Kapper

Privacy Policy

Last updated:

Who we are

This Privacy Policy is published by Anass El Moussaoui, an individual operator based in Spain who provides the Kapper service and acts as the data controller for the data described below. For any data-protection enquiry, contact contact@kapper.io.

What data we collect

  • Account data: first name, last name, email, phone, business name.
  • Billing data: processed by Stripe (web), Apple (App Store) or Google (Google Play), depending on where you subscribe; we never receive or store full card numbers.
  • Client data you upload: contact and appointment information for your barbershop's clients.
  • Usage data: technical logs, performance metrics, product usage events.
  • AI-submitted content: text and images sent through the AI features described in the Terms.

Why we collect it

To deliver the Service, send appointment reminders to your clients on your behalf, bill your subscription, improve the product, and meet legal obligations.

  • Contract performance (account and billing).
  • Legitimate interest (analytics, fraud prevention).
  • Consent (marketing emails, optional AI features).

Third parties we share data with

  • Stripe (Stripe Payments Europe Ltd.) — processes payment data for web subscriptions. We never store full card numbers.
  • Apple (App Store, Sign in with Apple) — bills and renews subscriptions bought in the iOS app, and authenticates you if you sign in with Apple.
  • Google (Google Play, Google Sign-In, Firebase) — bills and renews subscriptions bought in the Android app; authenticates you if you sign in with Google; delivers push notifications (Firebase Cloud Messaging); and receives crash reports from the apps (Firebase Crashlytics: device model, OS version, app version and the error trace — no client data).
  • RevenueCat (RevenueCat, Inc.) — keeps track of App Store and Google Play subscription status. It receives your account identifier and the store's purchase records, not your client data.
  • Mapbox (Mapbox, Inc.) — draws the map in the Kapper client app. When the map is open it receives the approximate area being viewed and technical usage data.
  • Resend — sends our transactional emails (verification, booking confirmations, receipts).
  • Twilio — sends WhatsApp/SMS appointment messages to your clients when you enable that feature.
  • Meta (Instagram/Facebook) — only if you connect your Instagram or Facebook account to show it on your booking page.
  • Cloudflare (Turnstile) — protects public forms against bots; processes technical browser signals.
  • OpenAI (OpenAI, L.L.C.) — receives (a) text submitted to AI text features (support reply drafting, content suggestions, lead-deduplication) and (b) images you upload that are intended for public publication (logos, gallery photos, service images, cover photos), which are sent to OpenAI's Vision API for automated content moderation. We have opted out of these data being used for training OpenAI's models. We do not send client names, phone numbers, or appointment details to OpenAI.

The application is hosted on a private VPS in Spain. Plausible analytics is cookie-less, IP-anonymized, and runs behind a same-origin proxy.

Data retention

  • Account data: while the account is active + 30 days after a deletion request.
  • Appointment records: for the applicable Spanish accounting retention period (up to 5 years).
  • Audit logs: 1 year.

Your rights (GDPR)

You have the right to access your data, rectify it, delete it, port it, restrict processing, and object. Email contact@kapper.io to exercise these rights. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD).

International transfers

Some of the providers above (including OpenAI, Apple, Google, RevenueCat, Mapbox, Twilio, Resend and Cloudflare) may process data in the United States. These transfers are covered by the EU–US Data Privacy Framework where the provider is certified, or by the European Commission's standard contractual clauses.

Cookies

We use only essential cookies (auth session, language preference). Plausible is cookie-less. We do not use advertising or third-party cookies.

Security

TLS in transit, encryption at rest, password hashing, refresh-token rotation, and routine updates. No system is perfectly secure; we will notify you without undue delay in case of an incident affecting your data.

Children

The Service is for professionals and businesses. It is not directed at children under 16.

Changes to this policy

We may update this policy. Material changes will be notified by email at least 14 days in advance.

Contact

For any privacy matter: contact@kapper.io.