Privacy Policy

Kunuus is provided by Kunuus UG (haftungsbeschränkt), incorporated in Germany (Forsthausstr. 20, 61352 Bad Homburg, Germany). Our role depends on whose data it is:

• Businesses using Kunuus (owners and staff, and visitors to kunuus.com): we are the controller of your data.
• Customers of those businesses (for example people who book through a salon's Kunuus page): the business you're booking with is the controller of your data, and we process it on their behalf. For questions about how the business uses your information, contact them directly - we'll help them respond.

If you book with a business: your name, email, phone number if you give it, the service, time and person you book, any note or documents you add, whether you confirmed, rescheduled, cancelled or attended, waiting-list requests, the messages sent to you, and where your booking came from (for example the business's website or a QR code). Notes can contain health information if you choose to include it - please only share what the business needs for your appointment. Documents you attach are stored privately; only the business (and team members who can see your appointment) can open them, and uploads you didn't book with are deleted after a day. For an online meeting with a business that has connected Google Calendar, your email address is added to the business's calendar event so Google can send you the invitation with the meeting link. You can also book with only your mobile number and get your confirmation and reminders on WhatsApp instead of email.

If you run a business on Kunuus: your login email, your business details (name, address, country, contact details, services, team members' names and roles, opening hours, rules), your website address and information Kunuus reads from it during setup, connected calendar details, subscription and billing status (payments themselves are handled by Stripe), and activity in your account.

Technical data: basic logs (such as IP address, browser and time of request) needed to run and secure the service. Our hosting provider may use your IP address to show the right prices for your country.

• To make, confirm, change and cancel bookings, and to check real availability.
• To send the messages the business has turned on: confirmations, reminders and attendance checks, waiting-list offers, one follow-up if you started booking but didn't finish, and one invitation to leave a review after an attended visit.
• To show the business its bookings, alerts and results, and to sync with its calendar.
• To set up and bill business accounts, provide support, and keep the service secure.
• To comply with the law.

Under the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG), we rely on: performing a contract (running your account, or the booking you asked for); legitimate interests (keeping the service secure and improving it); legal obligations; and consent where it's required. For customer data we process on a business's behalf, the business determines the legal basis, including for any health information.

We don't sell personal data. We share it only with:

• The business you booked with (for customers), or your own team (for businesses).
• Service providers ("sub-processors") that help us run Kunuus, under contracts that require them to protect it:
  • Lovable and its hosting providers (including Cloudflare) - Hosting and running the Kunuus website and app
  • Supabase - Database and owner sign-in
  • SendGrid (Twilio) - Sending confirmation, reminder and other emails
  • Stripe - Subscription payments (businesses only)
  • WATI - Sending WhatsApp messages to customers who opt in, and alerts to business owners
  • Google - Google Calendar and Google Business Profile, when a business connects them
  • Lovable AI gateway and Google (Gemini models) - AI features for businesses: setup, website text, translations and the owner assistant
• Authorities, where the law requires it.

AI features send data to our AI provider: during setup and when drafting website text, the business's public website text and what the owner writes; when translating a page, the business's texts (services, descriptions, website text); in the owner assistant, the owner's questions and the business data needed to answer them, such as appointments and customers' names. The booking chat customers use is an automated assistant that follows set rules; it doesn't send conversations to an AI provider. We don't use customers' data to train AI models.

Our providers may store or process data outside the country where you are, including in the United States and the European Union. Where the law requires it, we rely on appropriate safeguards for these transfers, such as standard contractual clauses.

We keep business account data while the account is active and for a short period afterwards to allow export, then delete it, except records we must keep by law (for example invoices). Customer booking data is kept for as long as the business keeps its account, unless the business deletes it sooner or asks us to. Technical logs are kept for a limited period for security.

Data is encrypted in transit. Access is restricted so that each business can only reach its own data, and customers manage their bookings through private links sent only to them. No system is perfectly secure; if a breach affects your data, we'll notify the business and authorities as the law requires.

Depending on where you live, you may have the right to access, correct, delete or export your data, to object to or restrict some processing, to withdraw consent, and to complain to a data protection authority - where you live, or the one responsible for us: the Hessian Commissioner for Data Protection and Freedom of Information (HBDI). Customers should contact the business they booked with first; we'll support the business in responding. Businesses can contact us using the contact details on our website.

We use only what's needed to run Kunuus: your browser stores the sign-in session for business owners, your chosen language and the progress of an unfinished setup conversation. We don't use advertising cookies or third-party trackers.

Business accounts are for adults. Where a parent or guardian books for a child, the business is responsible for handling that information appropriately.

We'll update this policy when our practices change and show the date at the top. Significant changes will be notified to businesses by email or in the app. Questions can be sent to us using the contact details on our website. See also our Terms of Service.