Kapper
Sign in

Privacy Policy

Last updated:

Who we are

This Privacy Policy is published by Anass El Moussaoui, an individual operator based in Spain who provides the Kapper service and acts as the data controller for the data described below. For any data-protection enquiry, contact contact@kapper.io.

What data we collect

  • Account data: first name, last name, email, phone, business name.
  • Billing data: processed by Stripe; we never store full card numbers.
  • Client data you upload: contact and appointment information for your barbershop's clients.
  • Usage data: technical logs, performance metrics, product usage events.
  • AI-submitted content: text and images sent through the AI features described in the Terms.

Why we collect it

To deliver the Service, send appointment reminders to your clients on your behalf, bill you via Stripe, improve the product, and meet legal obligations.

  • Contract performance (account and billing).
  • Legitimate interest (analytics, fraud prevention).
  • Consent (marketing emails, optional AI features).

Third parties we share data with

  • Stripe (Stripe Payments Europe Ltd.) — processes payment data for subscriptions. We never store full card numbers.
  • OpenAI (OpenAI, L.L.C.) — receives (a) text submitted to AI text features (support reply drafting, content suggestions, lead-deduplication) and (b) images you upload that are intended for public publication (logos, gallery photos, service images, cover photos), which are sent to OpenAI's Vision API for automated content moderation. We have opted out of these data being used for training OpenAI's models. We do not send client names, phone numbers, or appointment details to OpenAI.

No other third-party processors. The application is hosted on a private VPS in Spain. Plausible analytics is cookie-less, IP-anonymized, and runs behind a same-origin proxy.

Data retention

  • Account data: while the account is active + 30 days after a deletion request.
  • Appointment records: for the applicable Spanish accounting retention period (up to 5 years).
  • Audit logs: 1 year.

Your rights (GDPR)

You have the right to access your data, rectify it, delete it, port it, restrict processing, and object. Email contact@kapper.io to exercise these rights. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD).

International transfers

OpenAI may process data in the United States. The transfer is covered by the EU Commission's standard contractual clauses.

Cookies

We use only essential cookies (auth session, language preference). Plausible is cookie-less. We do not use advertising or third-party cookies.

Security

TLS in transit, encryption at rest, password hashing, refresh-token rotation, and routine updates. No system is perfectly secure; we will notify you without undue delay in case of an incident affecting your data.

Children

The Service is for professionals and businesses. It is not directed at children under 16.

Changes to this policy

We may update this policy. Material changes will be notified by email at least 14 days in advance.

Contact

For any privacy matter: contact@kapper.io.