Privacy Policy

1. Data controller

RizzlerGPT is operated by:

Kirpeit Solutions is the data controller responsible for your personal data under the GDPR and applicable data protection law. When this policy says "we", "us" or "our", it refers to Kirpeit Solutions.

2. Data we collect

Data you provide directly

Data collected automatically

Data we explicitly do not collect or store

• Uploaded screenshots — images are forwarded in real-time to OpenAI's API and are never written to our storage. They are discarded immediately after the API response is returned.
• The text content of messages visible in any screenshot
• Precise geolocation data
• Device identifiers beyond user-agent
• Any data for advertising or retargeting purposes

3. How we use your data

• Providing the service — forwarding screenshots to OpenAI, returning reply suggestions, managing your account and Premium subscription status.
• Authentication — generating and sending magic login links via PHP mail() on our own server, verifying session tokens.
• Payment management — communicating with Stripe via webhook to activate or revoke Premium access based on subscription status. We never store card details.
• Abuse prevention — IP-based rate limiting enforces the 3-free-try limit without requiring an account.
• Product analytics — aggregated, anonymised usage data via self-hosted Matomo to understand how the service is used. No individual user profiling.
• Legal compliance — retaining billing records as required by German commercial and tax law (§ 257 HGB, § 147 AO), typically for 10 years.

We send only transactional emails (login links, billing confirmations). We do not send marketing or promotional emails.

We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects on you.

4. Legal basis for processing (GDPR)

For users in the European Economic Area and United Kingdom, processing is based on the following grounds under Article 6 GDPR:

Where we rely on legitimate interests, we have assessed that our interests do not override your rights and freedoms, given the minimised and non-sensitive nature of the data involved and the EU-based infrastructure used.

5. Third-party sub-processors

We share personal data with exactly two external sub-processors. All other processing — including analytics, email, and database storage — takes place on our own EU-hosted server.

We have no relationship with advertising networks, data brokers, social media platforms, or marketing tools. We do not use Google Analytics, Meta Pixel, or any equivalent tracking service.

6. Analytics — Matomo

We use Matomo, an open-source analytics platform, to understand how visitors use RizzlerGPT. Matomo is installed and operated on our own server in Germany. No analytics data is sent to any third party.

Matomo is configured with the following privacy settings:

• IP addresses are anonymised before storage (last octet masked)
• No cross-site tracking or fingerprinting
• Data is stored exclusively on our EU server and is never shared or sold
• Analytics data is retained for 13 months, then automatically deleted

7. International data transfers

The majority of your data never leaves the European Union — our server, database, analytics, and email are all EU-based.

The following transfers to third countries occur:

• OpenAI (USA) — screenshot images only, protected by Standard Contractual Clauses (SCCs) per European Commission Decision 2021/914.
• Stripe (USA / Ireland) — payment processing. Stripe's primary European entity is Stripe Ireland Ltd., which is subject to GDPR. US-based transfers are protected by SCCs.

California (CCPA/CPRA): California residents have the right to know what personal information we collect, the right to delete, the right to correct, and the right to opt out of sale. We do not sell or share personal data for cross-context behavioural advertising. To submit a CCPA request, email kirpeit@kirpeit-solutions.de.

United Kingdom: Transfers are conducted under the UK GDPR and the International Data Transfer Agreement (IDTA) where applicable.

Other jurisdictions: We make reasonable efforts to comply with applicable local privacy law. If you have a concern specific to your jurisdiction, please contact us.

8. Data retention

9. Cookies & local storage

Cookies we set

Browser local storage

We store one item in your browser's local storage:

• a counter tracking your free-tier usage. This value stays in your browser and is never sent to our server.

Matomo cookies

Matomo may set first-party cookies (a session token, a session token) to distinguish visits. These cookies do not leave our domain, are never shared with third parties, and can be blocked by enabling "Do Not Track" in your browser. No third-party cookies are set by Matomo.

We set no advertising cookies, social media cookies, or any cross-site tracking cookies.

10. Children's privacy

RizzlerGPT is intended for users aged 16 and over (or 13 and over where local law permits a lower age). We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us at kirpeit@kirpeit-solutions.de and we will delete it promptly.

11. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent revision. For material changes — such as adding a new sub-processor or changing the legal basis for any processing — we will notify registered users by email at least 14 days before the changes take effect. Continued use of RizzlerGPT after the effective date constitutes acceptance of the updated policy.

12. Contact & complaints

Right to lodge a complaint

If you are in the EEA and believe we have not handled your data lawfully, you have the right to lodge a complaint with your national data protection authority. As we are based in Germany, the lead supervisory authority is:

UK residents may contact the Information Commissioner's Office (ICO). You may also contact the supervisory authority in your own EU member state.