Legal

Privacy Policy

Introduction

Updated 4 October 2026. This policy explains how Kilo uses information about you when you visit our website, use the platform or contact us. It also explains how to request a copy, correction or deletion of your personal information.

CHIRP USA LLC operates the Kilo software platform. Kilo is the product name. We decide how account, billing, website and support information is used. When a business customer decides why and how personal information from its connected devices is used, we handle that information on its instructions. These roles are called controller and processor, respectively. This policy concerns the platform; Kilo IoT GmbH is a separate hardware business. CHIRP USA LLC is a US company, but its location alone does not tell you where each service or provider processes information. Section 6 explains international processing. GDPR means the European Union's General Data Protection Regulation.

Contact Us

For privacy questions or requests, email info@kiloiot.de. Explain which service or account is involved and what you want us to do. Send only the information needed to identify your request. Do not include passwords, API keys or unnecessary copies of identity documents. We may ask for proportionate additional information if we reasonably need to confirm your identity or your authority to act for someone else.

1. Purpose of this Privacy Policy

This policy covers personal information collected through kiloiot.io, Kilo platform accounts, connected-device services, the AI assistant and support. Personal information is information that identifies someone or can be linked to them. Device names, locations, readings and camera information can fall into this category depending on their use.

Third-party links: This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.

2. Data we collect about you

The information involved depends on what you do: browse a page, send an enquiry, create an account, connect devices or choose an additional service. The sections below explain those uses.

a. Data processing during general use of our website

Your browser sends connection information when it requests a page. Optional analytics and advertising technologies involve additional information and depend on your choices.

(1) Internet connection data

When you call up our website, we process the internet connection data that your browser automatically transmits to our server. This is your IP address and other usage data (e.g. date and time of the call, name of the page called up, amount of data transferred and the requesting provider). We need this information to enable you to use our website, for example by adapting the website to the technical requirements of your device.

We use connection information to deliver and protect the website. The legal basis is our legitimate interest in a secure, usable service, Article 6(1)(f) GDPR. Our published retention commitment for these website connection records is 35 days. This is separate from the periods for platform security records, enquiries and supplier-held copies; contact us about the records relevant to your request.

(2) Cookies

We use tracking technologies on our website that enable us or also our contractual partners or service providers to collect data relating to the use of our website. These tracking technologies are usually referred to as cookies, which is why we also use this term in the following. However, the following also applies accordingly to other tracking technologies or file formats, such as local storage, pixels, beacons or tags.

Cookies are text files that are saved to the browser on your end device. User-related pseudonymous data can be stored for these files. This data can then be read out again.

When you visit our website for the first time, we display a so-called cookie consent banner to inform you about the tracking technologies we use and to give you the choice of which optional cookies you would like to agree to. You can change your choice at any time in the Privacy Preference Centre on our website.

(i) Technically necessary cookies: In certain cases, the storage of information on your device or access to information already stored on your device is absolutely necessary so that we can make our website available to you for use ("Necessary Cookies"). Insofar as this information has a personal reference and is processed by us in our IT systems, the legal basis for this data processing is our justified interest in providing our website and ensuring the availability of our services, Art. 6(1)(f) GDPR.

(ii) Cookies requiring consent: We only use cookies that are not technically essential with your consent. We use the following categories of consent-requiring cookies:

Performance cookies: These cookies help measure visits, traffic sources and how people use pages. Reports may be aggregated, but the identifiers and other information used to produce them can still be personal information. You can decline optional analytics.

Functional cookies: These cookies enable the website to provide enhanced functionality and personalisation. They may be set by us or by third parties whose services we use on our sites. If you do not allow these cookies, some or all of these services may not work properly.

Cookies for marketing purposes: These cookies and similar technologies help advertising providers measure campaigns and may recognise your browser or device across visits. An identifier can be personal information even when it does not contain your name. You can decline optional marketing technologies.

You can find more information about the file names, storage duration, provider and category of the respective cookie in the cookie settings of the cookie consent banner or the data protection preference centre of the website. By clicking on the respective button (e.g. "Accept all cookies" or "Confirm selection") in the cookie consent banner or the data protection preference centre, you consent both to the storage and reading of information in these optional cookies via our website and to the further processing of any personal data (Art. 6(1)(a) GDPR).

(iii) Google Tag Manager

We use Google Tag Manager, provided by Google LLC, to control analytics and advertising tags. Google Tag Manager is a tag-management system and does not itself create user profiles. We load it only after you consent to the Statistics or Marketing category in our Cookie Consent Banner. The tags delivered through it are restricted by your selected consent categories. The legal basis for processing by optional analytics or advertising tags is your consent under Art. 6(1)(a) GDPR.

(iv) Google Analytics

As a tool of a US provider, we use the Google Analytics by Google (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, US). By clicking on the respective button (e.g. "Accept all cookies" or "Confirm selection") in the Cookie Consent Banner or the Privacy Preference Center, you consent both to the storage and retrieval of information in this optional cookie and to the further processing of any personal data retrieved (Art. 6(1)(a) GDPR). If you consent to the setting of the Google Analytics cookie, Google will collect data relating to your use of our website. This enables Google to assign data relating to usage behaviour on our website to this respective pseudonymous user. We have commissioned Google to use this information to evaluate the usage behaviour of the website, to compile reports on website activities and to provide us with further services related to website and internet usage. The data processed by Google, in particular your IP address, is also stored on Google servers in the USA.

(v) Google Ads attribution and conversion measurement

If you consent to Marketing cookies and arrive through an advertisement, we may process the advertising click identifier supplied by Google (gclid, wbraid or gbraid), campaign parameters, the capture time and a record of your consent. If you continue to app.kiloiot.io and create an account, we may associate this pseudonymous advertising information with your authenticated user and organisation so that genuine funnel events, such as account activation, creation of a protocol-neutral digital device, or a paid invoice, can be measured. Click identifiers are encrypted at rest, are not logged in raw form, and expire no later than 90 days after capture. We may send Google the click identifier and the event time and, for paid invoices, value and currency. If enhanced conversion matching is separately enabled, we may send a normalised, one-way SHA-256 hash of your email address rather than the raw address. The legal basis is your consent under Art. 6(1)(a) GDPR. Withdrawing Marketing consent stops new attribution and removes active attribution from our system; account deletion also triggers deletion from the attribution store. Google may process this data in the USA.

(vi) Ryze conversion measurement

If you consent to Marketing cookies, we load the Ryze pixel of Ryze AI, operated by Meow AI LLC, San Francisco, CA, USA ("Ryze"). Ryze helps us measure which advertising campaigns lead to sign-ups, booked calls, newsletter subscriptions and contact requests. Once loaded, the pixel records page views, clicks and form submissions on our website together with advertising click identifiers (for example gclid or fbclid), campaign (UTM) parameters, and a pseudonymous first-party identifier that Ryze stores in cookies on your device ("_rza" for up to 400 days, "__ryze_i" for up to 90 days and "__ryze_c" holding your consent state). We do not pass your email address or telephone number to Ryze. The legal basis is your consent under Art. 6(1)(a) GDPR. Withdrawing Marketing consent stops the collection and deletes the identifier stored on your device. Ryze may process this data in the USA.

(vii) Content Delivery Network (Cloudflare)

We use the service "Cloudflare". The provider is Cloudflare Inc, 101 Townsend St, San Francisco, CA 94107, USA (hereinafter "Cloudflare"). Cloudflare offers a globally distributed content delivery network with DNS. This technically routes the transfer of information between your browser and our website via Cloudflare's network. This enables Cloudflare to analyse traffic between your browser and our website and act as a filter between our servers and potentially malicious traffic from the internet. In doing so, Cloudflare may also use cookies or other technologies to recognise internet users, but these are used solely for the purpose described here. The use of Cloudflare is based on our legitimate interest in providing our website as error-free and secure as possible (Art. 6(1)(f) GDPR), as well as on your consent pursuant to Art. 6(1)(a) GDPR with regard to the cookies set.

(viii) Withdrawal of your consents

You can withdraw your consents given in the cookie consent banner at any time for the future (Art. 7(3) GDPR). To do so, call up the data protection preference centre on our respective website. You can access the data protection preference centre by clicking on the link "Cookie Settings" in the footer of our website. In the data protection preference centre, you have the option to withdraw any consent you have already given by deselecting the relevant cookies. You can also select additional cookies and give us further consent. Your selection of optional cookies will in turn be saved as a cookie in your browser.

3. Accounts, connected devices and support

When you register, we process your email address and sign-in information to create and protect your account. If you add profile details or join an organisation, we process those details and your membership and permissions. We use this information to provide the requested service, under Article 6(1)(b) GDPR.

Connected devices send readings and related information, such as the device identifier, measurement time and the name or location assigned to the device. The platform uses them for storage, charts, rules and alerts. Notifications use the contact details or device tokens for the channels you select. Paid services also involve subscription, billing and transaction information. The information involved depends on the features you use.

If you use our contact form, we receive your name, email address, subject and message. The form uses ZeptoMail to send the enquiry to our company mailbox. Support requests may also reach the team through email and Telegram. We use the information to answer your request and manage the service or proposed contract, under Article 6(1)(b) GDPR where that applies. Requests made under data-protection law are handled under the relevant legal duty, Article 6(1)(c). Other necessary business correspondence is assessed under our legitimate interests, Article 6(1)(f). Include only information needed for the enquiry.

3.1 The AI assistant and connected AI applications

Kilo includes an AI assistant. You can also connect a separate AI application to your account through the Model Context Protocol (MCP) connection. The built-in assistant uses your signed-in account and selected organisation for its requests. Check the access you grant, review proposed actions and read any confirmation before approving a change to devices or data.

To answer a request, the built-in assistant sends your messages and relevant platform information, such as device names, readings, rules or alarms, to the selected model provider. Kilo's configured route uses OpenRouter, which forwards requests to the selected model. Messages, answers and information returned by tools can appear in conversation history. Avoid passwords and unrelated confidential information. Provider retention, processing locations and use for model training depend on the applicable provider arrangement and settings; this policy does not promise that every model route has the same terms or keeps no copies. Contact us for the arrangement applicable to your use before sending information subject to special restrictions.

If you supply your own model-provider credentials or connect an external AI application, information sent to it is also handled under your agreement with that provider. Review its retention, training and privacy settings before use. Kilo remains responsible for its own handling of information. Disconnecting an application ends the connection; it does not itself erase information the application or its provider already received.

The legal basis for this data processing is the fulfilment of the contract concluded with you for the use of our service, Art. 6(1)(b) GDPR.

4. Newsletter requests and marketing choices

If you request the newsletter on this website, the form sends your email address, page language and signup page to our company mailbox through ZeptoMail. We are not currently sending newsletters. Your request is for Kilo email updates and is based on consent under Articles 6(1)(a) and 7 GDPR. It is separate from an ordinary contact or support enquiry.

You can withdraw consent or object to direct marketing at any time, without giving a reason, by emailing info@kiloiot.de. Tell us which address or subscription is involved. Withdrawal ends permission for future consent-based marketing; it does not make earlier lawful use unlawful. Any record retained to respect your objection or demonstrate lawful handling must be limited to that purpose. Removing an address from a mailing list and removing provider or mailbox copies are separate steps.

5. Disclosures of your personal data

The services you use determine which providers receive information. Relevant categories include infrastructure and hosting, website delivery and security, communications, payment processing, analytics and the AI providers described in section 3.1. We must put the required contractual and data-protection arrangements in place where a provider processes personal information for us. Naming a provider here is not a certification or a guarantee about all of its services.

An AI application or model provider you choose can receive your messages and information retrieved for your request. The provider's own terms cover its handling, alongside Kilo's duties for the part it performs. Ask info@kiloiot.de for the providers and arrangements relevant to your service. We disclose information for other purposes only where a valid legal basis permits or requires it.

6. International transfers

CHIRP USA LLC is based in the United States. The platform uses Hetzner for cloud infrastructure; other providers may process information or provide support from other countries. A US company address does not mean that all information is stored in the US, and an EU server address does not cover every onward recipient. Where the GDPR requires safeguards for a transfer outside the European Economic Area, the applicable route must meet those requirements. Contact info@kiloiot.de for the countries, recipients and transfer arrangements relevant to your service, including how to obtain any applicable safeguards.

7. Data security

We use account access controls and security procedures to protect personal information and handle suspected incidents. The protection required depends on the service and information involved. Limit access to people who need it, protect your sign-in details and report suspected misuse to info@kiloiot.de. We must assess a personal-data breach and notify affected people and the relevant authority when the law requires it.

8. Keeping information and completing deletion

Different records have different purposes. We need account information to provide an active account, messages to answer an enquiry, and transaction records for billing and applicable legal duties. The retention rules describe what may be kept; they do not mean that closing a login automatically deletes every related record. Contact us if you want an account closed, personal information erased or company data returned.

For an enquiry, the relevant period depends on resolving the request and any necessary follow-up. If part of the exchange is needed for a contract, legal duty or specific legal claim, that record has its own purpose and retention requirements. A general possibility of future usefulness is not a reason to keep the whole exchange indefinitely. For a newsletter request, withdrawal or objection ends the marketing purpose; limited consent or objection records have a separate purpose.

Billing and transaction records have separate retention requirements for accounting, tax and specific legal claims. The relevant event may be a transaction, the end of a tax period or an applicable filing date, rather than the day your account closes. We must identify the applicable duty and keep only the necessary records. These reasons do not justify keeping every customer profile, message or reading for the same period.

A deletion result must distinguish active records, copies held by providers and backups. Backup copies can have a separate expiry cycle. Information retained for a specific legal reason must be limited to that reason, and deleted information must not be restored to ordinary use. We will explain any remaining records and the applicable reason or next step in the response to your request. Information is anonymous only when it can no longer be linked to a person; removing a name alone is not enough.

Conversation history lets you return to earlier work. The assistant has a separate conversation-deletion function. Closing an account does not currently provide an automatic, complete deletion of conversations and all related copies; request that outcome explicitly at info@kiloiot.de. Information already sent to a model provider also needs to be considered. Your subscription plan determines the reading history available through the service. A reading no longer appearing in a query is not confirmation that every stored copy has been erased. These limitations do not reduce your rights or release Kilo from its deletion obligations.

9. Your choices and privacy rights

Email info@kiloiot.de to exercise a privacy right. Say whether you want access, a correction, deletion, restricted use or another outcome, and identify the relevant service without sending unnecessary sensitive information. Where the GDPR applies, we must respond about the action taken without undue delay and normally within one month of receiving the request. A necessary extension must be explained within that first month. This response deadline is not a waiting period for deletion: qualifying erasure must take place without undue delay. The following rights apply subject to their legal conditions:

10. Automated individual decision-making, including profiling

We do not make decisions based solely on automated processing, including profiling, which produces legal effects concerning the data subjects.

11. Changes on our Privacy Policy

New legal requirements, corporate decisions or technical developments may require changes to our privacy policy. The privacy policy will then be adapted accordingly. You will always find the latest version on our website.