1. Roles: Salon and KAMAS
The Salon using the platform is the controller of its own end-customer data: it decides which appointments to record, which information to enter and for which purposes it is used.
KAMAS is the software (SaaS) provider and acts as processor when it technically processes customer data on behalf of the Salon, based on the instructions set out in the Terms & Conditions and in Annex A — Data Processing Addendum.
KAMAS is instead the controller for data it processes for its own legitimate purposes: the professional account of the Salon and its staff, platform security, abuse prevention, administration and subscription billing.
KAMAS does not use salon customer data for its own commercial, marketing, advertising, profiling or CRM purposes. Where such data is technically processed as part of the booking service, KAMAS processes it strictly to the extent necessary to provide, maintain and protect the service on behalf of the Salon.
Operating base: Zurich, Switzerland. For any privacy request you may write to the contact address published by the salon on its page, or to KAMAS at the address indicated in the Contact section of the platform.
2. Personal data collected
- Booking data: first and last name, e-mail address, phone number in international format, selected service, professional, date and time of the appointment, any notes left by the customer.
- Professional account data: owner name, salon name, full address, postal code, city, country, e-mail, phone, chosen subdomain, preferred language.
- Billing and subscription data: subscription status, invoice history, SMS usage. Payment card data is processed exclusively by the payment provider and is never stored by KAMAS.
- Essential technical data: IP address, device and browser type, access and security logs (login attempts, two-factor verifications).
3. Purposes and legal basis
- Performance of the contract: managing bookings, appointment reminders, delivery of the in-salon service, subscription billing.
- Legal obligation: retention of accounting records under Swiss law.
- Legitimate interest: platform security, abuse prevention, aggregated and anonymous usage statistics.
- Consent: promotional messages via SMS or e-mail and use of non-essential cookies. Consent can be withdrawn at any time.
4. Contact and booking forms
Forms only request the data needed to confirm and manage the appointment (data minimisation). Submitting a form implies that this policy has been read; no data is used for promotional purposes without separate, specific consent. Appointment reminders, sent up to three hours in advance, are part of the requested service and are not commercial communications.
5. Providers and disclosure to third parties
Data is never sold or transferred to third parties for marketing purposes. There is no customer database shared between salons, no global CRM and no global customer export.
Some of these providers are companies with establishments outside Switzerland and the European Economic Area and may, in certain situations, process data in third countries. In such cases the transfer relies on the safeguard mechanisms provided by applicable law and on the data protection terms agreed with the provider. KAMAS does not state a specific transfer mechanism for a provider unless it has been verified for the actual scenario.
- Supabase (managed PostgreSQL database on AWS infrastructure, EU region): production database hosting. Data categories: bookings, professional accounts, technical data and application logs.
- Twilio: sending confirmation SMS, reminders and operational messages about appointments. Data categories: phone number and message content.
- Stripe: management of the Salon's subscription and related payments. Data categories: Salon billing data; card data is processed exclusively by Stripe and is never stored by KAMAS.
- Resend: sending transactional e-mails, in particular password recovery. Data categories: e-mail address and message content.
- Competent authorities, exclusively where required by law.
6. Data retention
Personal data contained in bookings is kept for a maximum of twenty-four months. An automated nightly process running on the database anonymises the personal data of expired bookings (name, phone, e-mail and notes) and deletes customer profiles and access tokens that are no longer needed.
Data required for accounting and administrative obligations, in particular invoices and Salon subscription records, is processed separately and kept in accordance with the applicable obligations, as a rule ten years under the Swiss Code of Obligations.
Backups and logs handled by infrastructure providers follow the operational cycles of those services: this policy does not state a specific backup duration or location, because that configuration is not determined by the application code. When a professional account is closed, the Salon's data is deactivated and subsequently deleted, subject to legal retention obligations.
7. Security
Access to data is protected by authentication, per-salon isolation enforced at database level through Row Level Security (no cross-salon access), encryption in transit and two-factor authentication available on all professional accounts. Passwords are managed by Supabase Auth and stored in hashed form only, subject to minimum complexity requirements.
Technical access by KAMAS personnel to a salon's data is limited to what is strictly necessary for maintenance, security and support, and is subject to confidentiality obligations.
8. Data subject rights
Requests are handled within thirty days. You may also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) in Bern or, for residents of the European Union, with the competent supervisory authority under the GDPR.
- Right of access to your personal data.
- Right to rectification of inaccurate or incomplete data.
- Right to erasure, within the limits of legal retention obligations.
- Right to restriction of and objection to processing.
- Right to data portability in a readable format.
- Right to withdraw consent at any time.
9. Minors
Bookings for minors under sixteen must be made by a parent or legal guardian, who is responsible for the accuracy of the data provided.
10. Changes
This policy may be updated to reflect legal or technical changes. The date of the last update is shown at the top of the page; material changes are communicated to registered users.
11. Booking notes and health data
The platform is not intended for the collection or management of health data. Note fields are meant solely for organisational information about the appointment and display an explicit warning not to enter medical information or personal health data.
KAMAS does not build health records, does not classify notes, does not analyse them automatically and performs no profiling on their content.
12. No commercial use of customer data
KAMAS does not use end-customer data for its own marketing, advertising, profiling or CRM activities, does not aggregate it across salons and does not make it available to other salons. Any promotional messages are sent exclusively by the Salon, under its responsibility and within the limits of the consent it collected.