Kestrel
Download

Privacy Policy

Last updated: 20 October 2026

1. Controller

m8werk digital solutions UG (haftungsbeschränkt) Ebersteinstraße 13 66540 Neunkirchen Germany

Phone: +49 6821 20710600 Email: [email protected]

Represented by its managing director, Christoph Herrmann.

We are not legally required to appoint a data protection officer (Art. 37 GDPR, § 38 of the German Federal Data Protection Act, BDSG). If you have any questions about data protection, please contact us at the address above.

2. Scope

This policy applies to the licence service at https://license.m8werk.de (the purchase page, the customer account, the emails about purchases and licences, the downloads, and the interface our apps use to check their licence and fetch updates) and to the websites of our products that refer to it, such as https://kestrel-app.de and https://turnworks.de. Stripe's privacy policy also applies to Stripe's payment page.

Data that an app processes on your device (in Kestrel's case, for example, network connections and rules) stays on your device and is not transmitted to us. Our apps contain no tracking or analytics tools. On the websites of our products we measure reach without cookies, using software we run ourselves (section 3, “Reach measurement”); the licence service itself measures nothing.

3. Visiting our pages

Cloudflare

Our pages and the interface are reached through the network of Cloudflare, Inc. (San Francisco, USA). Cloudflare forwards requests to our server, resolves the domain name and protects the pages against attacks. In doing so, Cloudflare processes your IP address and the technical details of your request. Cloudflare acts as our processor. The legal basis is our legitimate interest in a secure and available service (Art. 6 (1) (f) GDPR).

Access logs

The web server that receives requests on our server logs every access with the date and time, the address requested, the status code, the amount of data transferred, the browser identifier and the IP address. We use these logs to detect errors and attacks and delete them after 14 days. The legal basis is our legitimate interest in secure operation (Art. 6 (1) (f) GDPR).

Protection against misuse

To limit misuse, such as too many sign-in attempts or orders in a short time, the licence service briefly uses your IP address in memory. It is not stored permanently there and is discarded when the relevant time window ends. The legal basis is Art. 6 (1) (f) GDPR.

Hosting

The licence service and the websites of our products run on servers of Hetzner Online GmbH (Gunzenhausen) in Germany, which acts as our processor.

Reach measurement

On the websites of our products (not on the pages of the licence service) we use the software Rybbit to measure how often which pages are visited. We run Rybbit ourselves on our server at Hetzner Online GmbH in Germany; the data is not passed on to anyone.

When you open a page, Rybbit processes the address of the page, the page you came from, the type and version of your browser and operating system, the device type, the screen size, the language, and the country and region derived from your IP address. The IP address itself is not stored. To count visits, Rybbit forms a hash from your IP address, your browser identifier and the website's identifier together with a random value that changes every day. A visit can therefore only be linked within the same day, not across days, and the hash cannot be traced back to you. Rybbit sets no cookies and stores nothing on your device, so no consent under § 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) is required. Sessions are not recorded.

The legal basis is our legitimate interest in learning how our websites are used in order to improve them (Art. 6 (1) (f) GDPR). You may object to this processing at any time (section 13).

4. Purchases

Order

For an order, we process your email address, the product chosen, the number of licences, the price, any voucher code redeemed, the order number, and the time and exact wording of your acceptance of our terms and of your consent to immediate delivery. The legal basis is the performance of the contract (Art. 6 (1) (b) GDPR). We also keep the details of your consent so that we can prove that your right of withdrawal has expired (Art. 6 (1) (f) GDPR).

We need your email address to send you the licence key and the invoice. Without it, we cannot conclude a contract.

Payment via Stripe

Payments are processed by Stripe Payments Europe, Limited (Dublin, Ireland). You enter your name, billing address, VAT identification number where applicable, and payment details directly on Stripe's payment page. Stripe uses the billing address to calculate VAT and tells us the result of the payment. We do not receive full card numbers.

Stripe processes this data partly on our behalf and partly under its own responsibility, for example for fraud prevention and to meet its own legal obligations. If Stripe offers to save your payment details for future purchases, Stripe itself is responsible for this. Stripe may transfer data to companies of the Stripe group in the USA; details are set out in Stripe's privacy policy at https://stripe.com/privacy.

If you choose PayPal, PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) processes the payment under its own responsibility. The same applies to Apple and Google if you use Apple Pay or Google Pay.

The legal basis is the performance of the contract (Art. 6 (1) (b) GDPR) and, as far as VAT is concerned, our legal obligation (Art. 6 (1) (c) GDPR).

Invoice

We do not store your name and address in the licence service's database. We read them from Stripe in order to create the invoice. We create invoices with Lexware Office, provided by Haufe-Lexware GmbH & Co. KG (Freiburg), which acts as our processor. Invoices are stored there with your name, address, VAT identification number where applicable, the service and the amount. The legal basis is our legal obligation to issue and retain invoices (Art. 6 (1) (c) GDPR in conjunction with § 14 of the German VAT Act, § 147 of the German Fiscal Code and § 257 of the German Commercial Code).

Refunds

If we refund a purchase, we initiate the refund via Stripe and record it with the order and the licences concerned (Art. 6 (1) (b) and (c) GDPR).

5. Licences and devices

For each licence, we store the holder's email address, the product, the licence number, the date of issue and the date until which updates are included. The licence key itself contains neither your name nor your email address, but we can link it to your purchase through the licence number.

When an app activates a device for your licence, we do not store a device identifier in plain text, only a check value (SHA-256 of licence and device identifier), the name the app sends for the device, and the time of activation and of the last check. The device name comes from your operating system and may contain your name. This allows us to enforce the number of devices per licence and lets you see and release your devices in the customer account. The legal basis is the performance of the contract (Art. 6 (1) (b) GDPR).

If you transfer a licence to another person in the customer account, we store their email address as the new holder address and send them the licence key. The legal basis is the performance of the contract with you and with the new holder (Art. 6 (1) (b) GDPR).

6. Connections between the apps and the licence service

Our apps connect to the licence service in order to

  • activate a device and check the licence (the licence number, the device's check value and the device name are transmitted),
  • fetch the list of revoked licence keys (without a licence key),
  • check for and download updates (the version and platform are transmitted, not the licence key),
  • fetch data an app needs to work (in Kestrel's case, the DB-IP Lite location database).

Each connection also transmits your IP address and technical details of the request; section 3 applies to these. The legal basis is the performance of the contract (Art. 6 (1) (b) GDPR); for the free version, it is our legitimate interest in providing you with updates and the data required (Art. 6 (1) (f) GDPR).

Where a product offers settings synchronisation, the app encrypts your settings on your device before they are transmitted to us. Only your device holds the key; we store nothing but the encrypted content, a version number and the time of the last change, and cannot read your settings. The legal basis is Art. 6 (1) (b) GDPR.

7. Customer account and cookies

You sign in without a password: we send a sign-in link to your email address that is valid for 15 minutes and can be used once. After you sign in, a cookie keeps your session for 7 days or until you sign out; scripts on the page cannot read it. If you choose the light or dark appearance, another cookie remembers your choice for one year. Both cookies are strictly necessary to provide the function you requested, so no consent is required (§ 25 (2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG). The related processing is based on Art. 6 (1) (b) GDPR (session) and Art. 6 (1) (f) GDPR (appearance).

We do not use cookies for advertising or analytics and do not embed third-party content such as fonts, videos or maps.

8. Emails

We send emails that relate to your purchase and your licences: the licence key and order confirmation, invoices, sign-in links, refunds and transferred licences (Art. 6 (1) (b) GDPR). The emails are sent via IONOS SE (Montabaur), which acts as our processor.

We also let you know by email when the update period of your licence is about to end and that you can extend it. This is advertising for our own similar services, which we may send to you as a customer without separate consent (§ 7 (3) of the German Act against Unfair Competition, UWG). The legal basis is our legitimate interest in informing our customers (Art. 6 (1) (f) GDPR). You can object to this use of your email address at any time, in the customer account or by email to [email protected], without incurring any costs other than the transmission costs at basic rates.

If you email or call us, we process your details to handle your request (Art. 6 (1) (b) GDPR, or Art. 6 (1) (f) GDPR for other enquiries).

9. Recipients and transfers to third countries

Personal data is received only by the parties named in this policy:

  • Hetzner Online GmbH, Gunzenhausen, Germany: servers (processor)
  • Cloudflare, Inc., San Francisco, USA: name resolution, forwarding and protection of the pages (processor)
  • IONOS SE, Montabaur, Germany: sending emails (processor)
  • Stripe Payments Europe, Limited, Dublin, Ireland: payments and VAT calculation (partly processor, partly independent controller)
  • PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg: payments, if you choose PayPal (independent controller)
  • Haufe-Lexware GmbH & Co. KG, Freiburg, Germany: invoices (processor)

We have concluded contracts with our processors in accordance with Art. 28 GDPR. Apart from this, we pass on data only where we are legally required to do so, for example to tax authorities.

Cloudflare and companies of the Stripe group may process data in the USA. For the USA, there is an adequacy decision of the European Commission covering companies certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR); Cloudflare and Stripe are certified. In addition, these providers have agreed to the European Commission's standard contractual clauses (Art. 46 (2) (c) GDPR).

10. Retention periods

  • Orders, licences and the associated email address: for as long as the licence exists, because this is the only way a perpetual licence can be checked, transferred and restored; beyond that, for as long as statutory retention periods apply.
  • Invoices and other accounting records: eight years from the end of the calendar year in which they were created (§ 14b of the German VAT Act, § 147 of the German Fiscal Code, § 257 of the German Commercial Code).
  • Business emails that count as commercial or business letters: six years from the end of the calendar year (§ 147 of the German Fiscal Code, § 257 of the German Commercial Code).
  • Activated devices: until you release the device or the licence is deleted.
  • Encrypted settings: until you delete them in the app or the licence is deleted.
  • Sign-in links: 15 minutes or until used. Sessions: 7 days or until you sign out.
  • Reach measurement: the daily random value is discarded at the end of the day; after that the stored page views can no longer be linked to a visit or a person and are kept as statistics.
  • Access logs: 14 days. IP addresses used to prevent misuse: in memory only, for the duration of the relevant time window.

If a licence is deleted, its number remains on the revocation list permanently so that the key does not become valid again. The revocation list does not contain email addresses.

11. No automated decisions

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR), and we do not create profiles.

12. Your rights

You have the right of access to the data we hold about you (Art. 15 GDPR), to rectification (Art. 16 GDPR), to erasure (Art. 17 GDPR), to restriction of processing (Art. 18 GDPR) and to data portability (Art. 20 GDPR). To exercise these rights, please write to [email protected].

13. Right to object under Art. 21 GDPR

Where we process your data on the basis of legitimate interests (Art. 6 (1) (f) GDPR), you may object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

You may object at any time, without giving reasons, to the use of your email address for information about our own similar services (section 8).

No particular form is required; an email to [email protected] is sufficient.

14. Complaints to a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Unabhängiges Datenschutzzentrum Saarland Fritz-Dobisch-Straße 12 66111 Saarbrücken Germany Phone: +49 681 94781-0 Email: [email protected] https://www.datenschutz.saarland.de

15. Changes

We update this policy when our services or the law change. The version published on this page applies.