Privacy Policy — ClickProbe
Zur deutschen FassungWho we are
ClickProbe is operated by kenaro GmbH, a German limited-liability company based in Leipzig, Germany. Contact: privacy@clickprobe.ai.
What data we hold
Account data (name, email), billing data (via Stripe — we never see your card number), session artefacts (screenshots, DOM snapshots used by the AI to explore your app), and access logs.
Subprocessors
| Subprocessor | Purpose | Data categories | Transfer mechanism |
|---|---|---|---|
| Anthropic PBC (USA) | AI inference (screenshots + DOM snapshots) | Screenshots, DOM snapshots, session context, and any test-login credentials you configure for the target app (sent as part of the exploration prompt) | SCCs + EU Data Processing Addendum |
| MailJet (France) | Transactional email | Email address, email content | EU internal |
| Hetzner Online GmbH (Germany) | Hosting | Account data, session data, logs | EU internal, DE |
| Stripe Payments Europe Ltd. (Ireland) | Payment processing | Name, email, billing address (card data held by Stripe) | EU internal |
| Functional Software, Inc. — Sentry (EU region, Frankfurt) | Error tracking | Stack traces, HTTP request metadata, account ID (ULID), release SHA, user-agent | EU data residency (Frankfurt); SCCs for US parent |
| Plausible Insights OÜ (Estonia) | Website analytics (cookieless) | Page URL, referrer, browser/OS, country (aggregated, no cross-site tracking) | EU internal |
Data categories we process
Account data (email, name, password hash). Billing data (name, email, invoice address; card data held by Stripe). Exploration artefacts (screenshots, DOM snapshots, URL lists, session logs from the tested app). Target-app credentials: if you configure a test login for the app under test, the password is encrypted at rest (Fernet, envelope key held on the same host) and decrypted only when a session starts, to be typed into the app’s login form — see “International transfers” below for what that means for where it travels. Proxy client tokens: when you run clickprobe-proxy login on a device, we store an access token and refresh token identifying that device as SHA-256 hashes — the plaintext never leaves your device; the access token expires after 1 hour, the refresh token after 90 days, or immediately when you revoke them. Telemetry data: error stack traces (Sentry EU). Local proxy update check: the local ClickProbe proxy checks, on startup and on request (clickprobe-proxy status), via a plain unauthenticated HTTP GET against clickprobe.ai/downloads/latest/VERSION, whether a newer version has been published. This request carries no account ID, no token, no device identifier and no session ID — it cannot be linked to your account. The check can be disabled via an environment variable (CLICKPROBE_DISABLE_UPDATE_CHECK=1).
How long we keep it
Billing records: 10 years (German statutory requirement). We do not yet have an automated deletion schedule for account data or exploration artefacts (screenshots, DOM snapshots) — they are retained until you delete your account. Error events (Sentry): 30 days.
Your rights
Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. Email privacy@clickprobe.ai. We respond within 30 days.
No tracking cookies
We use Plausible Analytics (EU-hosted, cookieless). No tracking cookies, no third-party ad networks, no fingerprinting. Because we set no cookies that require consent before login, we do not display a cookie-consent banner on this website.
International transfers
Anthropic (USA) receives screenshots and DOM snapshots for AI processing, covered by Standard Contractual Clauses (SCCs) and Anthropic’s EU Data Processing Addendum. If you have configured a test-login credential for the app under test, its password is included, decrypted, in the exploration prompt sent to Anthropic — the AI needs the real value to type it into the target app’s login form. Sentry processes data within EU data centres (Frankfurt); SCCs cover its US parent company.
Questions
privacy@clickprobe.ai. Supervisory authority: Die Sächsische Datenschutz- und Transparenzbeauftragte (datenschutz.sachsen.de).