The controller is Kernflow UG (haftungsbeschränkt), Postplatz 2, 01067 Dresden, Germany. Email: office@kernflow.io. Website: https://kernflow.io.
For personal data that we process exclusively on behalf of agencies or other business customers, responsibility is determined by the respective engagement and data processing agreement. Where necessary, we forward data subject requests to the responsible controller and assist it in handling them.
We process personal data to provide and secure our website and platform, manage user accounts, deliver agreed services, handle enquiries and appointments, provide support, manage billing and fulfil statutory obligations.
Article 6(1)(b) GDPR applies insofar as processing is necessary for a contract with the data subject or, at their request, for steps prior to entering into a contract. For contact persons and employees of business customers, we generally base necessary business communication and user administration on Article 6(1)(f) GDPR. Our interests are functional, secure service provision and reliable business operations. Article 6(1)(c) GDPR applies to statutory obligations. Processes requiring consent are based on Article 6(1)(a) GDPR.
Where we process data on behalf of a customer, the responsible controller determines the legal basis. The data processing agreement under Article 28 GDPR governs processing by Kernflow; it is not itself a legal basis for the original collection of data.
For hosting, we use Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The Kernflow platform, saved scripts and customer data are hosted at Hetzner. Hosting includes storage and technical provision of this content. The separate transmission of selected content to the OpenAI API is described in section 8. Hetzner hosting does not mean that every processing operation takes place exclusively at Hetzner.
When accessing the service, technical data is processed, in particular the IP address, time, requested page or file, status code, browser and operating system and, where applicable, referrer and volume of data transferred. This data serves operation, error analysis and prevention of abuse. The legal basis is Article 6(1)(f) GDPR; our interest is secure and reliable provision.
Server logs are deleted as soon as they are no longer needed for these purposes. In the event of specific security incidents, relevant entries may be retained separately until the investigation and necessary legal action have been completed.
Necessary cookies or comparable storage access may be used for expressly requested functions such as login, session management and security. Where strictly necessary, section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG) applies. Subsequent processing of personal data is based on Article 6(1)(b) or (f) GDPR, depending on the purpose.
Non-essential storage access and external media requiring consent may be activated only after consent. Section 25(1) TDDDG and, where applicable, Article 6(1)(a) GDPR apply. Consent may be withdrawn with effect for the future. Pure session functions must be distinguished from analytics and marketing.
At present, no standalone marketing or audience measurement tools are used on the website. Payment and media services may trigger their own technical processes; see sections 11 and 12.
During registration and use, we process in particular names, business email addresses, company affiliation, account identifiers, plan, permissions, login and session data and necessary security information. This also includes client profiles and work content created by the user or an authorised administrator.
The data serves access, assignment to workspaces, authentication, licence management and security. The legal bases are Article 6(1)(b) GDPR for a contract with the data subject, or Article 6(1)(f) GDPR for business users and prevention of abuse. We may receive invited users' data from an administrator at their company. Invited users receive this privacy information with the invitation or at the first contact.
For enquiries, we process contact details and the content of the communication for handling and follow-up. The legal basis is Article 6(1)(b) or (f) GDPR as described in section 2. Unnecessary additional details are voluntary.
Appointments are booked through Calendly LLC, USA. In particular, name, email address, appointment, time zone, entered answers and technical data are processed. We receive the appointment details necessary to conduct it. Where a calendar is connected, the details necessary for appointment management and avoiding double bookings are exchanged with our business calendar. We use Google Workspace for business communication and calendar management; see section 13.
Opening the Calendly booking link establishes a connection to Calendly. For a direct embed, the notices on external content in section 12 and storage access in section 4 also apply. Calendly may be a controller in its own right for certain purposes. Information: https://calendly.com/legal/privacy-notice and https://calendly.com/legal/data-processing-addendum.
Demo, onboarding and support calls take place through Zoom. The provider is Zoom Communications, Inc., USA; the specific contracting entity is determined by our Zoom contract. Data processed may include name, email address, participant identifier, audio and video when transmission is activated, chat, shared content and connection and device data. The basis for conducting calls is Article 6(1)(b) or (f) GDPR under section 2.
We use Zoom's automatic transcription for written follow-up of calls and agreed next steps. Speech is processed and converted into text for this purpose. Transcription requires prior information and the express consent of all affected participants; the legal basis is Article 6(1)(a) GDPR. Acceptance of terms and conditions does not replace this consent. A call without transcription is possible. New participants are informed accordingly before inclusion.
Any further permanent audio or video recording must be distinguished from transcription and requires separate prior information and consent. Mere participation in the call or acceptance of terms and conditions does not replace this consent. Upon withdrawal, we stop the relevant processing for the future; rights to erasure and legally permitted exceptions remain unaffected.
Only persons responsible for call follow-up receive access to transcripts. Retention is determined by the summary still required, documentation of agreed steps and handling of the enquiry discussed. After these purposes have been completed, full transcripts are deleted unless specifically necessary statutory retention or preservation of evidence prevents this. Individual contract-relevant details may be incorporated into the necessary business document without permanently retaining the full transcript for this purpose.
Privacy information: https://www.zoom.com/en/trust/privacy/.
Kernflow processes client profiles, brand voice, briefings, product and audience information, scripts, hooks, captions, feedback, content plans, videos or video links, transcripts and available performance details to deliver the agreed content services. Such content may contain personal data. Where this occurs exclusively on customer instructions, processing takes place within the data processing relationship; if the agency is itself a processor, Kernflow may be its subprocessor.
We use the OpenAI API for AI-supported ideas, scripts, summaries and structuring. Inputs and context information necessary for the respective task are transmitted to OpenAI and results are returned. This may include, in particular, briefings, brand voice details, texts and transcripts. For EEA data, OpenAI's data processing terms provide for processing by OpenAI Ireland Limited; further OpenAI entities and subprocessors may be involved.
Under its published terms, OpenAI does not use API inputs and outputs for model training by default. This does not mean that no storage occurs: security logs may generally be retained for up to 30 days; statutory or security-related exceptions and additional function-dependent storage are possible. For API functions with their own content storage, this may continue until deletion is initiated or the applicable retention period expires. Retention therefore also depends on whether only a request is processed or a persistent API object is created. Data may also be processed outside the EEA; section 14 explains the requirements.
Information: https://openai.com/policies/data-processing-addendum/ and https://developers.openai.com/api/docs/guides/your-data.
Special categories of personal data, such as health data, may be processed only with separate legal and contractual safeguards. Users should remove unnecessary personal details from inputs. AI outputs may be inaccurate and must be checked before further use.
For topic and content research, Kernflow also processes publicly accessible social media content. Video links, profile names, descriptions, transcripts and publicly visible metrics may be processed. Public availability alone does not permit unrestricted further processing.
Where research is performed on behalf of a customer, that customer, as the responsible controller, determines the purposes and legal basis. Where Kernflow itself builds a general research collection for its own purposes, Kernflow is the controller for it. For our own content research, our interest is identifying publicly visible topics and preparing relevant content ideas. Processing under Article 6(1)(f) GDPR requires that it be necessary for this purpose and that conflicting interests or rights of data subjects do not override it. Publicly available content comes in particular from social media profiles and publications on Instagram and YouTube. Saved research information is used only for as long as necessary for a current research collection or the specific customer engagement; outdated personal details or those no longer needed for these purposes are removed.
Where we act as controller, we generally fulfil the information obligations under Article 14 GDPR no later than within one month, or earlier upon first communication or disclosure. Any exceptions must be checked and documented individually. Data subjects may contact us through the contact in section 1 and object to processing based on legitimate interests.
Access to personal customer content must be limited to the persons and data necessary for service provision, requested support, troubleshooting, security measures or administration. Technical administrator access does not authorise unrestricted inspection or publication. Processing on behalf of the customer is governed by documented instructions and the data processing agreement.
The necessary technical and organisational measures include risk-appropriate access restriction, confidentiality, secure transmission, separation of client workspaces, backup and restorability, and procedures for security incidents. For processing on behalf of customers, the security and audit obligations of the data processing agreement additionally apply.
We use Stripe for subscriptions and payments. For EEA customers, Stripe Payments Europe, Limited and further Irish Stripe entities are involved in particular, depending on the service. During payment, name, company, billing address, email address, selected plan, transaction data, payment status, necessary tax details and technical data may be transmitted to Stripe. Payment information is processed in the respective Stripe payment process; the details Kernflow receives from it depend on the payment method and integration.
Stripe processes data partly on our behalf and partly as an independent controller, for example for statutory obligations or certain security and fraud prevention purposes. The legal bases for our processing are Article 6(1)(b), (c) or (f) GDPR under section 2. Additional functions requiring consent may be activated only on an appropriate basis.
Invoice and tax data is subject to statutory retention obligations. A bank transfer is processed by the credit institutions involved. Privacy information: https://stripe.com/privacy and https://stripe.com/legal/privacy-center.
For a simple link to Instagram, YouTube or LinkedIn, the connection triggered by the link to the respective provider occurs only when it is opened. Embedded players or previews, however, may transmit IP addresses and further technical data when loaded. This applies both to external videos on the website and social media embeds in the platform.
For YouTube, Google Ireland Limited or Google LLC is generally involved; for Instagram in the EEA, Meta Platforms Ireland Limited. YouTube's privacy-enhanced mode through youtube-nocookie.com does not automatically remove all consent and information obligations. External content requiring consent must remain blocked until consent is given. An alternative is a local placeholder with an external link.
Our website fonts are hosted locally; no external font providers are contacted to deliver them. External services' own privacy information also applies.
For business communication, calendars, documents and contact management, we use Google Workspace, including Google's Drive, Docs and Sheets; for project organisation we use Asana and for automation n8n. Contact, communication, appointment or project details necessary for the respective business process are processed. Central storage of platform content at Hetzner must be distinguished from these business workflows.
The legal bases are Article 6(1)(b) or (f) GDPR as described in section 2 and, for statutory obligations, Article 6(1)(c) GDPR. For self-hosted automation software, use of the software alone does not result in transmission of customer data to the manufacturer; transmission may occur through external services actually connected.
Necessary invoice and tax documents may be provided to our tax adviser for bookkeeping and tax obligations using DATEV. A tax adviser is generally an independent controller within the scope of their statutory tasks and duty of confidentiality.
If you voluntarily use a support channel offered through WhatsApp, WhatsApp Ireland Limited or an involved WhatsApp group company processes communication and technical data within its service. We process your contact details and messages to handle the support case under Article 6(1)(b) or (f) GDPR. You may also contact us by email. Confidential customer materials should be exchanged through a suitable protected channel. Information: https://www.whatsapp.com/legal/privacy-policy-eea.
The requirements of Article 28 GDPR apply to processing personal data on our behalf. Service providers receive only the data necessary for their respective task. Information: https://policies.google.com/privacy, https://asana.com/terms/privacy-statement and https://n8n.io/legal/privacy/.
OpenAI, Calendly, Zoom, Stripe, Google, Asana, WhatsApp and external media providers may process data, particularly in the USA or other countries outside the EEA, or make it accessible from there. Hetzner's own registered office in Germany is not an assurance about all locations or the entire processing chain.
Third-country transfers may take place only on a basis under Chapter V GDPR. These include an applicable adequacy decision or standard contractual clauses, including necessary supplementary measures. The EU-US Data Privacy Framework may be relied on only if the specific recipient entity is currently covered for the relevant processing. Blanket certification of all providers is not claimed.
Information and a copy of the applicable safeguards may be requested through section 1; details deserving protection may be redacted.
We delete personal data when the specific purpose ceases to apply and no statutory retention obligation or other lawful necessity exists. Business documents are retained according to the applicable statutory category; for example, generally eight years for accounting vouchers, ten years for certain books and records and six years for business correspondence. Calculation of periods and special cases are governed by law.
Enquiries and appointment details are retained until final handling and necessary follow-up. Contract documents may be retained separately to fulfil statutory obligations and as necessary to assert or defend claims. Security logs, Zoom transcripts and API data follow the purposes and criteria described in their respective sections.
After the contract ends, customer content is processed only for necessary return or deletion on customer instructions and for mandatory data retrieval and provider-switching rights. Completion of this process and conflicting statutory obligations are decisive. The customer may send return or deletion instructions to office@kernflow.io. Backup copies may remain blocked until their necessary replacement or deletion exclusively for restoration and security purposes; upon restoration, deletion instructions already given must be reapplied. This does not permit unlimited retention in backup copies.
A billing obligation does not justify blanket long-term storage of all scripts, briefings or transcripts. For data processed on behalf of the customer, return or deletion follows the customer's choice and Article 28(3)(g) GDPR unless a statutory retention obligation prevents this. Mandatory data retrieval and provider-switching rights remain unaffected.
Subject to the statutory requirements, you have rights of access, rectification, erasure, restriction, data portability and objection. Consent may be withdrawn at any time for the future. Previous processing remains unaffected. Proportionate identity verification may be necessary for handling a request.
You may object to processing under Article 6(1)(f) GDPR on grounds relating to your particular situation. For direct marketing, you have a right to object at any time without giving particular reasons. Following such an objection, personal data is no longer processed for direct marketing.
You may lodge a complaint with a data protection supervisory authority, in particular at your habitual residence, workplace or the place of the alleged infringement. The Saxon Data Protection and Transparency Commissioner is responsible for our registered office. Current contact details: https://www.datenschutz.sachsen.de.
At present, no regular newsletter is sent. Business contact management may be based on Article 6(1)(f) GDPR provided the requirements, including balancing of interests, are met. In addition, the rules of section 7 of the German Act Against Unfair Competition (UWG) must be observed for the permissibility of each advertising approach. In particular, B2B advertising emails are not permissible solely on the basis of a legitimate interest.
Minimal suppression information necessary to respect an objection to advertising may continue to be retained. It must not be used for further advertising.
Details required for an account, booking and service must be identified in the respective process. Without this data, the relevant function or service cannot be provided. Further details are voluntary unless a statutory obligation exists.
Kernflow creates creative and operational suggestions. A solely automated decision about persons with legal or similarly significant effects within the meaning of Article 22 GDPR is not envisaged under the described scope of functions.
We update this policy when processing or legal requirements change. The policy does not create additional authorisation to process data and does not replace required consent or a contractual agreement.