How Kairo handles your clients' data
The privacy policy and the data processing agreement, in plain words. Each point links to the clause it comes from: when in doubt, the legal text prevails.
Your clients' data is yours
For your clients' data the controller is you, the salon. Kairo is the processor: it handles it only on your behalf and under your instructions, as article 28 of the GDPR requires. If a client asks to see or delete her data, the request comes to you, and we help you handle it.
The data processing agreement (DPA) →Where it is kept
The database is hosted in the European Union. Data is encrypted both in transit and at rest, and access is controlled.
Privacy, security →What the AI does with your questions
To answer you, Kairo uses specialised AI providers, only in zero-data-retention mode: the request is processed to produce the answer, it is not kept by the provider and it is not used to train its models. Some of these providers are in the United States: there the transfer is covered by the European Commission's standard contractual clauses.
Privacy, AI providers and transfers →Who sees what, in the salon
The salon's numbers (margins, total takings) are seen by the owner only. A team member using the assistant sees the data of the client she is looking after, not aggregated data on the others.
Privacy, staff data →Kairo does nothing on its own
Kairo prepares the change and writes it out for you: the message, the move, the promotion. Nothing leaves until you press Apply.
How the chat works →What we don't do, and what we do
We don't sell personal data. From the use of the product we derive aggregated, anonymous statistics on the industry, for example how demand for a service changes during the year: they power the comparisons inside Kairo and may be shared with third parties, also for a fee. A figure is released only if it covers at least five salons, so it cannot be traced back to a salon or a client. You can object by writing to us.
Privacy, aggregated statistics →How long it stays, and how you leave
Your clients' data stays for the length of the contract and is deleted within 48 months of the account's last use. You can ask for it to be exported or deleted earlier, at any time: from the settings you download your data as CSV or delete the account.
Privacy, retention →The named list of providers that process data on our behalf is available on request: write to kairo.aidesk@gmail.com.