Privacy policy

1. Who is the controller

Stella JM Corp S.R.L. (cédula jurídica 3-102-786135), with registered address at San José, Costa Rica. Privacy contact: [email protected]. Data protection officer or representative: not appointed for now; please write to the privacy contact.

2. Two different roles

• Controller: Ku4ndo decides on the data of business accounts and dashboard users (owners, administrators and professionals), and on the billing data of subscriptions.
• Processor: the data of customers who book with a business is managed by that business, which is its controller. Ku4ndo processes it on behalf of the business, solely to provide the service and following its instructions (dashboard settings). If you are a customer of a business, to exercise your rights please contact that business first; if you write to us, we will forward the request to it.

3. Data of businesses and dashboard users

• Account: email, name and profile picture (if you sign in with Google), language and the email verification date. If you use Google to sign in, we store the identifiers and tokens that Google returns for that session.
• Session: a session identifier and its expiry.
• Business: name, address (slug), locations and addresses, opening hours, services and prices, logo, cover image and photos, page texts, colors, custom domain and settings.
• Team: display name, job title, bio, photo and, optionally, the email of each professional; role and permissions of each access; invitations (invitee’s email and who sent the invitation).
• Billing: Stripe customer and subscription identifiers, plan, period, currency and payment status. Card details are received by Stripe; Ku4ndo does not see or store them.
• Integrations: if you connect Google Calendar or Outlook, we store the connected account (usually its email) and its encrypted access tokens, and the busy time ranges of the calendar, without titles or details. If you connect Stripe to collect payments for appointments, the identifier of your connected account and its status.
• Activity log: who made relevant changes in the dashboard (for example, deleting a customer or changing permissions), with the before and after.

4. Data of each business’s customers

• When booking: name, mobile phone number, email (if the business requests it or the customer provides it), language and time zone, and any comment the customer writes.
• Appointments: service, professional, location, date and time, status, changes and cancellation reason.
• Business management: internal notes and tags that the business adds to the customer’s record, with their author.
• Notifications: consent for WhatsApp/SMS (date and phone number for which it was given) and opt-outs; if the customer links Telegram, the chat identifier; a log of each notification sent (recipient, channel, status).
• Waitlist: contact details and the requested time slot.
• Appointment payments: Stripe identifiers, amounts and refunds. Card details are received by Stripe; neither Ku4ndo nor the business sees them.
• Reviews: rating, comment and an abbreviated name (for example, “Laura P.”), only for completed appointments.

The customer does not need to create an account. Their personal “my appointment” link lets them view, reschedule or cancel the appointment and expires 30 days after the appointment.

5. What we use the data for and on what basis

• Providing the service contracted by the business: account, schedule, public page, bookings, notifications, payments and integrations (performance of the contract).
• Charging for subscriptions and messaging credit, and complying with accounting and tax obligations (contract and legal obligation).
• Sending transactional emails: dashboard access, confirmations, reminders, changes and review requests for completed appointments (contract; in the case of customers, on behalf of the business).
• Sending WhatsApp or SMS notifications only to customers who ticked the consent box, which is not pre-ticked (consent, revocable at any time).
• Security and abuse prevention: rate limits per IP and per email, technical and activity logs (legitimate interest).

Ku4ndo does not sell data, does not use it for advertising, does not build commercial profiles of customers and does not use third-party analytics or advertising tools.

6. Providers that process data (sub-processors)

We use these providers to deliver the service. Some are only involved if the business enables the corresponding feature.

If the business uses the API or webhooks (Business plan), the data received by its system falls under its responsibility. Webhooks do not include customers’ names, emails or phone numbers; the API does return them to anyone holding a key of the business.

7. International transfers

Several of these providers process data outside your country, in particular in the United States. Where required by law, transfers rely on the safeguards offered by each provider (for example, standard contractual clauses or adequacy frameworks).

8. How long we keep data

Technical logs mask emails, phone numbers, cookies and credentials. IP addresses are used only in memory and in temporary counters to limit attempts; they are not stored in the database.

9. Your rights

Depending on the law of your country (for example, the GDPR in Europe or the LGPD in Brazil), you can request access, rectification, erasure, portability, objection or restriction of processing, and withdraw your consent. You can also lodge a complaint with the data protection authority of your country.

• Customers of a business: from the customer’s record, the business can download a copy of their data (JSON or CSV), correct it or delete it. Deleting erases or anonymizes the name, email, phone number, notes, tags, consents, Telegram link, waitlist entries and the text of their reviews, cancels their future appointments and invalidates their links; the dates, services and amounts of past appointments are kept, without identifying them.
• WhatsApp or SMS notifications: you can unsubscribe from the “my appointment” link or by replying STOP; on Telegram, with /stop or by blocking the bot.
• Businesses and dashboard users: you can correct your data from the dashboard and export your customers as CSV. To request a copy of your account data or its erasure, write to [email protected].

Backups may retain deleted data until they are renewed, within the period indicated above.

10. Cookies

Ku4ndo uses only its own cookies that are necessary for the service to work. It does not use analytics, advertising or social media cookies, nor does it store data in the browser’s local storage. Fonts are served from our own domain. That is why we do not show a cookie consent banner.

Session and sign-in cookies are only used in the dashboard (app.ku4ndo.com). People booking an appointment only receive the language cookie, if they choose a language. When you pay for an appointment or a subscription, you are redirected to Stripe, which applies its own cookies according to its policy.

11. Security

Each business’s data is isolated in the database, connections are encrypted (HTTPS), calendar tokens and webhook secrets are stored encrypted, and API keys only as a fingerprint (hash). Professionals without management permission see customers’ contact details masked. No system is infallible: if we detect a security breach that affects you, we will notify you as required by law.

12. Minors

Business accounts are for people of legal age. If a business serves minors, it is the business that must obtain, where applicable, the consent of their parents or guardians to process their data.

13. Changes to this policy

If we change this policy, we will update the date above and, if the change is material, we will notify businesses by email or in the dashboard.

14. Contact

Stella JM Corp S.R.L. · San José, Costa Rica · [email protected]