Privacy policy

Controller

Sascha Weisenberger

Questions about privacy, access or deletion: [email protected]

What data we process

Account: your email address and either a password (stored only as a salted hash, never in plain text) or your Google identifier if you sign in with Google. For sign-in we store a session (strictly necessary cookie, 30 days).

Your content: contacts you create yourself, entries and notes about conversations, projects with phases and details, and timestamps.

Google contacts (only if you connect your Google account): Kistiro gets read access to your contacts. We store a reference to each contact and a display cache of name, phone numbers and email addresses. Kistiro never changes or deletes contacts at Google. The access token is stored encrypted.

Call log (Android app only, only if you grant permission): number, direction, time and duration of a call. Only calls with numbers of your contacts are stored, all others are discarded immediately. Conversations are never recorded.

Technical access data such as IP address and time arise when operating the servers. They are not analysed or combined.

Purposes and legal basis

Providing the app and your account, Art. 6(1)(b) GDPR (contract).

Access to Google contacts and call log, Art. 6(1)(a) GDPR (consent). You can withdraw it at any time: in Kistiro under “Disconnect”, in your Google account settings, or in Android permissions.

Security and stable operation, Art. 6(1)(f) GDPR (legitimate interest).

Google user data

Kistiro’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google data is used only to show you your contacts in Kistiro and to match calls and entries. It is not sold, not used for advertising and not shared with third parties.

Recipients and service providers

Operation: Kistiro runs on the operator’s own server. Traffic passes through Cloudflare (proxy and attack protection), which technically processes the transmitted data. Standard contractual clauses apply.

Google: when signing in with Google and when retrieving your contacts, under Google’s privacy terms.

We do not share data with anyone else. The website uses no analytics or tracking services and no advertising.

Retention

Your data is kept until you delete your account. After that it no longer exists in Kistiro. Technical server backups rotate automatically and are permanently deleted after 12 months at the latest.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, and to withdraw consent you gave. Write to [email protected].

You can delete your account and all data yourself at any time: Delete account

You can lodge a complaint with the competent data protection supervisory authority.

Security

Transmission is encrypted with HTTPS. Passwords are stored only as hashes, access tokens encrypted. Each user sees only their own data.

Changes

We update this policy when Kistiro changes, for example with new features such as email capture. The version published here applies.

Last updated: 15 November 2026