Get started
Get started

Privacy Policy

Last updated: 18 September 2026

This policy describes how personal data is processed when you use websites and services operated under the KERSIVO brand for UK barbershops, including marketing pages, live product preview booking and shop flows, monthly subscription checkout, and (where applicable) the barbershop admin experience. It is written in plain language and does not replace legal advice.

Note: The live public offer is a £39/month subscription with no setup fee. References below to a “setup deposit” describe a gated legacy checkout path that is not currently offered publicly; if that path is re-enabled, the same payment-related processing rules apply.

Who is responsible for your data?

The legal operator of the KERSIVO service is Bartosz Jasinski, trading as KERSIVO, based in Bournemouth, England, United Kingdom. References in this policy to “KERSIVO”, “we”, “us” and “our” mean Bartosz Jasinski trading as KERSIVO, unless the context refers specifically to a barbershop using the service.

KERSIVO is not the controller for every category of personal data processed through the platform. Roles depend on whose relationship with the data subject is involved.

When the barbershop is the controller

Where a live barbershop uses KERSIVO to run its own booking, client records, notes, retail pickup, staff roster or related operational tools, that barbershop determines the purposes and means of processing personal data about its customers, clients, barbers and team members. In those cases, the barbershop is the data controller, and KERSIVO processes that personal data on the barbershop’s behalf as a processor to provide the software service (for example hosting bookings, sending transactional confirmations or reminders, and storing client CRM records).

If you are a customer of a barbershop that uses KERSIVO, you should normally contact that barbershop first about your personal data. KERSIVO can assist the barbershop where appropriate.

When KERSIVO is an independent controller

KERSIVO remains an independent controller for personal data it processes for its own business purposes, including:

  • KERSIVO account-holder details and authentication / security records;
  • subscription and billing administration;
  • terms acceptance and related contract records;
  • support and contact enquiries sent directly to KERSIVO;
  • direct communications between KERSIVO and the business customer (the barbershop);
  • tax, accounting and legal records KERSIVO must keep;
  • consented analytics and advertising measurement on KERSIVO marketing pages;
  • fraud, security and abuse-prevention records; and
  • KERSIVO operational audit records.

For data protection enquiries about KERSIVO’s own controller processing, or to exercise rights relating to that data, contact: hello@kersivo.co.uk.

What data we process and why

Depending on how you interact with us, we may process:

  • Contact and setup enquiries — name, email address and message content you submit through our contact form. Purpose: responding to your request. Legal basis (UK): legitimate interests. (KERSIVO as independent controller.)
  • Setup deposits — name, email, shop details and payment status when you pay a KERSIVO setup deposit via Stripe Checkout on our account. Purpose: taking payment, confirming the deposit, sending onboarding information and internal fulfilment notices. Legal basis (UK): performance of a contract / steps prior to a contract. (KERSIVO as independent controller.)
  • Campaign attribution on checkout — if present in the page URL when you start checkout, we may pass advertising or campaign identifiers (for example gclid, gbraid, wbraid or UTM parameters) into Stripe session metadata and include a summary in internal fulfilment email. We do not store these identifiers in browser cookies or local storage before you choose optional advertising measurement in our cookie banner. Purpose: understanding which campaigns relate to setup purchases. Legal basis (UK): requires confirmation with our legal adviser (typically legitimate interests and/or consent for related storage technologies — see the Cookie Policy).
  • Booking data (live barbershop) — service, barber, date/time, and contact details (name and email; phone if provided). Processed so the barbershop can manage appointments, confirmations, reschedule and cancel links, and related emails. On a live tenant site the barbershop is the controller; KERSIVO processes this data as processor. Demo / sandbox booking flows on the marketing site are simulations or previews and are described separately where they apply.
  • Shop orders (buy-and-collect) — for a live barbershop shop: email address used at checkout, order contents, payment status as recorded after payment, and related confirmation emails to fulfil your purchase. Card payments are handled securely by Stripe on the barbershop’s own Stripe account; we do not store full card numbers on our servers. The barbershop is typically the controller of retail customer data; KERSIVO processes it as processor to run the shop software. The public retail demo on this marketing site is a simulation only and does not collect checkout personal data, take payment, or create an order. Private owner test orders in admin may create marked test records without payment.
  • Post-purchase setup — after a KERSIVO subscription purchase, information you submit in the authenticated KERSIVO client onboarding (for example business details, branding, team, services, opening hours, photos and migration notes) is processed to prepare your barbershop for launch. (KERSIVO as independent controller for the business-customer relationship; some fields may also relate to staff or migration content controlled by the barbershop once live.)
  • Admin access — first-party session cookies / tokens that keep you signed in to the barbershop admin panel (typically for up to 30 days), and operational logs needed for security. (KERSIVO as independent controller for account security.)
  • Content you upload — for example barber or product images where the product allows uploads. Stored so the site and shop can display them. Client-note images on a live shop are processed for the barbershop as controller.
  • Email delivery — we use Resend to send transactional emails (for example booking confirmations, order confirmations, setup deposit confirmations, and contact form delivery to our inbox), using the addresses involved in each message. Booking and retail customer emails for a live shop are sent as processor on the barbershop’s behalf; KERSIVO account and marketing emails are KERSIVO’s own controller processing.
  • Website analytics (optional) — if you accept analytics cookies on KERSIVO marketing pages, Google Analytics 4 may process pseudonymous usage data (for example pages viewed and approximate location derived by Google) to help us understand site performance. Live barbershop booking and storefront pages do not load KERSIVO marketing analytics tags. Legal basis (UK): consent. (KERSIVO as independent controller.)
  • Advertising measurement (optional) — if you accept advertising measurement on KERSIVO marketing pages, Google Ads measurement tags may process data needed to measure whether ads lead to enquiries or subscriptions. We do not use Google Ads Enhanced Conversions (we do not send hashed customer emails or phone numbers to Google). Legal basis (UK): consent.
  • Personalised advertising (optional) — asked for separately from measurement and off unless you switch it on. If you accept it, Google may add you to our remarketing audiences so we can show KERSIVO ads to people who have already visited the site. Withdrawing it stops future audience collection. Legal basis (UK): consent.
  • SMS (optional) — if you subscribe to a plan that includes SMS and we enable it for your shop, we may process mobile numbers and message content needed to send appointment reminders through a third-party SMS provider, only where that feature is enabled. For live-shop reminders the barbershop is the controller and KERSIVO acts as processor.

Recipients and providers

To provide the live barbershop service, KERSIVO uses infrastructure providers that may process Customer Personal Data as sub-processors (on KERSIVO’s behalf as processor for the barbershop), including:

  • Vercel — application hosting;
  • Neon / PostgreSQL — database hosting;
  • Resend — transactional email delivery;
  • Twilio — SMS delivery, only where SMS reminders are enabled for a shop.

Other providers are used in specific functional contexts and are not listed above as general sub-processors:

  • Stripe — payment processing for KERSIVO subscriptions on our platform account, and for live barbershop deposits/retail through the barbershop’s own Stripe Connect account at go-live (the barbershop remains seller of record for those shop payments). The public retail demo does not use Stripe Checkout. Card numbers are not stored on KERSIVO servers.
  • Google Analytics 4 / Google Ads — optional measurement on KERSIVO marketing pages only when you consent (see the Cookie Policy). These tags are not used on live barbershop booking or storefront pages.

We do not sell personal data. Where we engage providers to process Customer Personal Data on a barbershop’s behalf, we do so under appropriate arrangements required by UK data protection law.

International transfers

Data may be processed by providers outside the UK (for example in the United States). Where that happens, we rely on approved safeguard mechanisms required by UK data protection law (for example the UK International Data Transfer Agreement / Addendum or Standard Contractual Clauses), as offered by those providers. Details of each provider’s transfer mechanism should be confirmed in their current data processing terms.

How long we keep data

Retention depends on whose data it is and why it is held.

  • Live barbershop (Customer Personal Data). While a subscription is active, shop data is kept to run the service. After a subscription ends, the barbershop may export a free CSV of client contact details and booking history for up to 30 days. After that window, the live shop data graph is eligible to be permanently deleted from the production database. Cancellation does not delete shop data instantly. Residual copies may remain briefly in encrypted backups until those backups expire under our hosting provider’s normal backup cycle; we do not promise immediate erasure from every backup replica.
  • KERSIVO independent-controller records. Account, billing, tax, legal acceptance, security and operational audit records may be retained for as long as needed for those purposes, including where UK law requires longer retention of financial or legal records. That does not mean all personal data of every type is kept for six years.
  • Analytics and advertising cookies follow the durations in our Cookie Policy when you have consented.

Your rights (UK)

Under UK GDPR and the Data Protection Act 2018, you may have the right to:

  • request access to your personal data;
  • ask for inaccurate data to be corrected;
  • ask for data to be erased in certain circumstances;
  • restrict or object to processing in certain circumstances;
  • data portability where applicable;
  • withdraw consent where processing is based on consent.

If your request relates to a barbershop’s customers or bookings, contact that barbershop first (they are usually the controller). For KERSIVO account, billing or marketing data, email hello@kersivo.co.uk. You may also complain to the UK Information Commissioner’s Office (ICO): https://ico.org.uk/.

Cookies and similar technologies

We use necessary cookies and similar technologies to run the website (for example security, payments-related flows, forms, remembering your privacy choices, and keeping a barbershop admin signed in). With your permission on KERSIVO marketing pages, we also use analytics and advertising measurement technologies as described in our Cookie Policy.

Admin login uses necessary first-party session cookies so you can stay signed in while managing your shop. Full names, purposes and durations are listed in the Cookie Policy.

You can accept, reject or change optional technologies at any time using Cookie settings in the website footer, or by revisiting the cookie banner when your consent version is updated.

Security

We apply appropriate technical and organisational measures appropriate to the nature of the service, including access controls for admin areas and encrypted connections (HTTPS) for site traffic. No online service can be guaranteed 100% secure.

Changes to this policy

We may update this policy from time to time. The “Last updated” date will change when we do. We will notify active clients of any material changes via email. Material changes to cookie purposes may also require a new consent choice.