Privacy Policy

This Privacy Policy applies to all personal data processed by Kayo across its services, including:

• kayo.ae — the main Kayo website and business enquiry form, used by prospective clients enquiring about Kayo's digital presence services
• Kayo Booking — the appointment booking platform used by salons and their customers to schedule, manage, and pay for appointments
• Kayo Dashboard — the business management portal used by salon owners and staff to operate their Kayo Booking account

By using any of the above services or submitting personal data through them, you acknowledge the practices described in this policy. This policy is subject to change; material updates will be reflected by a revised “Last updated” date above.

Kayo is a technology and digital services company operating in the Middle East. We provide digital presence, website, and booking management services to SMEs, primarily in the UAE. For the purposes of applicable data protection law, Kayo acts as the data controller in respect of personal data collected through kayo.ae, and as a data processor on behalf of salons using the Kayo Booking platform.

For privacy-related enquiries, contact us at support@kayo.ae.

The data we collect depends on how you interact with our services. We collect only what is necessary for the purpose described.

Business enquiries (kayo.ae join form)

When you submit a business enquiry, we may collect:

• Business name and your name
• Phone number and, optionally, email address
• Plan interest, current website URL, Google Maps link, and preferred contact time (all optional)
• Any additional notes you choose to provide

Booking guests (Kayo Booking)

When you book an appointment through a salon using Kayo Booking, we collect:

• Name, phone number, and email address
• Selected services, preferred staff member, and appointment date and time
• Any notes provided to the salon at the time of booking
• Payment confirmation data (transaction reference, card brand, last four digits) processed through Stripe — we do not store full card numbers or CVV codes

Salon dashboard users

When a salon owner or staff member creates a Kayo dashboard account, we collect:

• Name and business email address
• Account authentication credentials (passwords are hashed; Kayo staff cannot view them)

Technical data (all users)

We collect standard server and application logs including IP addresses, browser type, device information, and pages accessed. This data is used for security monitoring, fraud prevention, and service stability, and is not linked to personal enquiry or booking records.

We use the personal data we collect for the following purposes:

• To respond to business enquiries and provide information about Kayo's services
• To facilitate the booking of appointments and process associated payments
• To enable salons to manage their appointments, customer records, and business operations through the Kayo Dashboard
• To maintain booking history for the benefit of salons and their ongoing client relationships
• To send service-related communications, such as booking confirmations and reminders, where applicable
• To fulfil legal and contractual obligations, including tax record-keeping
• To detect and prevent fraud, abuse, and security incidents
• To improve and maintain the reliability of our services

We do not use personal data for advertising, automated profiling, or the sale or sharing of data with third parties for their own commercial purposes.

We rely on the following lawful bases under applicable data protection law, including the GDPR and UAE Federal Decree-Law No. 45 of 2021 (PDPL):

• Performance of a contract — processing necessary to fulfil a booking, deliver a service, or operate a dashboard account you have entered into
• Legitimate interests — processing necessary for the legitimate operational interests of Kayo and the salons we serve, including maintaining service records, supporting client history, and ensuring platform security, where those interests are not overridden by your rights
• Legal obligation — processing required to comply with applicable law, including financial record-keeping obligations
• Consent — where you have provided explicit consent for a specific processing activity; you may withdraw consent at any time without affecting the lawfulness of prior processing

We retain personal data for as long as is reasonably necessary for the purposes for which it was collected, taking into account the legitimate operational needs of our business and the salons we serve, as well as applicable legal requirements.

In particular:

• Booking records (name, contact details, appointment history) are retained for as long as necessary to support the salon's ongoing service relationship with its clients, including the ability to access historical booking records for returning customers. Salons may request deletion of specific records at any time.
• Payment and financial records are retained for the period required by applicable tax and commercial law in the UAE, which is generally a minimum of five years from the date of the transaction.
• Business enquiry data is retained for as long as is relevant to our business relationship or prospective relationship with you.
• Technical and server logs are retained for a limited period necessary for security monitoring and operational purposes.

You may request deletion of your personal data at any time (see Your rights below). Deletion requests are honoured subject to any overriding legal retention obligations.

We do not sell, rent, or otherwise transfer personal data to third parties for their own commercial purposes. We may disclose personal data to:

• Salon operators — booking guest data is made available to the salon through which the appointment was booked, for the purpose of managing that appointment. The salon acts as an independent data controller in respect of its relationship with its customers.
• Infrastructure sub-processors — third-party technology providers used to operate our services, including Supabase (database and authentication), Vercel (hosting and content delivery), and Stripe (payment processing). Each is engaged under a data processing agreement and is permitted to process personal data only as directed by Kayo.
• Legal and regulatory authorities — where disclosure is required by law, court order, or regulatory obligation.

Where personal data is transferred outside the UAE or the EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses where required under GDPR.

Subject to applicable law, you may have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — request correction of inaccurate or incomplete data
• Erasure — request deletion of your data, subject to any overriding legal retention obligations
• Restriction — request that we limit processing of your data in certain circumstances
• Portability — receive your data in a structured, machine-readable format where technically feasible
• Objection — object to processing carried out on the basis of legitimate interests
• Withdrawal of consent — where processing is based on consent, withdraw it at any time without affecting prior processing

To exercise any of these rights, submit your request in writing to support@kayo.ae with sufficient information to identify you. We will respond within the timeframe required by applicable law (generally 30 days, extendable in complex cases).

You also have the right to lodge a complaint with a relevant supervisory authority if you believe your data has been processed unlawfully.

Kayo implements appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These include encryption of data in transit and at rest, access controls, authentication requirements for staff, and regular review of our security posture.

Payment card data is processed exclusively by Stripe, a PCI DSS Level 1 certified provider. Kayo does not store, transmit, or have access to full card numbers or security codes at any point.

No system is entirely immune to risk. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify affected individuals and, where required, the relevant supervisory authority, in accordance with our legal obligations.

We may update this Privacy Policy from time to time to reflect changes to our practices, services, or applicable law. The “Last updated” date at the top of this page will reflect any revisions. Continued use of our services following a material update constitutes acceptance of the revised policy.

For questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact us at support@kayo.ae.

For technical security and compliance details, see our Security & Compliance page.