Privacy Policy

This English translation is provided for convenience only. In the event of any discrepancies, the German version of this privacy statement shall prevail.

The protection of personal data is very important to KGE. Here we inform you about how we process your personal data when you use our app SwiftCards (section C). You will also find information about your rights regarding data processing, in particular your right to object (section D). If you have any questions after reading this privacy statement, please contact us at request@kge-it.de.

A. Who is responsible for processing my personal data?

The controller within the meaning of Article 4 No. 7 GDPR is KGE UG (haftungsbeschränkt), Haardtring 15, 64295 Darmstadt, Germany ("KGE").

B. Data protection information for visitors of our websites

1. Which data are processed when visiting the KGE website?

When accessing the KGE website, various data about the accessing system are automatically stored. This includes the browser type, browser version, operating system, the website from which access is made to the KGE website, the subpages accessed on the KGE website, the date and time of access, the Internet Protocol address (IP address), the Internet service provider, and comparable data. KGE uses these data to make the website accessible, to identify and resolve technical issues, and to prevent and, if necessary, prosecute misuse of KGE's services. In addition, KGE uses these data in anonymized form, i.e., without the possibility of identifying the user, for statistical purposes and to improve the website.

The legal basis for this processing of personal usage data is our legitimate interests under Article 6(1)(f) GDPR.

Matomo

We use Matomo (InnoCraft Limited), an open-source software for statistical analysis of visitor access on this website. Matomo is operated by us on our own servers (no data is shared with third parties for advertising purposes).

Processing is carried out to analyze the use of our website and to improve our offering. In particular, the following data are processed: pages/URLs visited, referrer URL (the page you came from), date/time, shortened/anonymized IP address, technical information about the device/browser (e.g., user agent), approximate location (derived from the anonymized IP).

Cookies: Matomo is configured so that no tracking cookies are set.

IP anonymization: We use IP anonymization so your IP address is only processed in shortened form.

Objection / opt-out: You can object to web analytics at any time. In this case an opt-out will be set so Matomo will no longer record your visit; the opt-out option is available on our website.

The legal basis (where applicable) is Article 6(1)(f) GDPR (legitimate interest) in the statistical analysis and optimization of our website. If consent is required, processing is based on your consent (Article 6(1)(a) GDPR).

2. How long is my personal data stored?

Personal data of visitors to our website are deleted when their knowledge is no longer required for the purposes described in this privacy policy, unless statutory provisions require longer storage. Usage data are regularly stored for a period of 30 days (B.1.).

C. Data protection information for users of our app SwiftCards

I. General

We process personal data that you voluntarily provide as a user of our app (the "App") and data that arises when you use the App. To use the App, after installing and opening it, signing in with your Apple account ("Sign in with Apple") is required. Through the sign-in, we receive a pseudonymous user identifier and — if and to the extent shared by you during sign-in — your name and email address; if you use Apple's "Hide My Email" feature, we only receive a forwarding address assigned by Apple (@privaterelay.appleid.com). There is no further transfer of your access data such as passwords. These data are needed for authentication and identification and are stored in Google Firebase Authentication for this purpose (see section C.V.). The legal basis is Article 6(1)(b) GDPR. The App is intended exclusively for persons aged 18 and over (see conditions of use, section I.); we do not knowingly process data of minors.

II. AI-based creation of flashcards

The core function of the App is the automated creation of flashcards from study material that you upload in the App (e.g. PDF, Word, PowerPoint, or image files). For this purpose, the uploaded content is transmitted via server functions operated by KGE (Google Cloud Functions) to Google's AI services (Vertex AI / Gemini) and processed there to create the flashcards. Larger files are temporarily stored in Google Firebase Storage for the duration of the processing and are automatically deleted there no later than one day after the upload.

Google processes this content as a processor within the meaning of Article 28 GDPR exclusively to provide the service; under the Google Cloud contractual terms, your inputs and the generated outputs are not used to train Google's AI models. To speed up processing, inputs may be cached for up to 24 hours and logged briefly for abuse detection.

The created flashcards and your decks are stored exclusively locally on your device and are not transmitted to KGE.

Please do not upload study material that contains special categories of personal data within the meaning of Article 9 GDPR (e.g. health data) or personal data of third parties, unless this is necessary for the creation of your flashcards.

The legal basis is Article 6(1)(b) GDPR.

III. Credits and abuse prevention

To provide the credit system (Credits, see our conditions of use), we maintain a server-side credit account that is assigned to your pseudonymous user identifier. It stores the one-time welcome balance, purchased credit packs, the daily subscription allowance, referral bonuses, and the respective consumption. If the App Store refunds an in-app purchase, we also record there the Credits removed from the refunded purchase and — to the extent Credits from the refunded purchase had already been used — an outstanding recovery amount that is set off against future purchases (see conditions of use, section VI.). The legal basis is Article 6(1)(b) GDPR; for the set-off of a recovery amount additionally Article 6(1)(f) GDPR (legitimate interest in not letting abusive refunds work to our detriment).

If you take part in the referral programme (see conditions of use, section VI.), we store your personal referral code and — under pseudonymous user identifiers — which account redeemed which code and when, and whether and when the bonus was credited or withdrawn after a refund. Neither the referring nor the invited user can see any personal details of the other. The legal basis is Article 6(1)(b) GDPR. To evaluate the programme we keep only monthly totals (e.g. number of redeemed codes and credited bonuses) with no reference to individual users.

To protect against abuse (e.g. manipulation of the credit balance or unauthorized access to the AI interface), we use Google Firebase App Check: Apple's App Attest service is used to verify that requests originate from an unmodified app instance obtained from the App Store; device-related attestation data are processed for this purpose. We also log technical verification values of individual requests and, for every call to our server functions, your pseudonymous user identifier, the function called, the app version, and the platform, in order to monitor operation, find errors, and see which app versions are still in use. The legal basis is Article 6(1)(f) GDPR (legitimate interest in preventing abuse and in stable operation).

IV. In-app purchase

If you make an in-app purchase, the transaction and payment are handled exclusively between you and the Apple App Store under its terms and privacy policies: https://www.apple.com/legal/internet-services/itunes/de/terms.html and https://www.apple.com/legal/privacy/de-ww/.

The legal basis is Article 6(1)(b) GDPR.

If you submit a refund request for an in-app purchase to the App Store, Apple asks us for information about the use of the purchase in order to decide on the refund. In this case we transmit the following information to Apple — via the RevenueCat service described below: whether and to what extent the Credits acquired with the purchase have already been used, how long your user account has existed, the total of your previous in-app purchases and refunds, the platform on which the App is used, and our recommendation whether the refund should be granted. The contents of your study material and your flashcards are not transmitted. You agree to the transmission of this information with the in-app purchase in accordance with our conditions of use (section VI.); the legal basis is Article 6(1)(b) GDPR and Article 6(1)(f) GDPR (legitimate interest in a well-founded refund decision and in preventing abusive refunds). The decision on the refund is made solely by Apple.

Subscription management (RevenueCat)

To manage in-app purchases and subscriptions we use RevenueCat, Inc., 1032 E Brandon Blvd #3003, Brandon, FL 33511, USA. RevenueCat processes technical information (e.g., a pseudonymous app user ID corresponding to your user identifier, purchase and subscription status, and device-related information) to correctly assign and provide purchases and subscriptions. Processing is carried out for contract performance under Article 6(1)(b) GDPR. It is not used for advertising or tracking purposes. Data is transferred to the USA on the basis of appropriate safeguards under Article 46 GDPR (EU Standard Contractual Clauses, see section C.IX.).

In addition, we evaluate the purchase and subscription data held by RevenueCat statistically in order to assess the economic viability of our App and to plan its further development (e.g. revenue, subscription renewals and cancellations, and average revenue per user by time of first use). For this we use only aggregated figures with no reference to individual users. The legal basis is Article 6(1)(f) GDPR (legitimate interest in the economic planning and improvement of our offering); for your right to object see section D.

V. Firebase, Google Analytics, and App Analytics

Our app uses Google Firebase (more information: https://firebase.google.com/docs), a development platform of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use the Firebase services Authentication (sign-in, see C.I.), Cloud Functions and Cloud Storage (AI processing, see C.II.), App Check (abuse prevention, see C.III.), and Cloud Firestore (credit management, see C.III.). Google processes the data as a processor on the basis of a data processing agreement (Google Cloud Data Processing Addendum and Firebase Data Processing and Security Terms) exclusively on our instructions. The legal basis is Article 6(1)(b) GDPR.

In addition, we use — only with your consent — Google Analytics for Firebase to analyze and improve app usage. Event data about the use of the App are processed (e.g. features used, app version, device type, duration of individual processing steps); the contents of your study material and your flashcards are excluded from this, and no advertising identifiers are collected. Usage data are transmitted to Google in pseudonymized form. So that we can relate purchases and subscriptions to the use of the App, we also pass the pseudonymous analytics identifier of your app installation to RevenueCat (see section C.IV.), where it is assigned to your pseudonymous user identifier; for this purpose RevenueCat may transmit purchase and subscription events (e.g. product, price, and time) to Google Analytics. As a result, the usage data can be attributed to your user account. If you withdraw your consent, we remove the analytics identifier from RevenueCat again. The legal basis is your consent (Article 6(1)(a) GDPR), which you can give when first starting the App and withdraw at any time with effect for the future in Settings under "Data Protection". We also use "App Analytics", an analytics service by Apple Inc. This tool processes data about downloads and app usage. We do not receive personal data about you from Apple Inc. The legal basis for this is our legitimate interests under Article 6(1)(f) GDPR.

To keep the App stable we use Firebase Crashlytics, a crash reporting service. If the App crashes or a serious technical error occurs, technical information is transmitted (e.g. crash log/stack trace, app version, operating system version, device model, a pseudonymous installation identifier, and the time of the error). The contents of your study material and your flashcards are not transmitted. The legal basis is our legitimate interest in detecting and fixing technical errors (Article 6(1)(f) GDPR). You can object to crash reporting at any time by disabling it in Settings under "Data Protection".

VI. Feedback

If you send us feedback via the App, we process the message you enter and — for context and troubleshooting — your pseudonymous user identifier, the app version, and information about your operating system and the current session. The session's diagnostic log and the associated AI requests are also transmitted with the feedback; these may contain excerpts from the study material you uploaded. This is pointed out in the feedback form. We use these data exclusively to handle your request and to improve the App. The legal basis is Article 6(1)(b) or (f) GDPR.

VII. Automatic error diagnostics

If the creation of your flashcards fails for technical reasons, the App can transmit an error report to us so that we can reproduce and fix the problem. Such a report contains the session's diagnostic log, the associated AI requests, and the source files you added themselves — it may therefore contain the full content of your study material. Your pseudonymous user identifier, the app version, and information about your operating system and the current session are also transmitted.

Automatic transmission only takes place if you have consented to error diagnostics (when first starting the App or in Settings under "Data Protection"). Without this consent, the App asks you in each individual case whether the report should be sent. The legal basis is your consent (Article 6(1)(a) GDPR); you can withdraw it at any time in Settings with effect for the future. Error reports are used exclusively for error analysis and are automatically deleted no later than 90 days after transmission.

VIII. Disclosure of personal data

We disclose your personal data to third parties:

We try to inform you about legal requests regarding your data when appropriate, unless prohibited by law or court order or in an emergency. We may challenge requests if they are excessive, vague, or inadequate. For certain technical processes, KGE uses external service providers who receive access to personal data as required to perform their tasks. These providers are carefully selected, meet high data protection standards, are bound to confidentiality, and process data only on KGE's instructions.

IX. Transfers to third countries

Where we transfer personal data to third countries (in particular to Google LLC and RevenueCat, Inc. in the USA), this is done on the basis of the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework (Article 45(3) GDPR), provided the respective recipient is certified under the DPF; Google LLC is DPF-certified. In addition, for recipients without DPF certification and for processing in other third countries (for example where Google processes requests in globally distributed data centers), we base the transfer on the European Commission's Standard Contractual Clauses (Article 46(2)(c) GDPR), where appropriate with additional safeguards.

X. How long we store data

We store your personal data as long as you have an account with us. Beyond that, we store personal data only if required by law or otherwise necessary. In detail: Study material uploaded in the App is deleted from our servers no later than one day after the upload. We store account data and credit balances as long as your account exists; after more than one year of inactivity, we may delete account data in accordance with our conditions of use. Referral data is stored for as long as your account exists; when you delete your account, your identifier and your code are removed from other users' redemptions and your own redemption is deleted — if it was rewarded with a bonus, it is instead kept for twelve months without the code and the timestamps (see below). We store feedback as long as this is necessary to handle your request and to improve the App, but no longer than twelve months. Error diagnostics reports, including the source files they contain, are automatically deleted no later than 90 days after transmission. Usage data from Google Analytics are deleted after 14 months, crash reports after 90 days, and the logs of our server functions after 30 days. Your flashcards and decks are stored exclusively locally on your device and are under your sole control. To recover from technical failures, our database retains earlier states for seven days; deleted data may therefore remain in these recovery states for up to seven days, after which it is removed automatically, and in that time it is used only for recovery.

You can delete your account, including your credit balance and — with the exceptions named in this and the following paragraph — the associated server data, at any time directly in the App (Settings → Profile → "Delete account"); alternatively, you can still request deletion from us by email at any time. To prevent the one-time welcome credit and the referral bonus from being claimed more than once, we retain, for five years after the deletion, only a pseudonymised check value (hash) of your Apple account identifier (Art. 6(1)(f) GDPR); it does not allow us to identify you. If your account was excluded from the referral programme because of repeated refunds of rewarded referrals, we also note this against that check value (Art. 6(1)(f) GDPR). If an outstanding recovery amount from a purchase refunded by the App Store (section C.III.) exists at the time of deletion, we additionally store the amount together with this check value so that it cannot be circumvented by deleting and re-creating the account (Art. 6(1)(f) GDPR). The amount is carried over to a new account created with the same Apple account and deleted once it has been settled. We also note the identifier of that new account against the check value for as long as the account exists, so that a refund arriving later for an earlier, deleted account can be set off there (Art. 6(1)(f) GDPR).

For twelve months after the deletion we also keep what we need to attribute and set off an App Store refund of a purchase made on the deleted account (Art. 6(1)(f), Art. 17(3)(e) GDPR): the records of the purchase and refund events reported via RevenueCat (section C.IV.) are not deleted early when the account is deleted but keep their regular periods (purchase events 90 days, refund records twelve months). A deletion record links the identifier of the deleted account to the check value and holds the pack credits that were still unused at the time of deletion. If your referral redemption was rewarded with a bonus, it is kept without the code and the timestamps so that a refund of the rewarded purchase can also take back the referrer's bonus. Your customer record at RevenueCat (purchase history) is deleted twelve months after the account deletion rather than immediately, because Apple draws on it when deciding refund requests (section C.IV.). If a purchase is refunded during this time, we set off only the credits already consumed as a recovery amount against the check value; unused credits that you lost by deleting are not charged. Twelve months is the period within which refunds of a purchase are, in our experience, still requested or reversed; these data do not allow us to identify you, and they are deleted when the period ends.

D. What rights do I have in relation to my personal data?

You have the right to information about the personal data stored by us and, if legal requirements are met, the right to correction, deletion, and restriction of processing. You also have the right to receive the personal data you provided in a structured, common, and machine-readable format and to transfer it to another controller. Where technically possible, you can request that we transmit the data directly to another controller. You can also lodge a complaint with the competent supervisory authority.

Right to object (Article 21 GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data where we base it on our legitimate interests (Article 6(1)(f) GDPR). This concerns:

If you object, we will no longer process the data concerned for this purpose unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. Such grounds may exist in particular for processing that serves to prevent abuse (abuse prevention, set-off of a recovery amount, information on a refund request, check value after account deletion).

An informal message to request@kge-it.de is sufficient to object. You can also object to crash reporting directly in the App (Settings → "Data Protection"). You can switch off the sharing of usage data with us via Apple App Analytics in your device's system settings ("Privacy & Security" → "Analytics & Improvements" → "Share with app developers").

Version: September 2026