Security and data protection
What Klirry does with your data, in plain terms. Each statement is backed by how the product is built; the legal documents below are the binding ones.
Where your data lives
Klirry runs on a server in Falkenstein, Germany, hosted by Hetzner under a standard data processing agreement. Your orders and account data are stored there. Not everything is EU-only: Stripe (card billing) and Sentry (error monitoring) are US companies. The sub-processors page lists every vendor and where it runs.
Credentials are encrypted
The credentials Klirry uses to connect to your store and ad accounts, and two-factor secrets, are encrypted at rest at the application level with AES-256-GCM. The key is held outside the database.
Read-only access
Klirry connects to your store and ad accounts to read numbers. It does not change your products, orders, prices or ads, and you do not install a Klirry pixel on your storefront. The only things it creates in a connected store are its own webhook subscriptions (small notices your store sends Klirry when an order comes in) and, for Shopify, the subscription you approve.
What we do not store
Klirry keeps an order's country, amounts, VAT, payment method, shipping method and line items. It does not keep the end customer's name, address, email or phone: they are removed before an order reaches our database.
Cookies
Klirry sets a first-party session cookie once you sign in, and nothing else that needs your consent without asking you first. Website analytics, if switched on, loads only after you accept. The cookie list is in the privacy policy.
Leaving
When you leave, you have at least 30 days to export your data. After that it is deleted, except for the records the law or a legal claim requires us to keep, which the privacy policy lists.