Legal

Privacy Policy

Last updated: 31 October 2026

At a glance

• We only use your data to run kwirk, take payments and keep the service safe.

• We never sell your data.

• TikTok and Instagram videos only load after you agree.

• You can download or delete your data at any time in your settings.

1. Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) is Siggipiet UG (haftungsbeschränkt), Merseburger Straße 393, 06132 Halle (Saale), Germany. Email: [email protected]. Further details are in our Imprint.

[We have not appointed a data protection officer because we are not legally required to. / Our data protection officer: Name, contact]

2. Visiting our website

When you visit kwirk, our hosting provider automatically processes technical data: your IP address, date and time, the page requested, browser, operating system and referring page. We need this to deliver the website and keep it secure. Legal basis: our legitimate interest in a secure, stable service (Art. 6(1)(f) GDPR). Log data is deleted after 30 days unless needed to investigate a security incident.

To find and fix errors, we use Sentry (Functional Software, Inc., USA). When something goes wrong in the app or on our servers, Sentry receives technical data about the error: the error message, the page, your browser and operating system and the time. We have set Sentry not to store IP addresses and to remove passwords and payment data. Sentry is certified under the EU-U.S. Data Privacy Framework. Legal basis: our legitimate interest in a working, secure service (Art. 6(1)(f) GDPR).

3. Your account

To create an account we process your email address and, if you provide it, your name. If you sign in with Google or Apple, we receive your name and email address from them. We use this data to provide your account and send you login links. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR). We keep it until you delete your account.

4. Creating characters and videos

When you use kwirk, we process your prompts and selections, the images and videos you upload, and the characters and videos we create for you. Legal basis: performance of our contract (Art. 6(1)(b) GDPR).

To generate your content, we send your Inputs to AI service providers. They may process and store this information in the United States and other countries where they or their service providers operate. These countries may not offer the same level of data protection as the EU.

Photos of people. If your uploads show identifiable people, they contain those people's personal data. Only upload such content if you have their permission (see our Terms). We do not use photos to identify people or to create biometric profiles.

Safety checks. We automatically check prompts and uploads to prevent prohibited content. Legal basis: our legitimate interest in a safe service and our legal obligations (Art. 6(1)(f) and (c) GDPR).

AI marking. Videos we create contain invisible, machine-readable information that marks them as AI-generated, as required by EU law. [This marking contains no personal data about you.]

Retention. Your characters and videos are stored until you delete them or your account. Uploaded reference files are deleted after 30 days.

5. Payments

Payments are processed by Stripe Payments Europe Ltd., Ireland. Stripe receives your payment details directly; we only receive your name, email, billing country, the last digits of your card and the payment status. Legal basis: performance of our contract (Art. 6(1)(b) GDPR) and our legal obligations under tax and commercial law (Art. 6(1)(c) GDPR). Stripe may process data in the USA. Invoices and accounting records are kept for the statutory retention periods of up to 10 years.

6. Emails

We send emails that are part of our service, such as login links, receipts and "your video is ready", through our email provider Resend, Inc., USA. Legal basis: Art. 6(1)(b) GDPR.

We only send our newsletter with trend tips and offers if you have opted in (Art. 6(1)(a) GDPR). We confirm your sign-up with a confirmation email (double opt-in). You can unsubscribe at any time with the link in every email.

7. Contact form, support and reports

If you contact us or send a report, we process the details you give us, such as your name, email and message, to handle your request. Legal basis: Art. 6(1)(b) GDPR for requests about your account or contract, otherwise our legitimate interest in answering you (Art. 6(1)(f) GDPR) and our obligations under the EU Digital Services Act (Art. 6(1)(c) GDPR). We do not share a reporter's identity with the reported user unless this is necessary or required by law. We delete the data 6 months after your request is closed, unless we must keep it longer by law. Our email is hosted by IONOS SE, Germany.

8. Cookies and similar technologies

We use cookies and local storage on your device.

• Necessary: keeping you logged in, security, remembering your cookie choices and your light or dark mode. These are essential to provide the service you requested and do not need consent (Section 25(2) no. 2 of the German TDDDG).

• External media: TikTok and Instagram videos on our Discover page. Only with your consent (see section 9).

• Analytics: PostHog (PostHog, Inc., USA), to see which pages and features are used so we can improve kwirk. Only with your consent.

• Marketing: [Only if you use ad pixels, e.g. TikTok Pixel or Meta Pixel.] Only with your consent.

Legal basis for optional cookies: your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can change your choices at any time in our Cookie settings.

9. TikTok and Instagram videos

Our Discover page shows trending videos from TikTok and Instagram. The video players are only loaded after you have agreed to external media or tap to play a video. Your browser then connects to the servers of TikTok Technology Limited, Ireland, or Meta Platforms Ireland Limited. They receive your IP address and other technical data and may set cookies. They may transfer data to countries outside the EU. Legal basis: your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR), which you can withdraw at any time in our Cookie settings. For details, see the privacy policies of TikTok and Instagram.

10. Who receives your data

We use the following service providers. Where they process data on our behalf, we have data processing agreements with them.

[Check each provider's current certification and contract before going live.]

We also share data with authorities where we are legally required to.

11. Your rights

You have the right to:

• access your data (Art. 15 GDPR),

• have it corrected (Art. 16) or deleted (Art. 17),

• restrict its processing (Art. 18),

• receive it in a portable format (Art. 20),

• object at any time to processing based on our legitimate interests (Art. 21),

• withdraw your consent at any time with effect for the future (Art. 7(3)), and

• complain to a data protection supervisory authority (Art. 77), for example in the country where you live or the authority responsible for us: [name of the authority for your federal state].

You can download or delete your data at any time in your settings, or email us at [email protected].

12. Automated decisions

We do not make decisions that have legal or similarly significant effects on you based solely on automated processing. Our automated safety filters may block a single generation. You can always ask us to have a person review it.

13. Age

kwirk is only for people aged 18 and over. If we learn that an account belongs to someone under 18, we delete it.

14. Security

We protect your data with encryption in transit, access controls and regular updates. No system is completely secure, but we work hard to keep your data safe.

15. Changes

We will update this policy when our services or the law change. We will inform you about important changes by email.