Privacy policy

Datenschutzerklärung · last updated 2026

Who is responsible

The controller for data processed on this site is Matthis Keuler, Josefstr. 28, 47623 Kevelaer, Deutschland, reachable at info@km-labs.de.

What we collect

• Free snapshot: the store URL you paste, and a salted SHA-256 hash of your IP address (never the IP itself). The hash exists only to rate-limit abuse; it cannot be reversed to your address.
• Customers: your email address, subscription status and Stripe customer/subscription identifiers.
• Monitoring data: the public product catalogs of the competitor stores you choose to watch. This is business data published by those stores, not personal data.
• No analytics, no advertising pixels, no third-party cookies. The site stores a single value in your browser’s local storage: your dashboard token, so you stay signed in.

Processors we use

• Supabase (database and serverless functions), hosted in the EU — region eu-central-1, Frankfurt. Stores everything listed above.
• Stripe (payments). Stripe processes your payment details directly; we never see your card data and only store the customer/subscription IDs Stripe returns.
• Lettermint (transactional email). Receives your email address and the content of your alert digests in order to deliver them.
• GitHub Pages serves these static pages; GitHub processes server log data including IP addresses as part of delivering the site.

Where data is processed outside the European Economic Area — specifically by Stripe and GitHub Pages in the United States — we rely on the EU–US Data Privacy Framework (adequacy decision of 10 July 2023) and, where applicable, the European Commission’s Standard Contractual Clauses. Lettermint and Supabase process data within the EEA.

Why we may process it (Art. 6 GDPR)

Performance of a contract (Art. 6(1)(b)) for everything needed to run your subscription and send your alerts; legitimate interest (Art. 6(1)(f)) for rate-limiting the free snapshot and keeping the service secure.

How long we keep it

Snapshot rate-limit hashes and cached snapshots: up to 30 days. Account data and change history: for as long as your subscription is active, and deleted on request. Email delivery logs: 12 months.

Your rights

You can request access, correction, deletion, restriction, portability, or object to processing at any time — just reply to any email from us or write to info@km-labs.de. You also have the right to complain to a supervisory authority. The competent supervisory authority for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Postfach 20 04 44, 40102 Düsseldorf, https://www.ldi.nrw.de.

Deleting your data

Removing a store from your dashboard deletes its stored catalog state and change history immediately. Cancelling your subscription and asking us to delete your account removes your email address and all associated records.