and cookie are only written when you actively use the toggle below, they record nothing but your objection, and they are needed to honor your choice. You can object at any time (Art. 21 GDPR).

What is processed: Pageview data (page URL, referrer, approximate location such as country and region, device type, operating system, browser, screen size and browser language) and conversion events (for example, that a sign-up was completed, never your email or account details). Visits are identified only by a rotating hash, not by name, email address or IP address.

Retention: Pageview and event records are kept on our own servers for as long as they are useful for product decisions. They contain no names, email addresses or raw IP addresses.

Opt out of analytics

Even though Umami does not identify you, you can always opt out using the toggle below, which stores a local flag and a small cookie in your browser, telling the analytics script and our server to stay silent. You can switch analytics back on at any time with the same toggle:

Checking your analytics preference…

Third-party services

We use the following third-party services to operate Kikiform:

  • Hetzner Online GmbH — server and database hosting (EU, Germany)
  • Lettermint — transactional email delivery for magic link sign-in emails (EU, GDPR-compliant)
  • Mistral AI — AI text extraction from invoice PDFs uploaded during onboarding (optional feature, only active when you choose to upload an invoice). Only the extracted text content of the PDF is transmitted; the file itself is discarded immediately on our servers and never stored. EU-based (France). Privacy policy
  • Mollie — payment processing. When you purchase invoices or subscribe, your payment is processed by Mollie B.V. (Netherlands). Mollie processes your payment details (card number, bank account) and email address. Privacy policy

Our web analytics (Umami) is self-hosted on our own infrastructure. It is not a third-party service. See the Analytics section above for what it processes and how to opt out.

We do not use social media embeds, advertising networks, or external tracking services.

How long we keep your data

We keep your account and invoice data for as long as your account is active. If you delete your account, we remove your personal data within 30 days. Invoice data linked to your account is deleted at the same time.

Note: German tax law (§ 147 AO) may require you to keep your own invoice records for up to 10 years. That obligation is yours as a business owner — it does not create an obligation for us to retain your data on your behalf.

Your rights

Under the GDPR, you have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate data
  • Delete your data (right to erasure)
  • Export your data in a portable format
  • Object to processing or ask us to restrict it

To exercise any of these rights, contact us at info@kikiform.de. We will respond within 30 days.

You also have the right to lodge a complaint with the supervisory authority responsible for Berlin:

Berliner Beauftragte für Datenschutz und Informationsfreiheit Friedrichstr. 219, 10969 Berlin www.datenschutz-berlin.de

Changes to this policy

If we make significant changes to this policy, we will notify you by email before they take effect. Minor updates (such as clarifications) will be published here with an updated date.

Contact

Technotetis UG (haftungsbeschränkt) Pohlstr. 70, 10785 Berlin, Germany info@kikiform.de