Privacy Policy

Last updated: October 30, 2026

This policy explains what personal data Kyroba handles, why, who it is shared with, and your rights. Kyroba is operated by Darian Quero, based in New Jersey, United States. Contact: info@kyroba.app.

1. Who is responsible for your data

Kyroba is a platform used by local businesses (barbershops, salons and others; the "Businesses") to run their loyalty card, appointments, payments and forms. There are two situations:

• If you have a Business account (owner, barber or staff), or you visit our website, Kyroba decides how your data is used and is responsible for it.
• If you are a customer of a Business (you book an appointment, have its loyalty card, fill in its form, buy from its store), that Business decides how your data is used. Kyroba stores and processes it on the Business’s behalf, only to provide the service. To exercise your rights you can contact the Business or us; if you contact us, we will pass it to the Business.

2. What data we collect

• Contact data: name, phone number and, if you provide it, email.
• Business account data: email, password (stored encrypted by our sign-in provider), shop name and details, services, hours, team and settings.
• Service usage data: visits and stamps, rewards, appointments (service, time, notes), waitlist, walk-in line, store orders, packages, tips, ratings and comments.
• Birth month, if you choose to give it, for your birthday reward.
• Answers to a Business’s forms and your signature, which may include health information such as allergies (see the Health Data Policy).
• Payments: processed by Stripe. Kyroba does not see or store your full card number; we only keep details such as the brand, last 4 digits and payment status.
• If you agree to text messages: your phone number, the date of your consent and a log of messages sent.
• Minimal technical data: if a page fails, we keep the error, the page and the browser/device type (without your IP address) for 30 days to fix it. If you open a demo, we keep an encrypted fingerprint (hash) of your connection, not your IP address, to limit abuse.
• If you save your card to Google Wallet or Apple Wallet, or turn on browser notifications, we keep the technical identifiers needed to send you notifications.

We do not ask for or store Social Security numbers, driver’s licenses or full bank details.

3. How we use it

• To provide the service: your loyalty card, appointments and reminders, forms, store and payments.
• To contact you about the service: confirmations, reminders, password recovery and important notices.
• Security, fraud and abuse prevention, and fixing errors.
• To comply with the law and defend our rights.
• Internal, aggregated statistics to improve the service (Vercel Analytics, without cookies and without identifying you).

We do not sell your personal data, we do not share it for targeted advertising, and we do not perform automated profiling that produces legal effects on you.

4. Who we share it with

Only with the relevant Business and with providers that help us run the service, under contract and only for that purpose:

• Supabase (database and sign-in) and Vercel (website hosting and cookieless analytics).
• Stripe (payments and subscriptions) and, if the Business connects it, Square (sales records).
• Resend (email delivery) and Cloudflare (domain and email forwarding).
• Google (Google Wallet) and Apple (Apple Wallet), only if you save your card there.
• Twilio (text messages), only if you agreed to them and the Business has them turned on.
• DeepL (translation), only with form text written by the Business owner, never with customers’ answers.

We may also share data if the law requires it, to protect someone’s safety, or if the Kyroba business is sold or merged (we would notify you).

5. How long we keep it

• While the Business account is active or while it is needed to provide the service to you.
• If a Business deletes its account, its data and its customers’ data are deleted, except what we must keep by law (for example, payment records).
• Error logs: 30 days. Demos: deleted automatically after 24 to 48 hours.
• Backups are overwritten automatically within a short period.

6. Your rights

Depending on where you live (for example New Jersey, California and other states), you can ask to: know what data we have, get a copy, correct it, delete it, and opt out of its sale or use for targeted advertising (we do neither). Email info@kyroba.app. We will respond within 45 days; we may ask for information to confirm it is you. If we deny your request, you can appeal by replying to the same email and we will answer within 45 days; if you disagree, you can complain to your state Attorney General. We will not treat you differently for exercising your rights.

To stop text messages, reply STOP. To stop card notifications, remove the card from your Wallet or turn off its notifications.

7. "Do Not Track" and Global Privacy Control

Because we do not sell data or do targeted advertising, there is nothing to opt out of; even so, we honor the Global Privacy Control (GPC) signal and we do not use advertising or cross-site tracking cookies. More in the Cookie Policy.

8. Children

Kyroba is not directed to children under 13 and we do not knowingly collect their data. If a Business uses a form to serve a minor, it is filled in and signed by the parent or guardian. If you believe a child gave us data, email us and we will delete it.

9. Security

We use encrypted connections (HTTPS), per-account permissions so each Business only sees its own data, and providers with recognized security practices. No system is 100% secure; if a breach affects you, we will notify you as required by law.

10. Where data is stored

Our providers may store and process data in the United States and other countries, with the protections required by their contracts.

11. Changes

If we change this policy in a material way, we will announce it on the site or by email before it applies. The last-updated date is shown above.

12. Contact

Darian Quero · New Jersey, USA · info@kyroba.app