Kinous

Privacy Policy

Last updated: July 8, 2026

1. Who we are

Kinous is an appointment management platform for service businesses such as salons, barbershops, and clinics. This Privacy Policy describes how we process personal data in connection with our services.

Controller vs. Processor: Regarding end-customer data (people making bookings), Kinous acts as a data processor on behalf of the business (the data controller). Regarding business account data (owners, managers, staff), Kinous is the data controller.

2. Data we collect

  • Identity data: full name, email address, phone/WhatsApp number
  • Booking data: services booked, dates, times, professionals assigned, appointment history
  • Preferences: preferred notification channel, recorded consents
  • Business account data: company details, subscription plan, billing history
  • Technical data: IP address, device type, session data — collected automatically via essential cookies

We do not intentionally collect sensitive personal data (health data, ethnic origin, religious beliefs, etc.).

3. How we use your data

  • Service delivery: creating, confirming and managing appointments
  • Notifications: sending reminders and confirmations via email or WhatsApp
  • Support: responding to your requests
  • Billing: processing subscription payments for businesses
  • Platform improvement: anonymized, aggregated usage analysis

We never use end-customer data for our own marketing, and we never sell data to third parties.

4. Legal basis (GDPR)

  • Contract performance (Art. 6(1)(b)): processing necessary to fulfill bookings
  • Consent (Art. 6(1)(a)): sending WhatsApp or marketing notifications
  • Legitimate interests (Art. 6(1)(f)): platform improvement and security
  • Legal obligation (Art. 6(1)(c)): accounting and tax compliance

5. Recipients

  • Meta Platforms (WhatsApp Business API): for WhatsApp notifications, when enabled by the business
  • Meta Platforms (WhatsApp): if you start a conversation through the contact button on our site, that conversation happens inside WhatsApp: your phone number and the message content are processed by Meta under its own privacy policy, including on servers in the United States. The button is only a link, and no data is sent before you click it.
  • Email providers: for transactional confirmations and reminders
  • Payment processors: for subscription billing (card data never passes through our servers)

We do not sell your data or share it with third parties for advertising purposes.

6. Your rights

Under the GDPR and applicable law, you have the right to:

  • Access your personal data
  • Rectification of inaccurate data
  • Erasure (“right to be forgotten”)
  • Restriction of processing
  • Data portability
  • Object to processing based on legitimate interests
  • Withdraw consent at any time without affecting prior processing
  • Lodge a complaint with a supervisory authority

To exercise your rights, contact us at hello@kinous.io. We respond within 30 days.

7. Data retention

  • Customer data: retained for the duration of the business's use of Kinous, plus up to 3 years
  • Business account data: retained for the contract term plus 7 years for accounting purposes
  • Technical logs: up to 12 months

8. International transfers

Data for EU customers is stored on servers within the EU. Any transfers outside the EEA are made under appropriate safeguards (Standard Contractual Clauses, Art. 46 GDPR).

9. Cookies and similar technologies

We use cookies and similar technologies in three categories:

  • Essential: required for the platform to work (login session, security, language preference). No consent required; cannot be disabled.
  • Usage statistics (with your consent): we use the product analytics tool PostHog (PostHog Inc., data hosted in the European Union) to understand, in aggregate, how the platform is used. It is only activated after you accept it in the cookie banner. Legal basis: consent (Art. 6(1)(a) GDPR).
  • Marketing (with your consent): we use Google Tag Manager and advertising pixels from partner platforms (Google Ads, Meta) for conversion measurement and personalized ads. These only load after you accept them in the cookie banner. Legal basis: consent (Art. 6(1)(a) GDPR). Transfers to the US rely on the EU-US Data Privacy Framework adequacy decision or Standard Contractual Clauses (Art. 46 GDPR).

On your first visit, the cookie banner asks for your choice — no optional category is activated without your express consent. You can change or withdraw your consent at any time via the “Cookies” link in the footer (Art. 7(3) GDPR). Withdrawing is as easy as consenting.

10. Security

We implement appropriate technical and organizational measures including TLS 1.3 encryption, httpOnly authentication tokens, role-based access control, and regular security reviews.

11. Changes

We may update this policy. For material changes, we will provide at least 30 days' notice via email or in-app notification.

12. Contact

Data controller for the European offering: Daniel Lourenço (sole trader), Humboldtstr. 103, 90459 Nürnberg, Deutschland. See also our Impressum.

Privacy inquiries: hello@kinous.io

Supervisory authority (EU): Federal Commissioner for Data Protection (BfDI)

Privacy Policy — Kinous