Privacy Policy

Who we are

Kairo is run by Shamalka Kiridena, based in Melbourne, Australia. In this policy that's “we” and “us”. You can reach us at enquiries@kairobookings.com, which is the fastest way to get a person.

We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Two different relationships

This matters more than anything else here, so it comes first.

• Your information. If you are a salon or barbershop using Kairo, we hold your business's information and this policy covers how we treat it.
• Your clients' information. The names, contact details, appointment history and notes your business records about the people it serves. That belongs to your business. We hold it for you and on your instructions. We don't use it for our own purposes, we don't sell it, and we never market to your clients. The Data Processing Addendum sets that out in full.

If you're a client of a salon that uses Kairo and want to see, change or delete what's held about you, ask the salon. They control that record. We'll help them action it.

What we collect from you

• Business and contact details, and what we need to set up your booking page.
• Billing records — what you paid and when. Card details are handled by our payment provider; we don't store card numbers.
• What you send us when you ask for help.
• Sign-in times, IP address and browser information, kept for security and troubleshooting.

Health information in client notes

Kairo lets you record notes against a client or an appointment. In a salon those often include allergies, patch-test results and product reactions. Under the Privacy Act that's health information, and it gets stronger protection than ordinary personal information.

We don't read your client notes, except where you ask us to while helping you, or where the law requires it.

Kai, the in-app assistant

Kai is an optional assistant inside Kairo. It runs on Claude, an AI made by Anthropic. Each person is asked in the app before they first use it, and nothing goes to Anthropic until they turn it on.

• What's sent — what you type to Kai, and the records it looks up or changes to answer you, such as a client's name, appointments or notes. Passwords and connection keys are never sent.
• Where, and for what — Anthropic processes it in the United States, only to answer you, and doesn't use it to train its AI.
• What we keep — your Kai conversations are kept in your own Kairo database, like the rest of your records. You can delete them in the app.
• Turning it off — anyone can turn Kai off for themselves at any time, and an owner can switch it off for the whole business in Settings.

What we use information for

• Running, maintaining and supporting the service.
• Taking payment and keeping the financial records we're required to keep.
• Contacting you about your account, billing, security and changes.
• Investigating misuse and meeting legal obligations.
• Improving the software — using aggregated or de-identified information wherever that will do the job.

We don't sell personal information, and we don't use your client list to market anything to anyone.

Who else sees it

Only the providers we need to run the service, listed in Sub-processors, and only what each of them needs. We may also disclose information where the law, a court or someone's safety requires it.

Where it's held

Your data is held in Singapore, on servers run by Render — the closest region to Australia our host offers — and the backups stay there with it. Some of the other providers we use also process information overseas; the sub-processors table says which and where. Because this means information leaves Australia, we take reasonable steps to see it's handled consistently with the Australian Privacy Principles, and we stay accountable for it.

How long we keep it

• While you're a customer — for as long as you use Kairo.
• After you stop — we keep your data for 60 days so you can ask for an export, then delete it within a further 30 days. Ask us to delete it sooner and we will.
• Financial records — five years, as Australian tax law requires.
• Backups — deleted data can sit in a backup until that backup rotates out, which takes up to 90 days.

Security

The Security Overview has the detail. No system is perfectly secure and we don't claim otherwise.

If something goes wrong

If there's a breach likely to cause serious harm, we'll notify the Office of the Australian Information Commissioner and the people affected, as the Notifiable Data Breaches scheme requires. Where it concerns your clients' data we'll tell you as soon as practicable — normally within 72 hours of confirming it — so you can meet your own obligations, and we'll help you do it.

Access, correction and complaints

To see or correct what we hold about your business, email enquiries@kairobookings.com. We'll respond within 30 days. If you're unhappy with how we've handled your information, tell us first and we'll try to sort it out. If you're still unhappy you can complain to the OAIC at oaic.gov.au.

Changes

We may update this policy. If a change materially affects you we'll email you at least 14 days before it takes effect. The current version is always at kairobookings.com/legal/privacy.