Kvarlo.

Privacy Policy

Last updated: November 2026

This is an English translation of our Datenschutzerklärung. If the two versions differ, the German version prevails.

1. Controller

Michael Timofeev
Sürther Str. 99
50996 Köln, Germany
Email: michael@kvarlo.io

If you have any questions about data protection, please contact us at the email address above.

2. Overview

Kvarlo is a CRM for sales teams, available at www.kvarlo.io ("the application"), complemented by a browser extension for Google Chrome ("Kvarlo for LinkedIn"). This policy describes which personal data is processed when you visit this website, use the application and use the extension.

3. Visiting the public website

When you open the website, the server processes technical access data (IP address, time, page requested, user agent) to the extent necessary to deliver the page and to keep the service secure (Art. 6(1)(f) GDPR). Server logs are deleted after 90 days at the latest. Server security logs (for example on failed SSH login attempts and blocked addresses) are deleted after about five weeks.

The public pages set no cookies and include no analytics, tracking or advertising services. No content is loaded from third-party servers, with one exception: on the sign-up and password reset pages, Cloudflare Turnstile (Cloudflare, Inc., USA) protects the forms against automated requests. Your IP address and technical details of your browser are transmitted to Cloudflare to check whether the request comes from a human. The legal basis is our legitimate interest in protection against abuse (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-US Data Privacy Framework.

4. Using the application (with an account)

The application can only be used with an account set up by the respective organisation.

  • Account data: name, email address, password (stored as a hash) and organisation membership, to provide the service (Art. 6(1)(b) GDPR).
  • Cookies: only technically necessary cookies: the session (authjs.session-token), the language choice (NEXT_LOCALE) and the appearance (KVARLO_THEME). No tracking cookies.
  • CRM content: leads, contacts, emails, notes, tasks and activities that your organisation enters or synchronises through connected mailboxes. Kvarlo processes this content as a processor on behalf of the respective organisation (Art. 28 GDPR); the organisation is the controller for it.
  • Email connection: credentials for connected mailboxes are used exclusively to fetch and send the organisation's emails.

Hosting and service providers: The application runs on servers of Contabo GmbH (data centre in Germany). Encrypted backups are stored with Cloudflare, Inc. (Cloudflare R2) on servers in the EU; Cloudflare is based in the USA and certified under the EU-US Data Privacy Framework, and the EU Standard Contractual Clauses apply in addition. System emails (for example password resets, invitations and booking confirmations) are sent by Sand Dune Mail Ltd (SMTP2GO, New Zealand) through servers in the European Economic Area; an adequacy decision of the European Commission exists for New Zealand. A data processing agreement under Art. 28 GDPR is in place with each of these providers.

Billing through Stripe: If your organisation takes out a subscription, payment and invoicing are handled by Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Dublin 2, Ireland). For this, Stripe processes the organisation's name, billing address, VAT identification number, the email address of the person taking out the subscription, the number of users and the payment data (for example card details or IBAN). You enter the payment data directly with Stripe; Kvarlo neither receives nor stores it. The legal bases are the performance of a contract (Art. 6(1)(b) GDPR) where the customer is a sole trader, our legitimate interest in performing the contract with your company (Art. 6(1)(f) GDPR) where you act as the contact person of a business customer, and compliance with commercial and tax retention obligations for invoices (Art. 6(1)(c) GDPR). Stripe also processes some of this data as an independent controller, for example for fraud prevention and to meet financial regulatory obligations; details at https://stripe.com/privacy. Stripe also processes data in the USA; Stripe is certified under the EU-US Data Privacy Framework, and the EU Standard Contractual Clauses apply in addition. Stripe does not receive the content of the CRM (leads, contacts, emails, notes).

Calendar connection: Users can connect a calendar to Kvarlo, through a secret iCal address, through CalDAV with username and password, or through their Google account. Kvarlo reads only: the start and end of events, their titles, and the email addresses of the attendees and the organizer. Kvarlo uses this data to hide busy times on the booking page, to attach meetings with customers to the matching lead and to recognise internal meetings. Kvarlo does not create or change any events in your calendar. Credentials (CalDAV password, Google access token) are stored encrypted. You can end the access at any time by removing the calendar in Kvarlo or by revoking Kvarlo's access in your Google account at myaccount.google.com/permissions.

Kvarlo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Kvarlo does not use this data for advertising, does not sell it and does not use it to train AI models.

Services chosen by the customer: Mailboxes, calendars and AI assistants that your organisation connects to Kvarlo itself are chosen by and the responsibility of the organisation. Kvarlo does not engage them as its own service providers.

Data processing agreement: Organisations using Kvarlo conclude an agreement with us under Art. 28 GDPR.

5. Browser extension "Kvarlo for LinkedIn"

The extension connects your own Kvarlo server with LinkedIn. The following applies:

  • Stored locally (in the browser, chrome.storage.local): only the address of the configured Kvarlo server and an API key. Both leave the browser only for requests to exactly that server.
  • Read: only content on LinkedIn profile and messaging pages: the profile details shown there (name, title, company, profile URL) and, only when you trigger an action, the text of the open conversation.
  • Transmitted: this data only to the Kvarlo server you configured, to create leads or log messages as activities. Nothing is transmitted to the provider of the extension or to any other third party.
  • The extension contains no analytics, tracking or advertising features. Data is not sold and not used for purposes beyond the core function described.
  • For data stored in the CRM, section 4 applies: Kvarlo processes it on behalf of the organisation that owns the account used.

6. Recipients

Personal data is not passed on to third parties, except to the service providers named in section 4 (hosting, backups, system emails, billing) and to the email providers and other services that your organisation connects to Kvarlo itself.

7. Retention

Titles and attendee addresses stored from connected calendars are deleted after 31 days, busy times after 90 days, and everything else relating to a calendar at the latest when it is removed.

Account and CRM data is stored for as long as the account or the organisation exists and is deleted after the end of the contract unless statutory retention obligations apply: from the live system 30 days after the end of the contract, from backups when they are rotated, at the latest six months after deletion from the production system. Trial accounts without a subscription are deleted on request, at the latest 90 days after the end of the trial period. We keep invoices and the related billing data for 8 years, as required by commercial and tax retention obligations (§ 147 AO, § 257 HGB as amended; legal basis Art. 6(1)(c) GDPR).

8. Your rights

Under the GDPR you have the right of access, rectification, erasure, restriction of processing, data portability and to object to processing based on Art. 6(1)(f) GDPR. You can also lodge a complaint with a data protection supervisory authority. If your request concerns an organisation's CRM content (section 4), please also contact that organisation as the controller.

9. Changes

This policy is updated when the application or the legal situation changes. The version published here applies.