Privacy Policy

Last updated: 16 October 2026

1. Data Controller

KYTH. Systems UG (haftungsbeschränkt)
Stefan Grasse, Stephan Wittmann (Managing Directors)
Prof.-Mederer-Straße 4, 92348 Berg, Germany
Email: datenschutz@kyth.systems

This privacy policy applies to the marketing website kyth.systems. Our products have their own privacy policies: KYTH.Karl at karl.kyth.systems/privacy, KYTH.Kartuu at the KYTH.Kartuu privacy policy. KYTH. Pi-Tool runs entirely locally on your device: we process no data in doing so. KYTH.Kolli has the KYTH.Kolli privacy policy (in German). For KYTH.Klara, the policy will follow at launch.

2. Overview of Processing Activities

This site is a purely informational corporate website. We process personal data only in the following cases:

  • Server logs when the site is requested (technically necessary).
  • Newsletter sign-up (email address) with double opt-in, when you sign up via our form (in the footer or on the Karl product page), or if you joined the Kolli waiting list before 4 October 2026.
  • Email contact when you write to one of our addresses.
  • Telephone contact when you call one of the numbers given in our legal notice.
  • Appointment booking for setting up KYTH.Karl together, when you use the button on the Karl product page to open the Google Calendar booking page and book a slot there (section 8).
  • Direct outreach to businesses by email (name of the shop or company, website, country, gift card products, public contact address), when we introduce KYTH.Kartuu to Shopify merchants in the United States or the United Kingdom (section 8).
  • Meta Pixel (usage data, cookie identifier), only if you agree in the consent banner (section 9).
  • Google Analytics and Google Ads (usage data, cookie identifiers), only if you agree in the consent banner (section 10).

Without your consent we use no external web-analytics service, no tracking cookies, no advertising network and no pixel. Only once you agree in the banner does the Meta Pixel load (section 9), together with the Google tag for Google Analytics and Google Ads (section 10). Independently of that, page views are counted without cookies and without personal data in the Cloudflare Worker that serves this website (section 5). Fonts are served exclusively self-hosted (no Google Fonts).

3. Cookies and Local Storage

On your first visit a banner asks whether you agree to the Meta Pixel and to Google Analytics and Google Ads. Without your agreement this website sets no cookies and loads no tracking.

We store your decision in your browser's LocalStorage under the key kyth-consent-marketing-v2 (value "granted" or "denied") so that the banner does not appear on every visit. We base this on § 25 (2) (2) TDDDG, as it is strictly necessary to respect your choice. Only once you agree do the Meta Pixel and the Google tag set cookies and read information from your device; the legal basis is your consent under § 25 (1) TDDDG and Art. 6 (1) (a) GDPR (section 9 and 10). The consent covers both services together (category "Marketing" in the banner). You can change your choice at any time via "Privacy settings" in the footer.

If you close the banner with the X without choosing, we remember this only for the current visit in your browser's SessionStorage (key kyth-consent-marketing-v2-zu, value "1"). This is not consent: neither the Meta Pixel nor the Google tag loads, and the banner asks again on your next visit. The legal basis is likewise § 25 (2) (2) TDDDG.

4. Server Logs (Cloudflare Hosting)

When you visit the website, technical data your browser transmits is processed:

  • IP address
  • Date and time of the request
  • URL requested
  • Browser type, version and operating system
  • Referrer (if your browser sends one)

This data is technically necessary to deliver the site and protect it from attacks. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in stable, secure operations). The data is not merged with other sources.

5. Reach Measurement (cookie-free, no personal data)

We count page views without cookies and without personal data, directly in the Cloudflare Worker that serves this website (Cloudflare Workers Analytics Engine). No script is loaded in your browser and no external analytics service is embedded; we do not use Cloudflare Web Analytics. Google Analytics only loads with your consent (section 10) and has nothing to do with this count.

Per page view we store: the path of the page requested (without query parameters), the language (German or English), the referring domain (only the hostname from the referrer, if your browser sends one, never the full URL; navigation within kyth.systems is not stored as a referrer) and the time.

We do not store: IP address, user agent, cookies, device or browser characteristics (no fingerprinting), location or country. There is no identifier that links several views by the same person: we can neither recognise returning visitors nor build sessions or user profiles.

The processor is Cloudflare, Inc. (contractual basis in section 11). The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is understanding which pages are read. Because no information stored on your device is accessed, no consent under § 25 TDDDG is required. According to Cloudflare’s documentation, data in Workers Analytics Engine is retained for three months.

6. Self-hosted Fonts

This website uses self-hosted fonts only (Bricolage Grotesque, Plus Jakarta Sans, IBM Plex Mono). No connections are made to external font servers (e.g., Google Fonts, Adobe Fonts).

7. Newsletter Sign-up (Karl) and Kolli Waiting List

Via our newsletter form in the footer of our pages and prominently on the Karl product page (/karl/ and /en/karl/), you can sign up with your email address to receive product updates and availability notices for our products. We process your address using a double opt-in procedure: after submitting, you receive a confirmation email; you are only added to the list after clicking the link it contains.

On the Kolli product page (/kolli/ and /en/kolli/) you could join the waiting list for KYTH.Kolli until 4 October 2026 through the same form and the same double opt-in procedure; now that Kolli is in the Shopify App Store, the form is no longer offered there. The waiting list is kept separate from the newsletter: if you signed up, you receive, apart from the confirmation email, exactly one message about Kolli’s launch in the Shopify App Store, and no newsletter. Legal basis, withdrawal, storage location and deletion periods are the same as for the newsletter.

The legal basis is your consent under Art. 6 (1) (a) GDPR in conjunction with § 7 (2) UWG (German Act Against Unfair Competition). Providing your email address is voluntary. You may withdraw your consent at any time with effect for the future, via the unsubscribe link at the bottom of every email, or informally by emailing datenschutz@kyth.systems. After unsubscribing, your address is deleted immediately and completely.

The sign-up form submits your email address directly to our own product backend (karl.kyth.systems, likewise controlled by KYTH. Systems UG (haftungsbeschränkt)). There it is stored encrypted; the servers are located in Germany (IONOS hosting, Berlin). Confirmation and newsletter emails are sent via our mail host INWX (Germany, see section 11). If you do not confirm the sign-up, your address is automatically deleted after no more than 30 days.

8. Email, Telephone and Appointment Contact

If you write to us at an address in the kyth.systems domain (e.g. hello@, datenschutz@), we process your information to handle your request. The legal basis is Art. 6 (1) (b) GDPR (initiation/performance of a contract) or Art. 6 (1) (f) GDPR (legitimate interest in answering general enquiries). We do not pass your information to third parties without your consent.

Our kyth.systems mailboxes (e.g. hello@, datenschutz@, warteliste@) are operated as IMAP mailboxes by our mail-hosting provider INWX (Berlin, Germany); the mail servers are located in Germany. Receiving your email therefore does not involve a third-country transfer. We nonetheless recommend that you do not send sensitive personal data (e.g., health data) to us by unencrypted email.

We retain your correspondence for as long as it is required to handle your request. At the latest after applicable statutory retention periods (commercial law: typically 6 or 10 years where applicable) it is deleted.

If you call one of the telephone numbers given in our legal notice (the mobile numbers of the two managing directors), we process your phone number, if it is transmitted, and the time of the call. We only make notes of what you tell us during the conversation as far as this is needed to handle your request. The legal bases are the same as for email contact. We do not pass this information to third parties without your consent either.

Appointment booking and video call via Google (voluntary). On this website we offer to set up KYTH.Karl together in a 30-minute video call. The button opens a Google Calendar booking page in a new tab. Our website does not load anything from Google for this and does not transmit any data to Google. On the booking page, the person booking chooses a slot and enters their first name, last name, email address and shop domain, and optionally the shipping services they use. Google enters the appointment in our calendar and sends the confirmation to the person booking and to us. The call takes place as a video conference via Google Meet. Google processes the participants’ video, audio and connection data. We do not record the call and do not have it transcribed. We use the information to prepare and hold the appointment.

For this we use a free Google account. There is no data processing agreement with Google for it. Google processes the information under its own terms of service and its own privacy policy, as an independent controller and also for its own purposes stated there. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Processing in the USA by Google LLC is possible. Google LLC is certified under the EU-US Data Privacy Framework, for which there is an adequacy decision of the European Commission of 10 July 2023 (policies.google.com/privacy/frameworks).

The legal basis is Art. 6 (1) (b) GDPR (steps prior to entering into a contract at the request of the data subject) where the person booking is themselves our future contractual partner, otherwise Art. 6 (1) (f) GDPR (our interest and that of their business in setting things up together). Booking is voluntary. If you prefer not to use Google for this, write to us at support@kyth.systems. We delete the appointment and the confirmation email from our calendar and mailbox as soon as we no longer need them for the call and for follow-up questions about it, or earlier on request. How long Google stores the information beyond that is governed by Google’s privacy policy (policies.google.com/privacy).

Direct outreach to businesses by email. We introduce our app KYTH.Kartuu once, in a personal email, to Shopify merchants in the United States and the United Kingdom. We look up the details by hand on the shops’ public websites (home page, contact page, public product list). For the United Kingdom we check the legal form in the public Companies House register and only write to companies in the form of a Ltd, PLC or LLP. For this we process: the name of the shop or company, the website, country, the gift card products offered publicly, the public contact address and, for the United Kingdom, the legal form. The contact address is usually a general address such as info@, sometimes an address containing a person’s name. Personal data are mainly such addresses containing a name.

Stefan Grasse writes and sends each email individually from the mailbox stefan@kyth.systems, without a bulk email service. The mailbox is hosted by INWX (see above in this section). We keep the list of contacted shops locally on a KYTH computer and do not pass it on.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is to introduce our offer to businesses whose shop Kartuu suits (direct marketing, Recital 47 GDPR). The details come from publicly accessible sources.

Objection. You can object at any time to the processing of your data for this marketing (Art. 21 (2) GDPR), by replying to our email or by writing to datenschutz@kyth.systems. We will then not contact you again and delete your details from the list. We keep only the email address and the date of the objection on a suppression list so that we do not contact you again.

Storage period. If you do not reply, we delete the entry three months after our email. If you reply, what is stated above on email contact applies to the correspondence.

9. Meta Pixel (only with consent)

If you agree in the banner, we load the Meta Pixel of Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta"). It measures which ads on Facebook and Instagram lead to visits to this website and to clicks on our listings in the Shopify App Store, and makes it possible to show ads to people who have looked at our products.

The data processed are: pages viewed and time, IP address, browser and device information, the identifier of the _fbp cookie, after an ad click the _fbc identifier, and these events: PageView (page view), ViewContent on the KYTH.Karl and KYTH.Kartuu pages, AppStoreClick when you click a link to the Shopify App Store and AppLinkMail when you click “Email me the link” (only the click is counted; the email is written and sent by your own mail app, and the email itself reaches neither us nor Meta). If you are logged in to Facebook or Instagram, Meta can associate this data with your account.

Attributing app installs (KYTH.Kartuu only): On the KYTH.Kartuu pages, the same consent also lets us set the kyth_klick cookie for kyth.systems and its subdomains. It contains a random identifier, the _fbc and _fbp identifiers, the ad's campaign parameters (utm), the page viewed and the times of the click and of your consent. With “Email me the link”, this information is part of the link in the email; if you open it, we set the cookie on that device too and forward you to the Shopify App Store. If you then install KYTH.Kartuu, the app (kartuu.kyth.systems) reads the cookie and reports the install with these identifiers to Meta via the Conversions API. This tells us which ad led to an install. If you withdraw your consent, we delete the cookie.

The legal basis is your consent under § 25 (1) TDDDG and Art. 6 (1) (a) GDPR. For the collection on this website and the transmission to Meta, we and Meta are joint controllers under Art. 26 GDPR following the judgment of the CJEU of 29 July 2019 (C-40/17, Fashion ID); the arrangement for this is the Controller Addendum in Meta's Business Tools Terms. Meta alone is responsible for any further processing; details are in Meta's Privacy Policy.

You can withdraw your consent at any time with effect for the future via "Privacy settings" in the footer. The pixel then no longer loads. Meta also transfers data to Meta Platforms, Inc. in the USA (section 12).

On our pages in the Shopify App Store (KYTH.Karl and KYTH.Kartuu only): For these two listing pages on apps.shopify.com, we have entered a Meta pixel ID for each in Shopify's Partner Dashboard. Shopify only loads the pixel there if you have agreed to analytics in Shopify's consent prompt and have not opted out of the sale or sharing of your data. Meta then receives the events PageView (page view) and ViewContent with the app's name, ID and price. If you are signed in to Facebook or Instagram, Meta may link these data to your account. The legal basis is your consent (§ 25 (1) TDDDG, Art. 6 (1) (a) GDPR). You can withdraw it via "Your privacy choices" in the footer of the Shopify App Store.

10. Google Analytics and Google Ads (only with consent)

If you agree in the banner, we load the Google tag for Google Analytics 4 provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). It measures how this website is used and which ads on Google lead to visits and to clicks on our listings in the Shopify App Store. Our Google Analytics property is linked to our Google Ads account. This lets us measure the success of our Google ads and show ads to visitors of this website (remarketing).

The data processed are: pages viewed, page title and time, the source of the visit (referrer, after an ad click the click identifier gclid), IP address, browser, device and approximate location information, the identifiers of the cookies _ga and _ga_RFXXMQVV5N, after an ad click _gcl_au, and these events: page_view (page view), app_store_click when you click a link to the Shopify App Store and app_link_mail when you click “Email me the link” (only the click is counted). The Google tag runs in consent mode: it does not load before you agree, and after a withdrawal it reports the refusal to Google. If you are signed in to Google, Google may link these data to your Google account.

The legal basis is your consent under § 25 (1) TDDDG and Art. 6 (1) (a) GDPR. For measurement in Google Analytics, Google processes the data as our processor (Art. 28 GDPR, Google Ads Data Processing Terms). For advertising features such as remarketing, Google also processes data as an independent controller; details are in Google's Privacy Policy and under "How Google uses information from sites".

You can withdraw your consent at any time with effect for the future via "Privacy settings" in the footer. The Google tag then no longer loads, and we delete the cookies _ga, _ga_RFXXMQVV5N and _gcl_au. Google also transfers data to Google LLC in the USA (section 12).

On our pages in the Shopify App Store: For our listing pages of KYTH.Karl, KYTH.Kartuu and KYTH.Kolli on apps.shopify.com, we have entered the same Google Analytics property in Shopify's Partner Dashboard (measurement ID G-RFXXMQVV5N). Shopify embeds the Google tag there and only loads it if you have agreed to analytics in Shopify's consent prompt and have not opted out of the sale or sharing of your data. We use it to measure how often our listing pages are viewed and how often the install button there is clicked. Where we have also entered an API secret there (for example for KYTH.Kolli), Shopify additionally reports from its own servers when the app is installed. The legal basis is your consent (§ 25 (1) TDDDG, Art. 6 (1) (a) GDPR). Recipients, the transfer to the USA and the retention period in our property are the same as on this website (sections 12 and 13). You can withdraw your consent via "Your privacy choices" in the footer of the Shopify App Store. Any other processing in the Shopify App Store is governed by Shopify's Privacy Policy.

11. Processors and Recipients

We use the following service providers. Data-processing agreements under Art. 28 GDPR are in place with all recipients listed; for providers with third-country involvement we additionally rely on EU Standard Contractual Clauses pursuant to Art. 46 (2) (c) GDPR.

  • Cloudflare, Inc. (USA / EU edge): website hosting, DNS and CDN.
  • IONOS SE (Germany): hosting of our product backend karl.kyth.systems including the encrypted newsletter subscriber list; servers located in Berlin.
  • INWX (Berlin, Germany): hosting of our kyth.systems mailboxes and sending of newsletter / confirmation emails (SMTP); servers located in Germany.
  • GitHub, Inc. (USA, Microsoft group): source-code management and build pipeline (does not process end-user data of this website but is part of our infrastructure).

12. Third-Country Transfers

Transfers to the USA occur to Cloudflare (website hosting) and GitHub (infrastructure). We base these transfers on EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914) and on supplementary technical safeguards offered by the providers (TLS in transit, access controls, EU region where available). Where the respective provider is certified under the EU-U.S. Data Privacy Framework, we alternatively rely on the EU Commission adequacy decision (Art. 45 GDPR). The processing of your newsletter data (storage and email delivery) takes place exclusively in Germany.

With your consent to the Meta Pixel (section 9), Meta also transfers data to Meta Platforms, Inc. in the USA. Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework; the transfer is based on the EU Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR).

With your consent to Google Analytics and Google Ads (section 10), Google also transfers data to Google LLC in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework; the transfer is based on the EU Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR).

13. Retention Periods

  • Server logs (Cloudflare): per Cloudflare's standard policy, generally up to 30 days.
  • Reach data without personal reference (Cloudflare Workers Analytics Engine, section 5): three months according to Cloudflare.
  • Your choice in the consent banner (LocalStorage, section 3): until you change it or clear your browser storage.
  • Closing the banner with the X (SessionStorage, section 3): until you close the tab or browser.
  • Meta Pixel (section 9): the kyth_klick cookie for 90 days, the _fbp cookie for 90 days according to Meta; how long Meta keeps the transmitted data is governed by Meta's Privacy Policy.
  • Google Analytics and Google Ads (section 10): the cookies _ga and _ga_RFXXMQVV5N for two years according to Google, _gcl_au for 90 days according to Google; in our Google Analytics property, event data for two months and user data for 14 months (the property's retention settings, as of 5 October 2026). The same periods apply to the measurement on our pages in the Shopify App Store.
  • Newsletter email address: until you unsubscribe, then deleted immediately. Unconfirmed sign-ups are automatically deleted after no more than 30 days.
  • Email correspondence: for as long as needed to handle the request, plus statutory retention.
  • Telephone calls: notes on the call for as long as needed to handle the request, plus statutory retention. Your phone number and the time of the call remain in the phone’s call list until they are deleted or overwritten there.
  • Appointment booking (section 8): the appointment and confirmation email until we no longer need them for the call and follow-up questions, or earlier on request; storage at Google is governed by Google’s privacy policy.
  • Direct outreach by email (section 8): without a reply, three months after our email; after an objection, only the email address and date on a suppression list.

14. Your Rights

You have the following rights with regard to your personal data:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object to processing based on legitimate interests (Art. 21 GDPR)
  • Right to withdraw consent with effect for the future (Art. 7 (3) GDPR)

To exercise these rights, an informal email to datenschutz@kyth.systems is sufficient.

15. Right to Lodge a Complaint

You have the right to lodge a complaint with a data-protection supervisory authority. Locally competent for us is:

Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18
91522 Ansbach
Germany

16. Changes to this Privacy Policy

We update this privacy policy whenever processing activities change or new legal requirements arise. The current version is always available at this URL; the date of the latest revision is shown at the top.