In short: sumwerk has no third-party analytics, no advertising trackers and no scripts or fonts from third parties; which pages are visited and how the app is used is recorded on our own server (sections 2 and 3). We process two kinds of data. Yours (your login, what you write to us), for which we are the controller. And your customers' (what sumwerk reads from Stripe and what you and your systems add), which we process on your behalf and on your instructions: there you are the controller and we are your processor.
1. Who is responsible
Kitchn Venture GmbH, Französische Straße 12, 10117 Berlin, Germany. Contact for everything on this page: hello@sumwerk.com. We are not obliged to appoint a data protection officer.
2. This website and the app
- Server logs. IP address, time, requested address, status and browser identification, to operate and secure the service (Art. 6 (1) (f) GDPR). The log is limited in size and overwrites itself, typically within days.
- One cookie. A signed cookie that keeps you signed in. No other cookies, no local storage used for tracking, so there is no cookie banner.
- No third-party tracking. No Google Analytics, no tag manager, no pixels, no fingerprinting, nothing recorded in your browser. Fonts, scripts and images come from our own domain.
- Page views. For every public page opened (not by known bots), our server records the page, the time, the domain of the site that linked to it (not its address) and campaign tags in the link (
utm_…). No cookie and no script. To count visitors, our server computes a code from your IP address and browser with a random value that is replaced and deleted every day, as Plausible does: your IP address is never stored, and the next day the code is different, so nothing links visits across days. From the same address and browser the server also notes your country, region and city (IP geolocation by DB-IP) and your browser, operating system and device type; the address and the browser string themselves are not kept. When you sign up, the sign-up is counted as a goal of that day's code, apart from your account. It goes to datalove (section 3), to learn which pages are read and where visitors come from (Art. 6 (1) (f) GDPR).
- Figures about use. We count requests per page type and how long they took, as sums without IP addresses, users or accounts, to find slow pages and faults.
- The status page (status.sumwerk.com) runs at Cloudflare, apart from our server on purpose. It sets no cookies and records nothing about visitors; Cloudflare processes the connection data that serving a page needs.
3. Your account
- Login. Name, email address, a hashed password, your role in the team, and the sessions that are signed in (browser identification and IP address at sign-in), to provide the service (Art. 6 (1) (b) GDPR).
- Emails from us. Password resets, invitations, notices you switched on (for example when a closed month was restated), and answers when you write to us. No newsletter without your consent.
- What you do in the app is stored as part of the product: notes carry their author, tasks their assignee, settings who changed them where that matters.
- How you use the app. When you are signed in, our server records which app pages you open (the kind of page, not its address) and every change you make (for example that a task was created, a customer edited or a CSV downloaded, never what it contained), with your user and account number, and at sign-in your name, role and your company's name in sumwerk. We use it to learn which parts of sumwerk are used and to improve them (Art. 6 (1) (f) GDPR). It goes to datalove (datalove.io), a product analytics service we operate ourselves, on its own server at Hetzner in Germany. Nothing is recorded in sandboxes or through the API, and no cookie is involved. You may object at any time by writing to us; we then stop recording for you and erase what was recorded.
- Session recordings. When you are signed in, a script from datalove records what the app shows you and what you do on it (pages, clicks, scrolling), to see where sumwerk is hard to use and to fix it (Art. 6 (1) (f) GDPR). Before anything leaves your browser it masks what you type into any field, the page title, and the content of every page with your customers' data (their names, emails, amounts), so we see the layout and your clicks, not your customers. The recording is linked to your user and account number; the script keeps a random session id in your browser's session storage for this tab only (no cookie). Not in sandboxes. Kept 30 days in datalove. The same objection stops it and erases what was recorded.
- The API log. For every call made with one of your tokens: time, token, method, address, the names of the fields sent (never their values), the status. Kept for 30 days. API tokens are stored as hashes only.
- Feature requests. What you suggest is shown publicly without your name once we have read it; your votes are stored so that we can tell you when something is done.
- Errors. When something fails on our side we keep the kind of error, our own code lines and the place it happened, without request data.
4. Your customers' data: processed on your behalf
This is the data sumwerk exists for, and it is yours. We process it only to provide the service to you, on your instructions, under a data processing agreement (Art. 28 GDPR) that your company accepts at sign-up. It lists our security measures and sub-processors.
- From Stripe, through the sumwerk app you install in your Stripe account (it only reads until you switch on billing management): customers (name, email address, address and tax details as far as Stripe holds them), subscriptions, prices, products, coupons, invoices, credit notes and events. sumwerk never writes to Stripe. The key is encrypted and never shown again.
- From you and your systems: customers and leads, people at those companies (name, email address, title, phone, LinkedIn address), your own attributes and usage figures per day (for example how many ads a customer launched), tags, notes, call logs, tasks, emails you send from sumwerk, and what an import brings (for example from ChartMogul; the import key is deleted when the import ends).
- From integrations you connect (section 6).
Our own staff see states and counts of an account (who is on the team, which connections exist, how many customers), not your customers or what they pay. Looking into your data to help you happens at your request.
5. Who else processes data for us
These are our processors. Each works under a contract that binds it to our instructions. We add nobody here without saying so on this page.
| Who | What for, which data | Where |
|---|
| Hetzner Online GmbH | The servers: the app, the database with everything above, the nightly backups (encrypted before they leave the server, kept 14 days on the server and 30 days in Hetzner's storage) | Germany (Nuremberg) |
| Postmark (ActiveCampaign, LLC) | Sending email: our mails to you, and mails your team writes to your customers when they go out through sumwerk's sender and not through your own mailbox. Recipient, sender, subject and text | USA. Standard contractual clauses in Postmark's data processing addendum; the company states it is certified under the EU-U.S. Data Privacy Framework |
| Cloudflare, Inc. | Name servers for sumwerk.com (the app's traffic does not pass through Cloudflare), and the status page with its monitor, which holds no customer data | Worldwide network, USA. Standard contractual clauses; the company states it is certified under the EU-U.S. Data Privacy Framework |
Alerts about outages go to our team chat and by email to us. They name the part of sumwerk that failed, never a customer. Exchange rates come from the European Central Bank; nothing is sent there.
6. Platforms you connect: what you cover on your side
sumwerk connects to services you have a contract with. They are not our processors: you chose them, your agreement with them governs what they do, and connecting them to sumwerk is your instruction to us. Please make sure your own house is in order:
- Stripe. You are the controller of your customers' billing data; Stripe and sumwerk both work for you. Your privacy notice to your customers should cover that you use service providers for billing and for analysing subscriptions. Stripe shows what the sumwerk app may read and change before you install it; uninstall it in Stripe when you stop using sumwerk.
- Google (sending from your mailbox). Optional, and through a Google app of your own company. A team member grants the permission to send email as them; sumwerk cannot read the mailbox. We store the token encrypted and use it only to send the mails that person or their automations write. sumwerk's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Revoke at any time in sumwerk or in the Google account.
- Plain (support conversations). With your API key sumwerk reads conversations: title, status, labels, assignee and the customer's name and email address are stored to show them on the customer's timeline; the messages themselves are fetched when somebody opens them and are not stored.
- Calendly or cal.com (optional). When you connect your booking tool, it sends sumwerk each booking: the person's name and email address, the host, the time, and the answers to your booking form. sumwerk stores them as a lead, a contact, a note and a task, as your instruction. The booking tool works under your agreement with it; sumwerk holds only the signing secret, encrypted, to know a call is genuine.
- Customer research (optional). With your own LLM key and, if you add one, your own Apify key, sumwerk reads a company's public website and, through Apify, its LinkedIn company page and up to ten of its people, sends the website's text and your prompt to your LLM provider, and stores the summary as a note and a few attributes on that customer. The providers work under your agreement with them, not ours; sumwerk holds the keys encrypted only to make those calls, and forgets them when you switch research off. Do not use it on private individuals.
- ChartMogul (import). The key is used for the import and deleted afterwards; what was imported stays as your data in sumwerk.
- Your own systems, webhooks and AI assistants. What your systems send through the API becomes your data in sumwerk. A webhook you configure sends customer data to the address you gave. An assistant you connect over MCP receives what it asks for with the token you created: that assistant's provider then processes it under your agreement with them, not ours.
- Emailing your customers. You decide whom to write and need a legal basis for it. Every automated mail carries an unsubscribe link, and sumwerk honours it; do not work around it.
- Your team. Invite people with their own login, remove those who leave, and give every system its own API token so that one can be revoked.
7. How long
- Your account and your customers' data: as long as the account exists. Disconnecting Stripe, or uninstalling the sumwerk app in Stripe, ends the access at once and keeps the numbers; deleting the account deletes everything in it. An empty account you delete yourself (Account, danger zone); any other on a request from an owner's address, within 30 days.
- Backups: 14 days on the server, 30 days in storage, then they are gone. Deleted data leaves the backups with them.
- Page views: not stored on our server, sent to datalove within seconds; in datalove the raw events 30 days and the anonymous page views (the day's code, page, source, location and device, no address) 24 months.
- How you use the app: not stored on our server, sent to datalove within seconds; in datalove the individual events 30 days, your name, role and daily counts as long as your account exists or until you object.
- Session recordings: sent from your browser to datalove every few seconds; kept there 30 days after the session.
- API log 30 days, webhook deliveries 30 days (their content only until delivered), server logs days, sessions until you sign out.
- Invoices and what tax law requires us to keep: as long as the law says, once sumwerk charges money.
8. Security
Encrypted connections everywhere; keys and tokens of connected services encrypted in the database; passwords and API tokens stored as hashes; backups encrypted; access to the servers for the operator only; what an operator changes on an account by hand is written to a log.
9. Your rights
Access, rectification, erasure, restriction, portability and objection under the GDPR (Art. 15 to 21), and withdrawal of a consent at any time. Your data can be exported as CSV and through the API whenever you like. Write to hello@sumwerk.com. If a customer of yours asks us about their data, we pass the request to you, because it is your data. You have the right to lodge a complaint with a supervisory authority, for example the one at our seat: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Stuttgart.
There is no automated decision-making and no profiling with legal effect, and we sell no data to anybody.
10. Changes
When a processor is added or something here changes in substance, this page gets a new date and the changelog a line.