Privacy Policy
Effective June 1, 2026
1. Who we are
kolify ("the Service", "we", "us") is a workflow tool for creators and brands, operated by Leonhard Baumann, Georgenstraße 44, 92224 Amberg, Germany (the "Company"). We are the data controller for the personal data described in this policy. Full provider details are in our Impressum. For any privacy question, or to exercise your rights, email hello@kolify.app.
2. What we collect
- Account data — your email, password (stored hashed), and profile details you provide.
- Content you create — deals, invoices, contracts, media kits, expenses, and notes you enter.
- Free-tool inputs — values you type into public calculators (e.g. a deal fee or a brand domain). These are processed to return a result and are not tied to an account unless you are logged in.
- Technical data — IP address, browser type, and basic usage events, used to keep the Service secure and working.
3. How we use it
We process your data to:
- Provide and maintain the Service and your account
- Send transactional emails (e.g. password resets, invoice notifications)
- Provide customer support and respond to your requests
- Keep the Service secure and prevent abuse
Our legal bases (GDPR Art. 6) are: performance of our contract with you (providing the Service), your consent (where asked), and our legitimate interests (security and product improvement). We do not sell your personal data, and we do not use it to train AI models.
4. Subprocessors
We share data with a small number of vetted providers strictly to run the Service:
- Supabase — database, authentication, and file storage
- Vercel — application hosting and delivery
- Resend — transactional and outreach email delivery
- Stripe — subscription billing (payment card details are handled by Stripe, never stored by us)
Each acts as a processor under contract. Where data is transferred outside the EEA, it is covered by Standard Contractual Clauses or an equivalent safeguard.
5. Cookies
We use essential cookies only — to keep you signed in and to keep the Service secure. We do not use third-party advertising or cross-site tracking cookies. Because they are strictly necessary to provide the Service you asked for, they do not require consent under the ePrivacy Directive.
6. Data retention
We keep your account data for as long as your account is active. When you delete your account, your personal data is removed from our production systems within 30 days, except where we must keep records longer to meet legal or accounting obligations (for example, invoice records).
7. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Delete your data ("right to be forgotten")
- Export your data in a portable format
- Object to or restrict certain processing
- Withdraw consent at any time
To exercise any of these, email hello@kolify.app. You also have the right to lodge a complaint with your local data protection authority.
8. Security
Data is encrypted in transit (TLS) and at rest. Access to production data is restricted and authenticated. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data and will notify affected users and authorities of a breach as required by law.
9. Children
The Service is not directed at children. You must be at least 16 years old to use kolify.
10. Changes
We may update this policy. We will notify you of material changes by email or an in-app notice. The effective date at the top reflects the latest version.
11. Contact
Questions about your privacy? Email hello@kolify.app