Privacy Policy

This Privacy Policy explains how Kesumi collects, uses, stores, and protects personal data when you visit the website, join the waitlist, or use related services.

Kesumi is operated from Germany. Where the General Data Protection Regulation applies, we process personal data in accordance with GDPR principles including transparency, purpose limitation, data minimisation, storage limitation, integrity, confidentiality, and accountability.

Controller

Marc Hoffmann

Danziger Str.

38239 Salzgitter

Deutschland

Email: privacy@kesumi.app

Information We Collect

When you join the waitlist, we collect your email address and the time at which you submitted it. If optional fields are added later, we may also collect information you choose to provide, such as your name, country, or referral information.

When you visit the website, we may process technical information such as browser type, device information, IP address, page visits, clicks, referral source, and basic security logs.

When using future product features, Kesumi may process spending information, receipt images or extracted receipt text, Apple Shortcuts tracking data, user prompts, AI coach inputs, and AI-generated outputs.

How We Use Your Information

We use personal data to manage the waitlist, send product and launch updates, operate and secure the website and API, store user data, provide future Kesumi functionality, process AI coach and receipt scanning requests, improve our product, and prevent abuse.

Legal Bases Under GDPR

We process waitlist and email communication data based on your consent. You may withdraw consent at any time by contacting us or using any unsubscribe option provided in our emails.

We process technical, security, and abuse-prevention data based on our legitimate interests in operating a secure and reliable website and service.

Where Kesumi provides requested product functionality in the future, processing may be necessary for performance of a contract or to take steps prior to entering into a contract.

We may also process data where required to comply with legal obligations.

Hosting, API and User Data Storage

We use DigitalOcean to host the website, API, and user data storage. This means personal data submitted through the website or processed by the API may be stored and processed on DigitalOcean infrastructure.

DigitalOcean acts as a processor where it stores end-user data on our behalf. We aim to use European or GDPR-appropriate hosting configurations where available and rely on applicable data processing terms and transfer safeguards where data is processed outside the EEA.

AI Coach and Receipt Scanning

Kesumi may use OpenAI and Anthropic APIs to provide AI coach features, receipt scanning, spending summaries, and related recommendations. Data sent to these providers may include user prompts, receipt text or images, transaction context, and AI-generated outputs.

We use these providers to process requests and return results. AI-generated content may be inaccurate, incomplete, or outdated and should not be treated as financial, legal, tax, accounting, or investment advice.

According to OpenAI, API customer inputs and outputs are not used to train OpenAI models by default unless the customer explicitly opts in. Anthropic’s privacy materials describe rights and retention practices for personal data and deletion workflows. Provider terms may change over time.

Processors and Third-Party Providers

We use or may use the following providers:

• DigitalOcean: website hosting, API hosting, databases, storage, backups, logs, and related infrastructure.
• OpenAI: AI coach, receipt scanning, interpretation, summarisation, and recommendation features.
• Anthropic: AI coach, receipt scanning, interpretation, summarisation, and recommendation features.
• Email service providers: delivery of waitlist, launch, and product update emails.
• Analytics or security tools: website performance measurement, abuse prevention, and service security where enabled.

International Transfers

Some providers, including DigitalOcean, OpenAI, and Anthropic, may process personal data outside Germany or the European Economic Area. Where required, we rely on adequacy decisions, the EU-U.S. Data Privacy Framework, Standard Contractual Clauses, data processing agreements, or comparable safeguards.

Email Communication

By joining the waitlist you agree to receive launch updates, development updates, and product announcements. You may unsubscribe at any time.

Cookies and Tracking

Kesumi may use cookies, local storage, and similar technologies to remember preferences, improve website functionality, measure traffic, and understand user interactions. Where legally required, cookies will only be placed after obtaining your consent.

If advertising measurement tools such as Meta Pixel are enabled, they may collect page view and interaction data, including IP address and device information, and transmit that data to the respective provider. Such tools will be used according to applicable consent requirements.

Data Retention

Waitlist data is retained until you unsubscribe, request deletion, or the waitlist purpose no longer applies, unless a longer retention period is required by law.

Technical logs are retained only as long as needed for security, troubleshooting, and abuse prevention. Future app data is retained while needed to provide the requested service or until you request deletion, subject to legal retention requirements.

AI provider retention is governed by the applicable provider terms and data processing settings.

Security

We take reasonable technical and organizational measures to protect personal data, including transport encryption, access controls, provider security features, and limited access to production data. However, no internet transmission or storage system can be guaranteed to be completely secure.

Your GDPR Rights

Where GDPR applies, you may have the right to access your personal data, receive a copy of your data, correct inaccurate data, request deletion, restrict processing, object to processing, withdraw consent, and request data portability.

You also have the right to lodge a complaint with a data protection supervisory authority. In Germany, you may contact the authority responsible for your place of residence or the competent supervisory authority for the controller.

Requests may be sent to privacy@kesumi.app.

Children

Kesumi is not intended for children under the age required by applicable law. We do not knowingly collect personal data from children without appropriate permission.

Changes

We may update this Privacy Policy from time to time. Material changes will be reflected on this page.