Privacy Policy

The data controller is Heritage Srls, VAT no. 09949440961, with registered office at Via Martiri di Cefalonia, 4, 20097 San Donato Milanese (MI), Italia. For any privacy matter you can write to kairo.aidesk@gmail.com or kairo.aidesk@gmail.com.

We are not required to appoint a Data Protection Officer (DPO); if one is appointed, their contact details will be published here.

Kairo processes personal data in two distinct capacities:

• As Controller, for the data of website visitors, waitlist sign-ups, and the professionals who hold a Kairo account.
• As Processor, for the personal data of the salon's own end-clients that the salon enters and manages inside Kairo. Here the salon is the Controller of that data and we process it only on its instructions, under the data-processing agreement (DPA) referenced in the Terms.

Kairo is first and foremost a software product: most of the data we process comes from day-to-day use of the app, not from the website. Below we distinguish product data from website/waitlist data.

Product account and subscription:

• identification and contact data, login credentials, business details, and billing/payment data.
• if you sign in with "Sign in with Google": name, email address and profile picture provided by Google, solely to create/authenticate your account.

Salon staff (multi-user accounts):

• if the salon enables multiple users, we also process staff data: name, role, login credentials, permission-elevation PIN (owner/employee) and access history.
• access to financial and aggregate data (e.g. margins, total takings) is reserved to the owner: by design, an employee using the AI assistant only sees data about the client they are currently serving, never aggregate data about other clients, colleagues or services.

Salon business data managed in the product: appointments and calendar, services, takings, receipts and electronic invoices, products and stock, revenue and margin metrics, AI credits consumed and technical product-usage logs.

Telephony and messaging (if enabled): the client's phone number, call audio and transcripts to the extent needed for the voice assistant to work, SMS and WhatsApp messages sent/received with their delivery outcome, and requests made to our AI assistant (the text of questions and generated answers).

Salon clients' personal data (processed on the salon's behalf): name, contacts, appointment history, technical notes (e.g. colour formulas, allergies/notes provided by the salon), purchase history, and any other data the salon chooses to record. The salon is responsible for the lawfulness of this data.

Some of these notes (e.g. allergies) may fall within special categories of data under Art. 9 GDPR: it is the salon's responsibility to identify an appropriate legal basis for processing them (e.g. the end-client's explicit consent).

Website and waitlist:

• business name, your name, contact (email or phone), business category;
• technical data collected by our hosting provider's logs (IP address, browser type, request date and time) for security and diagnostics.

• Provide and operate the service and manage your account — performance of a contract (Art. 6.1.b GDPR).
• Manage the waitlist and pre-sales requests — your consent or our legitimate interest in responding to you (Art. 6.1.a/f).
• Billing, accounting and tax compliance — legal obligation (Art. 6.1.c).
• Security, abuse prevention and service improvement — legitimate interest (Art. 6.1.f).
• Marketing communications about products and news — consent, withdrawable at any time (Art. 6.1.a).
• Generating AI-based insights and answers — performance of the contract and/or legitimate interest (Art. 6.1.b/f).
• Producing aggregated, anonymous industry statistics, used for the product's benchmarking features and made available to third parties, including for a fee — legitimate interest for data we control (Art. 6.1.f) and, for data processed on a salon's behalf, the Controller's documented instruction (Art. 28.3.a). See section 6.

From use of the product we derive aggregated industry statistics: for example how much of a product category sells, how demand varies through the year, which services are bought together. These statistics power the benchmarking features we give back to salons themselves, and may be made available to third parties — for example professional-product suppliers — including for a fee.

The output of this process is anonymous data, from which no individual salon — and still less an individual end-client — can be identified. In practice:

• we strip names, contacts and every other identifier before aggregating: no end-client personal data enters the statistics;
• we release an aggregate figure only when it covers a minimum number of salons (at least five), so that no individual figure can be worked out by subtraction;
• we never disclose to third parties any data attributable to an identified or identifiable salon without that salon's specific opt-in, given in the account settings and withdrawable at any time.

For the salon's business data, of which we are Controller, the legal basis for aggregation is our legitimate interest in developing and improving the Service (Art. 6.1.f GDPR). For data processed on the salon's behalf, aggregation and anonymisation constitute a documented instruction from the Controller under Art. 28.3.a GDPR, set out in the DPA. Once anonymised, the data is no longer personal data and its use falls outside the GDPR (Recital 26).

You may object at any time to processing based on legitimate interest by writing to kairo.aidesk@gmail.com.

We do not sell your personal data. We share it only with the categories of providers listed below, which process it on our behalf with appropriate safeguards (the aggregated, anonymous statistics in section 6 are not personal data and follow the rules set out there):

• cloud hosting and infrastructure providers, to operate the website and the application;
• database hosting provider, located in the European Union;
• artificial-intelligence service providers, for natural-language processing and, where active, the voice assistant (USA or EU, in zero-data-retention mode and with appropriate safeguards — see sections 5 and 8);
• Stripe — payment and subscription handling;
• telephony and messaging providers, including WhatsApp (Meta) for messages sent over that channel;
• transactional and support email delivery provider;
• Google — "Sign in with Google" authentication and, subject to consent, aggregated website usage analytics (Google Analytics);
• professional advisors and competent authorities, where required by law.

The named, up-to-date list of all sub-processors is available on request by writing to kairo.aidesk@gmail.com.

Some providers may process data outside the European Economic Area, in particular in the United States (artificial-intelligence, payment, telephony/messaging and email-delivery providers, and Google). In that case the transfer relies on the EU Commission's Standard Contractual Clauses and appropriate supplementary measures. The database, by contrast, is hosted in the European Union.

In particular, requests to the AI assistant may be processed by providers located outside the EEA: the content of the request — which may include end-clients' names, contacts, calendar and spend data — is therefore processed outside the Union. We transfer the minimum needed to produce the answer and, as stated in section 5, the provider does not retain that content beyond the processing itself.

• Waitlist: until the service launches in your area or you withdraw consent.
• Account and business data: for the duration of the contract.
• Billing and payment data: handled by Stripe, which retains the relevant records per its own policy and legal obligations.
• Salon clients' data: retained for the duration of the contract and deleted within 48 months of the account's last use; the salon may request export or earlier erasure at any time.
• Technical logs: up to 12 months.

You may exercise at any time your rights of access, rectification, erasure, restriction, portability and objection, and withdraw any consent, by writing to kairo.aidesk@gmail.com. You also have the right to lodge a complaint with the Garante per la protezione dei dati personali (Italy) or the authority in your country of residence.

If your data is processed by Kairo on behalf of a salon, address your requests directly to that salon, which is the Controller; we will assist it as required.

We apply appropriate technical and organisational measures: encryption of data in transit and at rest, access controls, EU-based hosting and data-minimisation principles.

We receive and handle, under the procedure set out below, every request for access to, disclosure of or preservation of personal data coming from public authorities, law enforcement or courts — both for data we control and for data we process as Processor on a salon's behalf.

• Legality check — requests are accepted in writing only and logged on receipt. Before any disclosure we verify the requesting authority's competence, the legal basis invoked, the applicable jurisdiction and the formal validity of the instrument; the request undergoes legal review and no data is disclosed without that validation.
• Refusal of unlawful requests — where a request lacks a legal basis, exceeds the authority's competence, comes from a jurisdiction that does not apply, or is not properly formalised, we reject it in writing with reasons. Where appropriate we ask for clarification or for a valid instrument to be issued before reconsidering it, and we challenge the request through the proper channels if it remains unlawful.
• Minimisation — we disclose only the minimum strictly necessary to satisfy the validated request, limited to the individuals, data categories and time period expressly specified. We never export an entire account, client archive or database, and we do not extend disclosure to third-party data outside the scope of the request.
• Documentation — we keep an internal register of requests received, recording the date of receipt, the requesting authority, the legal basis invoked, the outcome of the legality check, any data disclosed, the person who took the decision and the date of that decision. The register is retained as evidence of the procedure followed.
• Notice to data subjects and customers — where a request concerns data processed on a salon's behalf, we inform the salon as Controller without undue delay and do not act on the request without its instructions, unless we are legally required to proceed. Where the law permits, we inform the data subject of the request concerning them.

The entity designated to receive, assess and decide on such requests is Heritage Srls, in its capacity as data controller, at kairo.aidesk@gmail.com. All requests must be addressed in writing to that contact: requests received informally, by telephone or verbally are not actioned.

The use of cookies and similar technologies is described in the Cookie Policy.

We may update this policy. The current version is always published on this page, with the last-updated date shown at the top.