Privacy policy

The controller within the meaning of the GDPR, the Slovenian Data Protection Act (ZVOP-2) and, for visitors in Switzerland, the Swiss Federal Act on Data Protection (DSG) is: Studio Slonček, videoprodukcija, Marie Breitkopf s.p., Šentjanž pri Dravogradu 59, 2373 Šentjanž pri Dravogradu, Slovenia, email: hello@getkroki.com, phone: +386 70 706 060.

Email for data protection questions: support@getkroki.com

We are established in the EU (Slovenia). We therefore don’t need a representative in the EU under GDPR Art. 27.

We have not appointed a data protection officer because we are not legally required to. You can reach us directly using the details above.

• Your answers, your dog’s profile, your plan and your progress are kept in your Kroki account with our database provider in the EU, and some of them also in your browser (section 3).
• Without your yes, we don’t load any statistics, advertising pixels or third-party content. Kroki currently doesn’t use any statistics service.
• When you open the site, our host processes technically necessary data such as your IP address (section 6).
• Which price you see is decided by chance, not by your data. You see the same price everywhere (section 5).
• You can download your data or have it deleted in your profile under “Your data” (section 11).
• Emails with reminders and information only come if you tick the box and confirm your address (section 3).

When you start the questionnaire, Kroki creates an account for you, at first without an email address. In it we store:

• the answers from the questionnaire and the result of the safety check
• your dog’s profile (for example name, age, sex, size and origin, as far as you provide them)
• your plan, your progress, your check-ins and notes
• your household: the names you add and the people who practise along
• your reminder settings
• your country, your price tier and, if you sign in or order, your email address, your order and the status of your subscription

Your browser also stores part of this information on your device (local storage “kroki:v1” with the backup copy “kroki:v1:backup”; details in the cookie policy). Kroki doesn’t store card details.

Legal basis: GDPR Art. 6(1)(b) (providing Kroki); for the storage in your browser § 25 (2) no. 2 TDDDG. Everyone who belongs to your household sees the shared dog profile and the household’s progress.

If you have your plan sent by email, we store your email address, your language, your country, your price tier and a copy of your answers from the questionnaire, so that the link in the email also opens your plan on another device. Legal basis: GDPR Art. 6(1)(b) (you asked for it to be sent).

If you tick the box for emails there, the first email contains a confirmation link. Only after you confirm do we send you at most 3 reminders about the plan in the first 7 days, with information about the Kroki subscription, and after that occasional training tips and news. As proof we store the version of the consent text, the time you ticked the box and the time you confirmed, without an IP address. Legal basis: your consent (GDPR Art. 6(1)(a), § 7 (2) no. 2 UWG). You can withdraw it at any time with effect for the future, with the unsubscribe link in every email or by email to support@getkroki.com. We don’t store whether you open our emails. How often links in our emails are opened, we only count as a total without an identifier (section 8).

You can download your data as a file and request its deletion in your profile under “Your data”. The storage period is in section 10.

You’ll find every entry with its name, purpose and duration in the cookie policy. In short:

• Necessary: the site needs these. We don’t ask for them (§ 25 (2) no. 2 TDDDG; in Austria § 165 (3) TKG 2021).
• Statistics: only with your consent. Kroki currently doesn’t use any statistics service. That’s why you don’t see a cookie banner.
• Marketing: we don’t use any.
• We don’t set a cookie for our counts without an identifier (section 8).

Under “Cookie settings” at the bottom of every page you can always see what is stored. If we add a service that needs your yes, we’ll ask you first. “Decline” will then be as easy as “Accept”. The same applies to visitors in Switzerland (Art. 45c Fernmeldegesetz, Telecommunications Act).

We test two price tiers for the same subscription. Which one you see is decided by a random generator (50:50). We don’t use any information about you, your device, your location or your behaviour for this, and we don’t build a profile.

So that you see the same price everywhere (home page, plan, payment page, checkout), your browser remembers the tier in local storage and in the technically necessary cookie “kroki_arm”. Your browser also stores it, signed, in the cookies “__Host-kroki_arm” and “__Host-kroki_arm_view”. They contain the tier (A or B), a random identifier and a signature, but no information about you.

Anyone who takes out a subscription keeps their price. The checkout shows a note that your price was assigned at random.

Legal basis: GDPR Art. 6(1)(f) (a fair, consistent price display). Under § 25 (2) no. 2 TDDDG the cookies are strictly necessary so that you are shown the right price. They expire after 90 days and are renewed for as long as you use Kroki. If you have an account, you keep the tier stored with your account.

Kroki is run by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA; server functions in Frankfurt am Main (Germany), delivery through a global content delivery network; transfers to the USA: EU-US Data Privacy Framework and standard contractual clauses. When you open the site, the host processes technically necessary data such as your IP address, date and time, the address requested, your browser and operating system, in order to deliver the site and keep it secure (GDPR Art. 6(1)(f)).

The host recognises your country (Germany, Austria or Switzerland) from your IP address. We only store the country code in the cookie “kroki_country”, for one day, so that the price, currency and right of withdrawal match your country.

On your first visit to a start page we open it in the language your browser names first (German, English or Polish); if it names none of them, the country code of your IP address decides. We store your language in the cookie “kroki_lang” for one year so the site does not switch again. You can change it at any time with the flag at the top right.

When you take out a subscription, we process the email address, the chosen plan, the order number, the times, your ticks at checkout and the payment status in order to perform the contract (GDPR Art. 6(1)(b)). We keep invoice data for as long as tax and commercial law require (GDPR Art. 6(1)(c)).

The payment is handled by a payment service provider: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. Stripe processes your name, email, billing address, payment method and transaction data as our processor to handle the payment, and as an independent controller for its own purposes (fraud prevention, legal obligations as a payment institution) (GDPR Art. 6(1)(b), (c) and (f)). Transfers to the USA: EU-US Data Privacy Framework and standard contractual clauses. More information: stripe.com/de/privacy. If you pay with PayPal, PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg, is also an independent controller.

The “Withdraw from contract” and “Cancel contracts here” forms work without signing in. For these we process your name, email address, contract number, the type of declaration and the time it was received (GDPR Art. 6(1)(b) and (c)).

If you take out a subscription, we may also send information about similar Kroki offers to your email address, for example about the yearly plan (§ 7 (3) UWG, GDPR Art. 6(1)(f)). We point this out at checkout and store which version of the notice you saw. You can object at any time, with one click in every such email or by email to support@getkroki.com. We don’t send such emails yet.

Without consent, we only count how often the steps up to a subscription are reached, for example “questionnaire finished”, “price viewed”, “payment didn’t go through” or “ordered”. All we store are daily counts: the step, the price tier (A or B), the country (Germany, Austria, Switzerland or other), the type of source (for example TikTok, search or direct), the campaign name from the link Kroki was opened with, the entry page, whether you are browsing inside a social media app and, for the subscription, the choice between monthly and yearly. We don’t store an identifier, an IP address or anything that would link the counts to you.

We take the price tier from the necessary price cookie (section 5), which your browser sends anyway so the right price is shown. We don’t use the random identifier in it for this. We read the source and campaign from the address you open Kroki with and keep them only while Kroki is open in this tab; we store nothing on your device for this. Legal basis: GDPR Art. 6(1)(f). Our legitimate interest: seeing which steps of Kroki need to get better and which price tier works better. We delete the counts after 13 months.

When you order, we pass the type of source, the campaign name and the entry page to our payment provider Stripe with the order (section 7). This shows us which videos and pages lead to orders (GDPR Art. 6(1)(f)). We keep this information with the order data.

Statistics services that store or read anything on your device only run with your consent (GDPR Art. 6(1)(a), § 25 (1) TDDDG). Kroki currently doesn’t use such a service. If one is added, we’ll name it here and in the cookie policy, ask you first, and it will only load after your yes.

As soon as there is something you can agree to, we store your choice as proof: a random identifier, the purpose, yes or no, the version of the notice text and the time, without your IP address. It is kept in local storage (“kroki:consent”, “kroki:consent-log”) and in the cookie “kroki_consent”. Your choice applies for 6 months, then we ask again.

You can withdraw your consent at any time with effect for the future via “Cookie settings”.

We pass data on to the service providers we need to run Kroki: the host (section 6), the database and sign-in, sending emails, protecting the forms against misuse and, if you order, the payment service provider (section 7). Where they process data for us, they act on our instructions. Stripe and PayPal are themselves responsible for their own purposes (section 7).

We also pass data on if we are legally required to (for example to tax authorities) or if it is necessary to enforce or defend legal claims (GDPR Art. 6(1)(c) and (f)).

Service providers, registered office, storage location and basis for transfers outside the EU, the EEA and Switzerland:

• Vercel Inc., USA: hosting, server functions in Frankfurt am Main (Germany), global content delivery network, EU-US Data Privacy Framework and standard contractual clauses
• Supabase, Inc., USA: database and sign-in, storage location Frankfurt am Main, standard contractual clauses
• Stripe Payments Europe, Ltd., Dublin, Ireland: payment processing (see section 7)
• Plus Five Five, Inc. (“Resend”), USA: sending emails, EU-US Data Privacy Framework and standard contractual clauses
• Cloudflare, Inc., USA: Turnstile, protecting the forms, EU-US Data Privacy Framework and standard contractual clauses
• for Switzerland, for transfers to the USA: Swiss-US Data Privacy Framework or standard contractual clauses with the adjustments for Switzerland

• Your account and your information (section 3): until you request deletion or delete your account, unless we are required to keep them. We automatically delete accounts without an email address and without a subscription that haven’t been used for 30 days.
• If you have your plan sent: the copy of your answers for 30 days. Without confirmed consent we also delete your email address after 30 days.
• Confirmed consent to emails: until you unsubscribe, 24 months at most. After you unsubscribe we delete your email address at once and keep only the proof (a check value of the address, the times and the text version) for 3 years.
• Information in your browser’s storage: until you delete it.
• Your cookie choice: 6 months.
• Cookie “kroki_country”: 1 day.
• Language: cookie “kroki_lang”: 1 year.
• Price tier: cookies “kroki_arm”, “__Host-kroki_arm” and “__Host-kroki_arm_view”: 90 days.
• Counts of the steps up to a subscription (without an identifier, section 8): 13 months.
• Invoices and accounting records: 10 years from the end of the calendar year
• Records of contracts, withdrawals and cancellations: 10 years from the end of the calendar year
• The host’s server logs: 30 days
• Proof emails (order, cancellation and withdrawal confirmations, renewal reminders): 10 years from the end of the calendar year, without a user identifier; other sending logs: 30 days

Under the GDPR (and largely the same under the Swiss DSG) you have the right to:

• access to your data and a copy (GDPR Art. 15)
• rectification of incorrect data (GDPR Art. 16); you can change a lot yourself in your profile
• erasure (GDPR Art. 17)
• restriction of processing (GDPR Art. 18)
• data portability (GDPR Art. 20); in your profile you download your data as a file
• withdraw your consent with effect for the future (GDPR Art. 7(3)), for example via “Cookie settings”
• object (GDPR Art. 21): if we process data on the basis of a legitimate interest (GDPR Art. 6(1)(f)), you can object at any time on grounds relating to your particular situation. We then no longer process the data, unless we can demonstrate compelling legitimate grounds or the processing serves legal claims. You can object to direct marketing at any time without giving a reason.

How to exercise your rights: write to support@getkroki.com or to the postal address in section 1. This is free of charge. We reply without undue delay, at the latest within one month.

You can complain to any data protection supervisory authority, in particular in the country where you live or work:

• Responsible for us (registered office in Slovenia): Informacijski pooblaščenec Republike Slovenije, Dunajska cesta 22, 1000 Ljubljana, Slovenia, ip-rs.si
• Switzerland: Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter (EDÖB), Feldeggweg 1, 3003 Bern, edoeb.admin.ch
• Austria: Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Wien, dsb.gv.at
• Germany: the data protection authority of your federal state; the list is kept by the Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (bfdi.bund.de).

For visitors in Switzerland, the Swiss Federal Act on Data Protection applies (DSG, in the version in force since 1 September 2023); for people in the EU, the GDPR applies in addition. We apply the stricter standard everywhere. In addition:

• Access (Art. 25 DSG): free of charge, usually within 30 days.
• Release and transfer of data (Art. 28 DSG): in your profile you download your data as a file.
• Further claims (Art. 32 DSG): rectification, erasure, objection to processing, declaratory ruling.
• Automated individual decisions (Art. 21 DSG): none, see section 14.
• Countries data may be transferred to (Art. 19 (4) DSG), and the safeguards for this: Vercel Inc., USA: hosting, server functions in Frankfurt am Main (Germany), global content delivery network, EU-US Data Privacy Framework and standard contractual clauses; Supabase, Inc., USA: database and sign-in, storage location Frankfurt am Main, standard contractual clauses; Stripe Payments Europe, Ltd., Dublin, Ireland: payment processing (see section 7); Plus Five Five, Inc. (“Resend”), USA: sending emails, EU-US Data Privacy Framework and standard contractual clauses; Cloudflare, Inc., USA: Turnstile, protecting the forms, EU-US Data Privacy Framework and standard contractual clauses; for Switzerland, for transfers to the USA: Swiss-US Data Privacy Framework or standard contractual clauses with the adjustments for Switzerland.

We don’t make any decisions that are based solely on automated processing and have legal effects on you or similarly significantly affect you (GDPR Art. 22, Art. 21 DSG). In concrete terms:

• Your training plan is put together from your answers. It is a recommendation, not a decision about you.
• If there are warning signs, the app pauses the relevant exercises and advises you to see a professional. Everything else stays usable.
• The price tier is assigned at random, not based on who you are (section 5). No profiling takes place.

Kroki is only for adults aged 18 and over. We don’t collect any data about children. The question in the questionnaire about whether children live in the household only serves to show you suitable safety tips.

You are not legally required to give us data. Without answers in the questionnaire we can’t put together a personal plan, and without an email address and payment details you can’t take out a subscription. Consent is voluntary; Kroki works fully without it too.

We take appropriate technical and organisational measures to protect your data (GDPR Art. 32, Art. 8 DSG), for example encrypted transmission (HTTPS). No one can ensure complete protection when data is transmitted over the internet.

If you find a security gap, please write to us at hello@getkroki.com.

We adapt this policy when Kroki, our service providers or the law change. The current version with its version number and date is always on this page. If a change needs your consent, we ask you beforehand.