Last updated: October 29, 2026
The short version. Kuseki handles the data of the professionals who sign up as a controller. It handles the data of clients who book on a professional's page on that professional's behalf, as a processor (Article 28 GDPR). No ads, no selling data, no tracking cookies.
Who is responsible for your data?
Kuseki App (kuseki.app) is provided by Michele De Vivo, trading as MichyDev, a self-employed professional (autónomo) based in Spain. On this page we call it "Kuseki", "we" or "us". Because we are based in the European Union, we follow the EU General Data Protection Regulation (GDPR) for every user, wherever you live.
- Privacy questions and requests: [email protected]
- Tax ID (NIF): Y4961075N (Spain)
We have not appointed a Data Protection Officer because the law does not require one for an activity like ours (Article 37 GDPR).
Why does Kuseki have two different roles?
Kuseki is a tool for people who work on their own: barbers, hairstylists, nail techs, estheticians and similar. The professional creates a booking page and their clients book there. That creates two situations:
| Whose data | Kuseki's role | Who decides |
|---|---|---|
| Professionals using Kuseki (account, page, subscription) and visitors to kuseki.app | Controller | Kuseki |
| Clients who book on a professional's page (name, phone, email, appointment) | Processor on behalf of the professional (Article 28 GDPR) | The professional, who is the controller |
If you booked an appointment on a Kuseki page, the professional you booked with is responsible for your data. Contact them first to exercise your rights. If you write to us, we will pass your request on and help them answer.
What data do we handle as controller, and why?
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Email, business name, password (stored only in hashed form), language | Create and run your account | Contract (Art. 6(1)(b)) |
| Logo or photo you upload, services, prices, hours, days off, page text | Show your booking page | Contract (Art. 6(1)(b)) |
| Billing details (name or company, tax ID, address), payment history | Subscription, invoices, tax duties | Contract and legal obligation (Art. 6(1)(b) and (c)) |
| Messages you send to support | Answer and fix problems | Contract or legitimate interest (Art. 6(1)(b) and (f)) |
| Technical data: IP address, browser type, access times, error logs | Security, abuse prevention, keeping the service running | Legitimate interest (Art. 6(1)(f)) |
| Service emails (account confirmation, end of trial, renewals, technical notices) | Tell you what you need to know about your account | Contract (Art. 6(1)(b)) |
| Product news emails | Keep you posted about Kuseki | Consent or, for existing customers, legitimate interest; you can opt out at any time |
We do not use your data for third-party advertising, we do not sell it and we do not build marketing profiles. We do not make decisions based solely on automated processing that have legal effects on you (Article 22 GDPR).
What data do we handle on behalf of professionals?
When a client books on a professional's page, Kuseki records the name, phone number, email (if requested), chosen service, date and time, any notes written by the client, and the status of the appointment (confirmed, moved, cancelled, no-show). On the professional's instructions we send confirmations and reminders.
Phone notifications: if a client or professional turns on notifications, we store the technical delivery address provided by the browser (it contains no name or number) and use it only for reminders and booking alerts. They can be turned off at any time in phone or browser settings; when the browser invalidates it, we delete it.
We use this data only to run the service for that professional, following their instructions and the data processing agreement in our Terms, section "Processing data on behalf of the professional". We do not use it for our own purposes and we never share it with other professionals.
We ask clients not to write health information or other sensitive details in the notes field. If a professional needs to know something like that, it is better to ask in person.
Which providers do we use?
| Provider | What it does | Where | Safeguards |
|---|---|---|---|
| Hetzner Online GmbH | Servers and database for the service (accounts, bookings, reminders) | EU | Data processing agreement (Art. 28 GDPR) |
| Cloudflare, Inc. | Website hosting, protection against attacks | EU and US (global network) | Cloudflare DPA with Standard Contractual Clauses; EU-U.S. Data Privacy Framework certification |
| Resend (Plus Five Five, Inc.) | Service emails, confirmations and reminders | US | Resend DPA; EU-U.S. Data Privacy Framework certification |
| Stripe (when active) | Subscription payments. Stripe handles card details; we never see them | EU and US | Stripe Privacy Policy; EU-U.S. Data Privacy Framework certification. For some purposes (fraud prevention, legal duties) Stripe acts as an independent controller |
| WhatsApp / Meta (optional, coming soon) | WhatsApp reminders, only if the professional turns them on | EU and US | WhatsApp Business terms. Until the feature is live, no data goes to Meta |
Does data leave the European Union?
Some providers are based in the United States. Those transfers rely on the European Commission's adequacy decision for companies certified under the EU-U.S. Data Privacy Framework (Article 45 GDPR) and, in addition or as an alternative, on the Commission's Standard Contractual Clauses (Article 46 GDPR). Ask us at [email protected] for a copy of the safeguards.
How long do we keep data?
- Professional accounts: while the account is active. After you cancel, you have 30 days to export your data; then we delete it.
- Bookings: bookings older than 24 months are deleted automatically. The professional can delete them sooner.
- Billing records: for as long as tax and accounting laws require.
- Technical logs: for the short time needed for security, unless we need them to investigate abuse.
- Paused accounts (trial ended without a subscription): data is kept and the page shows bookings as closed. You can ask us to delete everything at any time.
What are your rights?
You can ask to access, correct or delete your data, restrict its use, receive a portable copy, and object to processing based on legitimate interest (Articles 15 to 21 GDPR). If you gave consent, you can withdraw it at any time. We answer within one month.
You can also complain to a data protection authority (Article 77 GDPR). The authority where we are established is the Spanish Data Protection Agency (AEPD).
A note for users in the United States
We do not sell or share personal information for cross-context behavioral advertising, as those terms are defined in California law, and we do not use targeted advertising. If a US state privacy law applies to you and gives you additional rights, write to us and we will honor them.
How do we protect data?
Encrypted connections (HTTPS), password-free sign-in with expiring email links, access limited to what is strictly needed, backups, and separation between each professional's data. If a personal data breach ever happens, we handle it as required by Articles 33 and 34 GDPR and we tell affected professionals right away.
What if the site shows an AI assistant?
If the site or dashboard shows a chat with an AI-based assistant, we say so clearly before you start typing, as required by Article 50 of the EU AI Act (Regulation 2024/1689). Messages are used only to answer you and are not used to train models. Please do not type personal data the chat does not need.
Is Kuseki for adults only?
Yes. You must be at least 18 and use Kuseki for your own business to open an account.
What if this policy changes?
We publish the updated version here with a new date. For important changes we email registered professionals before they take effect.
See also our Cookie policy, Terms of service and Legal notice.