Privacy policy

Who is responsible

The controller for this website within the meaning of the GDPR is:

Name

Daniel Fischer, trading as digitalpositiv

Postal address

Türltorstraße 4, 85276 Pfaffenhofen an der Ilm, Germany

Email

support@kirat.ai

Full publisher details are in the Imprint.

At a glance: who receives what

• 01Visiting this websiteCloudflare, the hosting provider, processes connection data as our processor, to deliver the pages and for security. No cookies, no analytics, no tracking.
• 02Buying KiratLemon Squeezy, the merchant of record, as its own controller.
• 03Setting up Kirat in a Claude Code cloud environmentCloudflare, which also hosts the download, processes connection data as our processor, including the IP address the setup script's request comes from, to deliver the file and for security.
• 04Emailing usThe publisher, to answer you. Cloudflare Email Routing forwards your message to the publisher's mailbox at our email hosting provider.
• 05Calling usAn AI phone assistant run by fonio GmbH (Vienna, Austria) as our processor takes your call and a transcript, so that we can call you back.
• 06Using KiratOpenAI and Google, directly, under your accounts — from your computer, or in Claude Code cloud sessions from your own cloud environment through Anthropic's network proxy for that environment. The publisher receives nothing.
• 07Kirat's local filesThe folder .kirat in your home folder. You can delete it at any time.

This website and the cloud download

Hosting and connection data

This website consists of static pages. It is hosted on Cloudflare (Workers static assets), a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA.

When you open a page, your browser sends a request to Cloudflare's servers. To deliver the page and for security, Cloudflare processes connection data: your IP address, the time of the request, the requested URL and your browser's user agent.

Purpose: delivering the website, and its security and stable operation, for example detecting and fending off attacks. Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is a secure, working website.

Retention: the publisher does not receive or store access logs on the hosting plan we use. Cloudflare retains them according to its own policies: cloudflare.com/privacypolicy.

Cloudflare acts as our processor under its Data Processing Addendum (Art. 28 GDPR): cloudflare.com/cloudflare-customer-dpa. Cloudflare is based in the USA. Transfers to the USA are based on Cloudflare's certification under the EU-U.S. Data Privacy Framework and on the Standard Contractual Clauses in the Data Processing Addendum.

No cookies, no tracking

• This website sets no cookies.
• It runs no analytics and no tracking.
• It loads no content from third parties. The fonts are self-hosted: they load from this website, so your browser sends no requests to Google.
• Once checkout opens, the buy buttons are plain links: you leave this website for Lemon Squeezy's checkout only when you click one.

Download of the cloud package

If you use Kirat in Claude Code cloud sessions, the setup script in your cloud environment fetches the Kirat package from Cloudflare, the same host as this website. For this request, Cloudflare processes the same connection data: the IP address the request comes from, the time, the requested URL and the user agent.

Purpose: delivering the file you bought, and the security of the download. Legal basis: Art. 6(1)(b) GDPR for the delivery; Art. 6(1)(f) GDPR for security, our legitimate interest being a secure download. Retention: the publisher does not receive or store these access logs; Cloudflare retains them according to its own policies.

Cloudflare acts as our processor here as well, on the same terms as for this website: under its Data Processing Addendum, with transfers to the USA based on the EU-U.S. Data Privacy Framework and the Standard Contractual Clauses.

Local use of Kirat on your computer does not contact the download host.

Buying Kirat

Kirat is sold through Lemon Squeezy as merchant of record. Lemon Squeezy processes the checkout and the payment as its own controller, under its own privacy policy: lemonsqueezy.com/privacy.

Checkout has not opened yet. Before it does, this section will state which order details Lemon Squeezy passes to the publisher, for what purpose, on which legal basis, and how long they are kept.

Contacting us by email or phone

If you email us, we process your email address, your message and any details you include, in order to answer you.

Legal basis: Art. 6(1)(b) GDPR where your message concerns a purchase or your license; otherwise Art. 6(1)(f) GDPR, our legitimate interest in answering inquiries.

We delete the correspondence when it is no longer needed, unless statutory retention periods require us to keep it.

Emails to support@kirat.ai pass through Cloudflare Email Routing, a service of Cloudflare, Inc., which forwards them to the publisher's mailbox at our email hosting provider. Cloudflare and the email hosting provider act as our processors (Art. 28 GDPR); for Cloudflare, the terms in section 03 apply.

By phone

Calls to the number in the imprint are answered first by an AI phone assistant, also outside office hours. We process your phone number, your request and an automatic transcript of the call, in order to handle your request and call you back. Legal basis: Art. 6(1)(b) GDPR where the call concerns a purchase or your license; otherwise Art. 6(1)(f) GDPR, our legitimate interest in being reachable by phone.

The service is fonio, provided by fonio GmbH, Neustiftgasse 73–75/3/7, 1070 Vienna, Austria. fonio processes the data only on our behalf and on our instructions under a data processing agreement (Art. 28 GDPR). Austria is in the EU, so no transfer to a third country takes place. You don't have to use this channel: by email you reach us without an AI assistant. We delete recordings and transcripts when they are no longer needed and no statutory retention period applies.

Providing your details is voluntary, but without them we cannot answer your request.

The Kirat software

No telemetry

Kirat has no server and no account with us, and it sends no telemetry. The publisher receives no data from the software: not your API keys, not your questions, not your results. Fetching the cloud package is covered in section 03.

What goes to OpenAI and Google

Everything you give Kirat (questions, context, code, images) goes directly to OpenAI and Google — from your computer, or in Claude Code cloud sessions from your own cloud environment through Anthropic's network proxy for that environment. It is sent with your own API keys, under your accounts with them and their terms. The publisher is not part of this transfer.

In Claude Code cloud sessions, Kirat runs in your cloud environment on Anthropic's servers.

OpenAI and Google process this data under their own privacy policies:

• OpenAI: openai.com/policies/privacy-policy
• Google: policies.google.com/privacy

If your data may not go to OpenAI or Google, do not use Kirat for it.

Local files on your computer

Kirat keeps a folder named .kirat in your home folder. It contains:

• the daily cost counter and the cost log;
• the last 20 results — these contain your questions and the answers;
• the log of delegated decisions;
• generated images.

All Kirat sessions on the computer share this folder, in Claude Desktop and in Claude Code. You can delete it at any time. In a Claude Code cloud session, the folder lives in the session's cloud environment and ends with the session.

Your API keys

You enter your API keys in Claude's own install or settings dialog. Claude Desktop stores them in your operating system's secure storage (macOS Keychain, Windows Credential Manager). Claude Code stores them in the macOS Keychain; on Windows and Linux in ~/.claude/.credentials.json, readable only by your user account. In Claude Code cloud sessions, you store them as environment variables of your cloud environment; everyone who uses that environment can read them. The publisher never sees them.

We recommend a separate project at each provider, with a spending limit.

Your rights

Regarding your personal data that we process, you have the right to:

• access (Art. 15 GDPR);
• rectification (Art. 16 GDPR);
• erasure (Art. 17 GDPR);
• restriction of processing (Art. 18 GDPR);
• data portability (Art. 20 GDPR).

Right to object: where we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).

We do not use automated decision-making or profiling (Art. 22 GDPR). Connection data is technically necessary to deliver the pages and the cloud package; Cloudflare shows us only aggregated traffic statistics such as request counts, and we receive no individual access logs.

To use these rights, email us at the address in section 01. For data that Lemon Squeezy, OpenAI or Google process as their own controllers, contact them directly.

Right to complain to a supervisory authority

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state where you live, where you work or where the alleged infringement took place.

The authority responsible for the publisher is:

Authority

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)

Postal address

Promenade 18, 91522 Ansbach, Germany

Website

www.lda.bayern.de