Privacy Policy

Last updated: November 2026

1. Controller

The controller responsible for processing personal data in connection with Kayio is:

Shahab Hassani-Müller
Försterweg 167
22525 Hamburg
Germany

Email: privacy@kayio.app

Kayio is operated as a sole proprietorship.

2. General information

Protecting your personal data is important to us.

This Privacy Policy explains which personal data is processed when you use Kayio, the purposes of that processing, and your rights under the General Data Protection Regulation (GDPR).

Kayio is an application for organising purchases, receipts, return deadlines, warranty information and related documents.

3. Which personal data does Kayio process?

Depending on how you use the application, the following data in particular may be processed:

The data actually processed depends on which features you use.

4. User account

When you create a Kayio account, we process the information required for this, in particular your email address and a unique user identifier.

This information is processed to create and manage your user account, authenticate you and provide the features you request. You sign in without a password using a login code or login link sent by email.

Alternatively, you can sign in with your Google account. In that case Google transmits to us your email address as well as the name and profile picture of your Google account; no password is stored with us in this case either. The provider is Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Further information about privacy at Google is available at:
https://policies.google.com/privacy

In the iOS app you can also sign in with your Apple account. Apple then transmits your email address to us – a relay address generated by Apple if you choose to hide your address – and, on first sign-in, your name. The provider is Apple Distribution International Ltd. (Hollyhill Industrial Estate, Hollyhill, Cork, Ireland). Further information about privacy at Apple is available at:
https://www.apple.com/legal/privacy/

The legal basis is Article 6(1)(b) GDPR, insofar as the processing is necessary to perform the agreement governing your use of the service.

5. Purchase and receipt data

When you save purchases or receipts in Kayio, the following information, among other things, may be processed:

This data is processed to provide the Kayio features you request, in particular organising your purchases, reminders about return deadlines and warranties, and exporting warranty documents.

The legal basis is Article 6(1)(b) GDPR, insofar as processing is necessary to provide the services you request.

6. Receipt processing and automatic data recognition

Kayio uses technologies to automatically recognise and process information from uploaded receipts and forwarded order emails.

For example, retailers, product names, purchase dates, purchase prices and return deadlines may be recognised automatically.

Kayio uses Anthropic as a technical service provider for this automatic recognition (see the “Anthropic” section).

Automatically recognised information may be incorrect or incomplete. You should check automatically recognised information, particularly important details and deadlines, and correct it where necessary.

7. Reminders

Kayio can send you email reminders about return and warranty deadlines that you have saved or that have been determined automatically.

These reminders are solely intended to help you stay organised. Kayio does not provide legal advice and does not guarantee that a particular deadline or entitlement actually exists.

The information displayed may be based on your entries, automatically recognised information or automated calculations. Estimated deadlines are labelled as estimates.

You are responsible for checking important deadlines and conditions with the relevant retailer, manufacturer or contracting party.

8. Email processing

If you forward emails to the address provided by Kayio, Kayio processes their contents. This may include the following information in particular:

This information is processed to automatically recognise purchases and create corresponding purchase records in Kayio. Forwarded order emails are stored in association with your account so that they are available to you, for example when exporting warranty documents.

Kayio has no access to your mailbox. Only emails forwarded to a Kayio address are processed. Each account has its own forwarding address assigned to it alone; emails sent to that address are attributed to your account regardless of the address they come from. You can also link further email addresses of your own to your account so that forwards from them are recognised; for this we store the address and the confirmation code in unreadable (hashed) form. Emails that are neither addressed to a valid forwarding address nor sent from a linked address are rejected and not stored.

Gmail add-on: If you use the Kayio add-on in Gmail and tap "Save to Kayio" in an open email, the add-on transmits the content of that one email to Kayio, where it is processed like a forwarded order email. The add-on does not read any other emails and runs on Google's Apps Script infrastructure (Google Ireland Limited); only your Kayio forwarding address is stored there.

If you set up automatic forwarding with your email provider, we forward the provider’s confirmation message (e.g. Google’s confirmation code) to your account email address.

Kayio uses Cloudflare to receive forwarded emails (see the “Cloudflare” section).

9. Notifications

Kayio sends you notifications, for example about upcoming return deadlines and expiring warranties. They are delivered by email and, in the Android app, additionally as push notifications. In the settings you can turn email and push notifications on and off independently of each other.

Push notifications require you to grant the corresponding permission on your device. In that case a device registration identifier (token) issued by Google is created and stored by us in order to deliver notifications to your device; delivery itself takes place via Firebase Cloud Messaging (see the “Google Firebase Cloud Messaging” section). The registration identifier as well as the title and text of the notification are transmitted; the text contains the description of the purchase concerned and the associated date. If you do not grant the permission, or if you turn push notifications off, no such data is transmitted.

The registration identifier is deleted as soon as you turn off push notifications, sign out, uninstall the app or delete your account.

You can turn warranty reminders on and off for each purchase. Return reminders stop once you mark a purchase as kept or returned, or once the deadline has passed.

10. Supabase

Kayio uses Supabase for backend infrastructure, its database, authentication and data storage. The database and storage operate in the European Union (Frankfurt region).

Personal data may be processed and stored to the extent necessary to operate Kayio.

Further information about privacy at Supabase is available at:
https://supabase.com/privacy

11. Resend

Kayio uses Resend to send emails (login emails and notifications).

In particular, email addresses, technical metadata and content required for delivery may be processed.

Further information about privacy at Resend is available at:
https://resend.com/legal/privacy-policy

12. Anthropic

Kayio uses Anthropic (Claude) to automatically recognise purchase information. For this purpose the document in question is transmitted in full to Anthropic's programming interface:

The documents may therefore also contain details that Kayio does not need, such as a delivery address, a customer number or payment details. No redaction takes place before transmission. Kayio receives back structured data only (retailer, items, prices, currency, date, warranty and return details, order and tracking number); only this is stored in your account.

Anthropic processes the data on our behalf under a data processing agreement. Inputs and outputs are stored at Anthropic for up to 30 days and then deleted. If content is flagged by Anthropic's automated safety systems as a suspected violation of its usage policy, it may be retained for up to two years. Your data is not used to train AI models. Processing takes place outside the European Union, including in the USA (see the section "Transfers to third countries").

Our contracting party and processor is Anthropic Ireland, Limited (Dublin, Ireland). Processing takes place on Anthropic's infrastructure outside the EU, including in the USA (Anthropic, PBC, 548 Market Street, San Francisco, CA 94104, USA).

The legal basis is Article 6(1)(b) GDPR insofar as the recognition is part of the service you requested; for third-party details contained in a receipt, Article 6(1)(f) GDPR (legitimate interest in the automatic capture of your purchases).

Further information about privacy at Anthropic is available at:
https://www.anthropic.com/legal/privacy

13. Cloudflare

Kayio uses Cloudflare for domain management and to receive emails forwarded to the Kayio address (email routing).

Further information about privacy at Cloudflare is available at:
https://www.cloudflare.com/privacypolicy/

14. PostHog

Kayio uses PostHog to analyse application usage and improve the user experience. Kayio uses PostHog’s EU cloud.

Usage events, technical information and pseudonymous user identifiers are processed. No analytics cookies are set and no session recordings are made.

Further information about privacy at PostHog is available at:
https://posthog.com/privacy

15. Sentry

Kayio uses Sentry to detect, analyse and resolve technical errors. Kayio uses Sentry’s EU data region.

Technical information about the device used, the application and error conditions may be processed.

Further information about privacy at Sentry is available at:
https://sentry.io/privacy/

16. Google Firebase Cloud Messaging

Kayio uses Firebase Cloud Messaging, a service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), to deliver push notifications to Android devices.

The device registration identifier as well as the title and text of the respective notification are processed for this purpose. This processing only takes place if you have enabled push notifications (see the “Notifications” section). No other Firebase services are used, in particular no analytics or crash reporting services.

Further information about privacy at Google is available at:
https://policies.google.com/privacy

17. Data sharing

As a general rule, personal data is shared only where necessary to operate Kayio, where a legal obligation exists, or where there is another lawful basis for processing.

We use carefully selected technical service providers that process personal data only to the extent necessary to provide their respective services.

Where legally required, appropriate data processing agreements are concluded in accordance with Article 28 GDPR.

18. Transfers to third countries

Some service providers used by Kayio may process personal data outside the European Union or the European Economic Area.

Any transfer to a third country takes place in accordance with the legal requirements of the GDPR. In particular, European Commission adequacy decisions or standard contractual clauses under Article 46 GDPR may be used for this purpose.

The automatic recognition of receipts and emails by Anthropic (section 12) takes place outside the European Union, including in the USA. This transfer is based on the European Commission's standard contractual clauses (Article 46(2)(c) GDPR), which form part of our contract with Anthropic; in addition, the data is encrypted in transit and at rest, deleted after 30 days at the latest and not used for training. Kayio's own database and file storage are located in the European Union (section 10).

19. Retention periods

We retain personal data only for as long as necessary for the relevant purposes or as required by statutory retention obligations.

Purchase data and receipts are generally stored for as long as they are needed for your Kayio account, or until you delete them or delete your account.

When you delete entries in Kayio, they are initially marked as deleted so that you can undo the deletion for a short time, and are permanently removed after 30 days.

Technical logs and analytics data may be stored for shorter periods.

Invitations to a family vault: the invited email address is stored for as long as the invitation is open (7 days). After acceptance the invitation is deleted immediately; after expiry, on the following day.

At Anthropic, documents transmitted for recognition are stored for up to 30 days (section 12).

20. Account deletion

You can delete your Kayio account yourself at any time in the application settings. Even without the app installed, you can request deletion of your account and all associated data here:
https://kayio.app/en/delete-account

Alternatively, you can request deletion by emailing privacy@kayio.app.

Following account deletion, personal data is deleted unless statutory retention obligations or other legal grounds require its continued storage. Data may remain in backups for a limited period before being permanently deleted.

If you are a member of a family vault with other members, the following applies when you delete your account: your account, profile, notifications, return events and device identifiers are deleted. Purchases you shared in the vault remain in the vault together with their receipts, order emails and return documents and are assigned to the owner; purchases you marked as private are deleted. If you delete your account as the owner, the vault passes to the longest-standing member. We point this out before deletion. If you nevertheless want shared receipts deleted or redacted, you can request this at privacy@kayio.app; we assess each case individually (see the section "Family vault").

21. Family vault

You can invite up to four other adults into your vault (Kayio Family). Each member has their own account and joins by accepting the invitation. Before joining, we show the consequences of joining and ask for acknowledgement.

Invitation: we store the invited email address and send it an invitation email with a link valid for 7 days; the link itself is stored only in hashed form. The retention period of the invitation is described in the section "Retention periods".

What members see of each other: the sign-in email address of the other members and all shared purchases in the vault, including receipt photos, archived order emails, invoices and return documents. Every member can edit and delete shared purchases. Each member receives reminders for shared purchases according to their own settings and in their own language.

Private purchases: you can mark any purchase you filed as private. Then only you see it and its documents, only you receive reminders for it, and only you can change that marking. When joining, you decide whether your existing purchases are brought into the vault as shared or as private.

Leaving and removal: if you leave the vault or are removed by the owner, the purchases you shared remain in the vault together with their documents and are assigned to the owner; you take private purchases with you into your own vault. For deleting your account, see the section "Account deletion".

Details of other people: receipts may contain details of other people, for example a shared delivery address or the name of a family member. We process these details as part of the receipt for the members of the vault. Requests for access or deletion concerning such receipts – including from former members and from people without a Kayio account – should be sent to privacy@kayio.app. We assess them individually, because a receipt may contain data of several people and other members may need it for ongoing return or warranty cases.

The legal basis is Article 6(1)(b) GDPR towards each member for providing the shared vault; for third-party details in receipts, Article 6(1)(f) GDPR (the members' legitimate interest in a complete record of receipts, comparable to a jointly kept folder in the household).

22. Your rights

Subject to the applicable legal requirements, you have the following rights in particular:

To exercise your rights, you can contact us at any time at: privacy@kayio.app

23. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data.

The competent supervisory authority for Hamburg is:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
Ludwig-Erhard-Straße 22
20459 Hamburg
Germany

Website: https://datenschutz-hamburg.de/

24. Data security

We implement appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration or disclosure.

However, complete security when transmitting and storing data over the internet cannot be guaranteed.

25. Children’s privacy

Kayio is not specifically directed at children. We do not knowingly collect personal data from children in breach of legal requirements.

26. Changes to this Privacy Policy

We may amend this Privacy Policy if Kayio’s features, the service providers we use or legal requirements change.

The current version is made available on the Kayio website. The date of the last update appears at the beginning of this Privacy Policy.

27. Contact

If you have questions about privacy or the processing of personal data, you can contact us at any time:

Shahab Hassani-Müller
Försterweg 167
22525 Hamburg
Germany

Email: privacy@kayio.app