Kirby Tools
Hub

Privacy Policy

Last updated: 5 November 2026

Last updated: 5 November 2026

This website uses no tracking or advertising services. We count visits only with Cloudflare Web Analytics, without cookies. We process personal data only as far as it is needed to run the website, for reach measurement, for your licenses and to answer your enquiries.

Controller

The controller responsible for data processing on this website is:

Johann Schopplich
Paul-Gruner-Str. 38
04107 Leipzig
Germany

Email: hello@kirby.tools

Visiting the Website

When you visit this website, your browser necessarily sends data to the server, including your IP address, the requested address, the page you came from (referrer) and details about your browser and operating system. The server needs this data to deliver the page to you. The legal basis is our legitimate interest in a secure and working website (Art. 6(1)(f) GDPR).

The website is delivered by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, through its worldwide server network. Cloudflare processes the connection data on our behalf (Art. 28 GDPR), also to fend off attacks. We receive no log of page visits from Cloudflare. In the process, the data may reach the USA and other countries outside the EU. Cloudflare is certified under the EU-US Data Privacy Framework, for which an adequacy decision of the European Commission exists (Art. 45 GDPR), and has additionally agreed to the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). Learn more in Cloudflare's privacy policy.

You are not obliged to provide us with any data. Without the connection data, however, the website cannot be displayed.

Reach Measurement

To see how often our pages are visited and how fast they load, we use Cloudflare Web Analytics from Cloudflare, Inc. (see above). When a page loads, a small script reads the load times from your browser's performance interface and reports them, together with the address of the page (without parameters) and the referring page, to Cloudflare once the page has loaded, on every page change and when you leave or hide the page. Cloudflare derives the country, browser, operating system and device type from your IP address and browser identifier. It uses no cookies or other storage on your device; according to Cloudflare, it does not fingerprint individual visitors. We only see aggregated figures. Cloudflare keeps the individual measurements for seven days and aggregates them after that; they remain available for six months. The legal basis is our legitimate interest in knowing the reach and load times of our website (Art. 6(1)(f) GDPR). For the transfer to the USA, what is said about Cloudflare above applies.

Storage on Your Device

When you visit the website, we set no cookies and store nothing on your device. We serve fonts and scripts ourselves, not through third-party providers – except Cloudflare's measurement script (see above).

Your browser stores locally (local storage) whether you see the light or dark design, so that your choice persists on your next visit. This setting never leaves your device. This storage is strictly necessary for the function you requested (Section 25(2) No. 2 TDDDG, the German Telecommunications Digital Services Data Protection Act).

Cookies or similar technologies only come into play when you click the buy button or sign in to the customer portal. The details are in the following sections.

Links to other websites are ordinary links. Only when you click one does your browser connect to the other website; its own privacy policy applies there.

Buying Licenses

We sell our licenses through Paddle. Your contractual partner for the purchase is Paddle.com Market Limited, Judd House, 18–29 Mora Street, London EC1V 8BT, United Kingdom, which acts as the merchant of record. Paddle processes your payment, billing and contact data as an independent controller; Paddle's privacy policy applies to this. Paddle's checkout loads only when you click the buy button, together with a script of Paddle's ProfitWell service; Paddle may use cookies or similar technologies needed for the payment. For the United Kingdom, an adequacy decision of the European Commission exists (Art. 45 GDPR).

After your purchase, we receive from Paddle the details we need for your license: your name and email address, the order number, the purchased product and the license holder you entered. We use them to create, verify and manage your license (Art. 6(1)(b) GDPR). When a plugin activates or checks its license, we also store the address of the website, the plugin and Kirby versions and when the license was used there, to detect misuse of a license (Art. 6(1)(f) GDPR). The license data is stored in a database at Cloudflare (see above); we send emails about your license, such as sign-in links, through Resend from Plus Five Five, Inc., San Francisco, USA, which is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). Both act on our behalf (Art. 28 GDPR). We keep the license data even after a refund, so that every order stays traceable (Art. 6(1)(f) GDPR), and delete it on request unless tax retention obligations require us to keep it (§ 147 AO, German Fiscal Code).

You manage your licenses in the customer portal hub.kirby.tools, which also runs on Cloudflare. You sign in there with your email address, either through a sign-in link we send you via Resend or together with your order number. After you sign in, we set a session cookie that keeps you signed in for seven days; it is strictly necessary for the portal you requested (Section 25(2) No. 2 TDDDG). There, too, Paddle's checkout loads only when you buy an upgrade. We also count visits there with Cloudflare Web Analytics (see above).

Contact by email

When you contact us by email, we process your details – such as your name, contact details and the content of your message – to handle your request. If it concerns a contract or an order, the legal basis is Art. 6(1)(b) GDPR; for other enquiries, it is our legitimate interest in answering you (Art. 6(1)(f) GDPR). Providing your details is voluntary; without them, however, we cannot answer you.

Emails to our address are received by Cloudflare (see above) and forwarded to our mailbox. Our mailbox is run by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, in data centres in Germany.

We delete your request as soon as it has been dealt with. We keep it longer only where the law requires it – for example six years for business letters under § 147 AO (German Fiscal Code).

Your Rights

Under the GDPR, you have the right to:

  • access the data stored about you (Art. 15)
  • rectification of inaccurate data (Art. 16)
  • erasure of your data (Art. 17)
  • restriction of processing (Art. 18)
  • data portability (Art. 20)
  • object to processing (Art. 21, see below)

Simply contact us, for example by email at hello@kirby.tools. We do not use automated decision-making or profiling.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Saxon Data Protection and Transparency Commissioner, Postfach 11 01 32, 01330 Dresden, Germany, www.datenschutz.sachsen.de.

Right to Object

Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.