See live demo Get my free preview
Free preview

Privacy Policy

Last updated: 31 October 2026

This policy describes how personal data is processed when you use websites and services operated under the KERSIVO brand for UK barbershops, including marketing pages, KERSIVO Starter activation, Full KERSIVO subscription checkout, live booking and shop flows, the barbershop admin experience, QR Kit fulfilment and related service operations. It is written in plain language and does not replace legal advice.

Note: The live public offer includes KERSIVO Starter at £0/month and Full KERSIVO at £39/month per physical location. Starter does not create a KERSIVO SaaS subscription charge. Full subscription billing uses Stripe Checkout on KERSIVO’s own Stripe account. There is no current public setup-fee offer. Legacy setup-deposit checkout creation is disabled; any historical setup-deposit records may still be supported for fulfilment and customer support.

Who is responsible for your data?

The legal operator of the KERSIVO service is Bartosz Jasinski, trading as KERSIVO, based in Bournemouth, England, United Kingdom. References in this policy to “KERSIVO”, “we”, “us” and “our” mean Bartosz Jasinski trading as KERSIVO, unless the context refers specifically to a barbershop using the service.

KERSIVO is not the controller for every category of personal data processed through the platform. Roles depend on whose relationship with the data subject is involved.

When the barbershop is the controller

Where a live barbershop uses KERSIVO to run its own booking, client records, notes, retail pickup, staff roster or related operational tools, that barbershop determines the purposes and means of processing personal data about its customers, clients, barbers and team members. In those cases, the barbershop is the data controller, and KERSIVO processes that personal data on the barbershop’s behalf as a processor to provide the software service (for example hosting bookings, sending transactional confirmations or reminders, and storing client CRM records).

If you are a customer of a barbershop that uses KERSIVO, you should normally contact that barbershop first about your personal data. KERSIVO can assist the barbershop where appropriate. The contractual terms for KERSIVO’s processor role with business Clients are set out in the Data Processing Agreement.

When KERSIVO is an independent controller

KERSIVO remains an independent controller for personal data it processes for its own business purposes, including:

  • KERSIVO account-holder details and authentication / security records;
  • plan activation, subscription and billing administration;
  • terms acceptance and related contract records;
  • support and contact enquiries sent directly to KERSIVO;
  • direct communications between KERSIVO and the business customer (the barbershop);
  • B2B prospecting and business outreach to relevant UK barbershop contacts;
  • tax, accounting and legal records KERSIVO must keep;
  • consented analytics on KERSIVO marketing pages;
  • fraud, security and abuse-prevention records; and
  • KERSIVO operational audit records.

For data protection enquiries about KERSIVO’s own controller processing, or to exercise rights relating to that data, contact: hello@kersivo.co.uk.

What data we process and why

Depending on how you interact with us, we may process:

  • Contact and setup enquiries — name, email address and message content you submit through our contact form. Purpose: responding to your request. Legal basis (UK): legitimate interests. (KERSIVO as independent controller.)
  • KERSIVO plan activation and Full subscription billing — Starter is activated at £0/month without a KERSIVO SaaS subscription charge. When you purchase Full KERSIVO at £39/month per physical location via Stripe Checkout on KERSIVO’s platform Stripe account, we process business-customer billing details such as name, email, shop/business details needed for fulfilment, payment status, amount/currency, and Stripe-generated customer, subscription, Checkout session and related payment identifiers. We also retain Terms acceptance and service-plan lifecycle records for Starter / Full activation, downgrade and departure. Stripe hosts card entry; KERSIVO does not receive or store full card numbers or CVC. Purpose: activating and administering the service, taking Full subscription payments, confirming payment, onboarding and related fulfilment notices. Legal basis (UK): performance of a contract / steps prior to a contract where you are personally the contracting party; legitimate interests where we process administrative details of representatives of a corporate customer. Specific accounting or tax records may also be processed where a UK legal obligation requires them. (KERSIVO as independent controller for this business-customer relationship.)
  • Free website preview requests — your name (if given), email address, shop name, town or city, the links you send us, details about your shop, your notes and any changes you ask for, plus the details, text and images we take from those links to build your preview, and whether and when you opened it. Files you add in your private shop hub (logo, photos, price lists) are used only to build your preview and website, and are deleted with your preview if you don't launch. Messages you send in your private shop hub are used only to talk about your preview, and are deleted with your preview if you don't launch. Purpose: creating your private preview, sending it to you, up to two reminder emails about it (each has a link to stop them), and acting on your response. Legal basis (UK): steps taken at your request before entering into a contract; legitimate interests where you act for a corporate business. If you tick the optional box for product news and tips, the legal basis for those emails is consent, which you can withdraw at any time. (KERSIVO as independent controller.)
  • B2B prospecting and business outreach — KERSIVO may identify relevant UK barbershop business prospects from public business sources. Personal data may include a business contact name or role, public business contact information, public social handles, and business-related research or outreach history. Sources may include business websites, public social profiles, Companies House where relevant, and other public business sources. Purpose: relevant B2B prospecting, direct outreach and administration (including follow-ups, replies and do-not-contact / suppression records). Legal basis (UK): legitimate interests where applicable, and only where separate PECR rules for electronic marketing are satisfied. Legitimate interests is not treated as permission to message individual subscribers (for example many sole traders) where PECR requires consent. Tools used for this work include Notion for lead administration, Google/Gmail for email, and Meta/Instagram where direct messaging is used — without claiming unverified processor contracts or transfer conclusions for those tools. Retention follows prospect and suppression rules (personal contact research not yet contacted is either notified within 30 days or personal contact fields are removed; unsuccessful personal outreach history is generally removed or anonymised after about six months; minimal suppression data may be kept longer solely to honour an objection). You have an absolute right to object to use of your personal data for direct marketing. Object by replying to the message or emailing hello@kersivo.co.uk. (KERSIVO as independent controller.)
  • Historical setup deposits (not currently offered) — where a legacy setup-deposit Checkout session was created historically, name, email, shop details and payment status may still be held for fulfilment and support. New setup-deposit Checkout creation is disabled. (KERSIVO as independent controller for those historical billing records.)
  • Campaign / source information — campaign or source parameters (for example gclid, gbraid, wbraid or UTM values) may appear in the page URL. Where you grant Analytics consent, consent-based website analytics (GA4) may process relevant campaign/source information as part of ordinary analytics measurement (see Website analytics below). KERSIVO does not separately persist those checkout campaign identifiers into Stripe Checkout metadata or internal fulfilment email. There is no dedicated KERSIVO attribution cookie or localStorage. Google Ads website tags remain inactive on Production.
  • Optional Sign in with Google — where offered (for example “Continue with Google”), you may sign in or create a KERSIVO business/admin account using your Google Account. Google provides identity information needed for that login, which may include a Google account identifier, email address, email verification status, name, and profile picture URL. Purpose: authenticating you, creating and maintaining your KERSIVO business/admin account, account linking where applicable, and onboarding / account display. This is not used for end-customer booking login. Legal basis (UK): performance of a contract where you are personally the contracting party and Google Sign-In is necessary to provide the account access you requested; legitimate interests where you are staff, a manager or a representative of a corporate customer using Google Sign-In for authorised business access. KERSIVO does not request access to Gmail, Google Drive, Calendar, Contacts or other Google account content through this login. Under the current implementation, KERSIVO does not durably retain Google OAuth access tokens, refresh tokens or ID tokens after authentication. Google separately processes your Google Account information under Google’s Privacy Policy. (KERSIVO as independent controller for this account/authentication data.)
  • Booking and client data (live barbershop) — service, barber, date/time, booking status and contact details (name, email and phone where provided). KERSIVO Starter uses this data for the booking diary and Clients Core, including recent operational context; Full KERSIVO may make additional advanced client-management fields available. Processed so the barbershop can manage appointments, confirmations, reminders, reschedule/cancel flows and authorised client records. On a live tenant site the barbershop is the controller; KERSIVO processes this data as processor. Demo / sandbox booking flows on the marketing site are simulations or previews and are described separately where they apply.
  • Shop orders (buy-and-collect) — a Full KERSIVO feature for a live barbershop shop: email address used at checkout, order contents, payment status as recorded after payment, and related confirmation emails to fulfil your purchase. Card payments are handled securely by Stripe on the barbershop’s connected Stripe account using direct charges. New public connected-account onboarding uses Stripe Standard; historical Express connections may remain supported where already established. The barbershop remains the seller and controller for that customer payment; KERSIVO facilitates the technical checkout flow and adds 0% KERSIVO application / platform fee (Stripe’s own processing fees are separate). KERSIVO does not store full card numbers or CVC. The barbershop is typically the controller of retail customer data; KERSIVO processes related shop records as processor to run the shop software. The public retail demo on this marketing site is a simulation only and does not collect checkout personal data, take payment, or create an order. Private owner test orders in admin may create marked test records without payment.
  • Booking card payments (live barbershop) — KERSIVO Starter is payment-powered: before new customer-created public Starter bookings can go live, the shop must have a payment-ready Stripe Connect Standard account. For a Starter service priced above £5, the customer chooses a £5 deposit or Pay in full; a £5 service is paid in full. Public Pay at shop is not available on Starter, although staff-created manual bookings may still be recorded as Pay at shop. Full KERSIVO may use owner-controlled Pay at shop, £5-deposit or full-payment modes. Online booking payments are taken through the barbershop’s connected Stripe account under the direct-charge Connect model (barbershop seller/controller; KERSIVO facilitator; 0% KERSIVO application / platform fee). Stripe processing fees are separate. KERSIVO may store limited payment, refund and connected-account identifiers/statuses needed to operate the booking software, not full card details. KERSIVO may separately receive compensation or revenue share from Stripe under Stripe’s partner arrangements if it qualifies; that Stripe-paid compensation is not a fee deducted by KERSIVO from the barbershop’s booking payment.
  • KERSIVO setup and onboarding — information you submit in the authenticated KERSIVO onboarding (for example business details, branding, team, services, opening hours, photos and migration notes) is processed to configure Starter or prepare Full KERSIVO delivery. (KERSIVO as independent controller for the business-customer relationship; some fields may also relate to staff or migration content controlled by the barbershop once live.)
  • QR Kit fulfilment — where an eligible UK location on Starter or Full requests the included initial QR Kit, KERSIVO processes the responsible contact name, email, phone, delivery/address details, postcode, verification/fulfilment status and, where used, supplier, carrier or tracking references needed to verify, print and dispatch the kit. Internal print/postage unit-cost data is operational business data and is not exposed as customer-facing personal data. Purpose: service fulfilment, fraud/eligibility checks and support. Legal basis (UK): performance of contract / legitimate interests as appropriate to the business-customer relationship.
  • Google booking-link setup — KERSIVO stores the current KERSIVO booking URL and local setup/confirmation status so the barbershop can add or update that URL in its own Google Business Profile. KERSIVO does not use this guided flow to access or edit the Client’s Google Business Profile and does not claim that Google changed the link remotely. Google independently processes data when the Client uses Google services.
  • Full live booking-destination verification — where Full KERSIVO is delivered on the Client’s own domain, authorised KERSIVO operations users may record the exact verified live booking URL, verification timestamps/method, site version and audit identity of the operator who confirmed it. This is used to route the Client’s QR codes and show the correct booking URL for Google setup.
  • Admin access — first-party session cookies / tokens that keep you signed in to the barbershop admin panel (typically for up to 30 days), and operational logs needed for security. (KERSIVO as independent controller for account security.)
  • Content you upload — for example barber or product images where the product allows uploads. Stored so the site and shop can display them. Client-note images on a live shop are processed for the barbershop as controller.
  • Email delivery — we use Resend to send transactional emails (for example booking confirmations, order confirmations, subscription fulfilment notices, and contact form delivery to our inbox), using the addresses involved in each message. Booking and retail customer emails for a live shop are sent as processor on the barbershop’s behalf; KERSIVO account and marketing emails are KERSIVO’s own controller processing.
  • Website analytics (optional) — if you accept Analytics cookies on KERSIVO marketing pages, Google Analytics 4 may process pseudonymous usage data (for example pages viewed and approximate location derived by Google) to help us understand site performance. Live barbershop booking and storefront pages do not load KERSIVO marketing analytics tags. Private preview pages do not load them either; if you have accepted Analytics cookies, our server may tell Google Analytics about preview milestones (for example that a preview was viewed or launched) using the same pseudonymous identifier, without your name, email address or shop details. Legal basis (UK): consent. For the current configuration (Google “Google products & services” data sharing off), Google acts as a processor for Analytics-service data processed to provide the Analytics service; KERSIVO remains the controller for deciding to use GA4 on the marketing site. The standard Google Analytics contractual provider is Google Ireland Limited. Transfers to Ireland are covered by UK adequacy regulations. Google may process data internationally and use subprocessors; for applicable onward transfers to the United States, Google documents use of the UK Extension to the EU-U.S. Data Privacy Framework where coverage applies, and otherwise relies on the transfer mechanisms in its data processing terms (including applicable Standard Contractual Clauses).
  • Google Ads (currently inactive) — Production does not currently configure Google Ads measurement IDs, conversion labels, or remarketing tags. Cookie settings do not currently offer Advertising measurement or Personalised advertising choices. We do not use Google Ads Enhanced Conversions. This does not claim that any historical Google-held Ads records were erased from Google’s systems.
  • SMS (optional) — if you subscribe to a plan that includes SMS and we enable it for your shop, we may process mobile numbers and message content needed to send appointment reminders through a third-party SMS provider, only where that feature is enabled. For live-shop reminders the barbershop is the controller and KERSIVO acts as processor.

Recipients and providers

To provide the live barbershop service, KERSIVO uses infrastructure providers that may process Customer Personal Data as sub-processors (on KERSIVO’s behalf as processor for the barbershop), including:

  • Vercel — application hosting;
  • Neon / PostgreSQL — database hosting;
  • Resend — transactional email delivery;
  • Twilio — SMS delivery, only where SMS reminders are enabled for a shop;
  • Sentry — application error monitoring, only where monitoring is configured;
  • OpenAI — language-model processing for the optional admin AI assistant, only where the assistant is enabled. Free-text prompts submitted by authorised Client users may contain Customer Personal Data and are processed to generate responses. KERSIVO does not automatically export Client tenant databases to OpenAI.

Other providers are used in specific functional contexts and are not listed above as general sub-processors:

  • Stripe — payment services for (a) Full KERSIVO £39/month per-location subscription billing on KERSIVO’s platform Stripe account, and (b) live barbershop booking card payments and Full retail payments through the barbershop’s connected Stripe account using direct charges. New public connected-account onboarding uses Stripe Standard. Starter public booking launch requires a payment-ready Standard account; a historical Express account may remain supported for Full KERSIVO and historical payment/refund continuity where already established, but does not satisfy the Starter public-launch requirement. Merchants collect customer payments directly and KERSIVO adds 0% application / platform fee to new Starter and Full booking payments. Stripe processes card payments; KERSIVO does not store full card numbers or CVC. Stripe may pay KERSIVO separate partner compensation / revenue share if KERSIVO qualifies; that is not a fee deducted by KERSIVO from the barbershop’s booking payment. Under Stripe’s terms, Stripe may process personal data both as a processor for User-directed payment services and as an independent controller for fraud prevention, regulatory, compliance and other Stripe purposes. Stripe is therefore not listed above as a general KERSIVO Customer Personal Data sub-processor merely because Connect payments are facilitated. The public retail demo does not use Stripe Checkout.
  • Google Sign-In — optional identity / authentication for KERSIVO business/admin accounts (see “Optional Sign in with Google” above). This is separate from Google Analytics / Ads.
  • Google Analytics 4 — optional Analytics measurement on KERSIVO marketing pages only when you consent (see the Cookie Policy). ACTIVE / consent-based. These tags are not used on live barbershop booking or storefront pages. Separate from Google Sign-In. Google products & services data sharing is off for the current Analytics account configuration. Direct contractual provider: Google Ireland Limited (adequacy-covered UK→Ireland path; Google may process internationally under its processing terms as described under “Website analytics” above).
  • Google Ads — INACTIVE / DORMANT on Production (no Ads measurement ID / purchase conversion label configured; no active Ads consent choice in Cookie settings). Historical use may exist in older Google account records; those are not claimed erased here. Separate from Google Sign-In and from GA4.

We do not sell personal data. Where we engage providers to process Customer Personal Data on a barbershop’s behalf, we do so under appropriate arrangements required by UK data protection law.

International transfers

Data may be processed by providers outside the UK (for example in the United States). Where that happens, we rely on approved safeguard mechanisms required by UK data protection law (for example the UK International Data Transfer Agreement / Addendum or Standard Contractual Clauses), as offered by those providers. Details of each provider’s transfer mechanism should be confirmed in their current data processing terms.

How long we keep data

Retention depends on whose data it is and why it is held. Personal data should not be kept longer than needed for its purpose. Different categories can have different, purpose-specific periods.

  • Free website preview requests. If you do not subscribe, we delete your preview and the information you provided for it within 90 days of the preview expiring (or of us declining the request, if no preview was sent). We keep only an anonymised record of the request's status and dates, which cannot be linked back to you or your shop, to count how the service is used. Terms acceptance evidence from a checkout you started may be kept as described below. If you subscribe, the preview becomes your live site and its details become part of your account records.
  • Live barbershop (Customer Personal Data). While the KERSIVO service for a shop is active — whether on Starter or Full — shop customer and booking data is kept to run the service under the barbershop’s instructions. KERSIVO does not independently apply a blanket deletion period to active shop customer/booking records. Moving from Full KERSIVO to KERSIVO Starter does not start the post-service retention window because the KERSIVO service continues. When the shop leaves KERSIVO completely, new public booking intake stops and existing future accepted appointments are preserved for safe wind-down rather than silently deleted. Once the service has ended and operational blockers are resolved, the barbershop has the standard 30-day post-termination export / retention window before the live shop data graph becomes eligible for permanent purge from the production database. Departure does not delete shop data instantly. Where the barbershop is the controller, authorised barbershop admins can also instruct KERSIVO to erase an individual customer’s profile and related customer-controlled data (for example notes). Historical booking or payment records may remain in anonymised or minimised form where retention is still needed for operational, payment, accounting, legal or dispute purposes. Active or unresolved appointments, payments or in-flight messages may temporarily prevent erasure until resolved. Residual copies may remain temporarily in encrypted backups or other provider systems until those copies expire or are deleted under the provider’s normal lifecycle; we do not promise immediate physical erasure from every backup or provider replica.
  • KERSIVO independent-controller records. Account, billing, tax, legal acceptance, security and operational audit records may be retained for separate, purpose-specific periods needed for those purposes (for example limited billing and legal-acceptance evidence may be kept for up to six years after the end of the relevant commercial relationship, unless a live dispute or legal obligation requires longer). That does not mean all personal data of every type is kept for six years, and it is not a claim that UK GDPR itself imposes a single six-year retention rule for everything. Ending Full KERSIVO or leaving KERSIVO does not necessarily delete Stripe-held financial/payment records immediately; Stripe’s own retention of payment data is controlled by Stripe. KERSIVO shop-departure / account-deletion workflows do not imply deletion of every provider-side Stripe Customer, Subscription or connected-account record. Local deletion likewise does not guarantee immediate erasure of every residual copy held by other providers (for example email, SMS, monitoring, hosting or AI providers where used).
  • Analytics and advertising cookies follow the durations in our Cookie Policy when you have consented.

Your rights (UK)

Under UK GDPR and the Data Protection Act 2018, you may have the right to:

  • request access to your personal data;
  • ask for inaccurate data to be corrected;
  • ask for data to be erased in certain circumstances (this right is not absolute and may be limited where retention is still needed for a legal obligation or to establish, exercise or defend legal claims);
  • restrict or object to processing in certain circumstances;
  • object to processing of your personal data for direct marketing (this right is absolute);
  • data portability where applicable;
  • withdraw consent where processing is based on consent.

If your request relates to a barbershop’s customers or bookings, contact that barbershop first (they are usually the controller). KERSIVO provides tools and assistance so the barbershop can action valid erasure instructions for customer profile and related data, subject to lawful retention and technical limits described above. For KERSIVO account, billing or marketing data, email hello@kersivo.co.uk. You may also complain to the UK Information Commissioner’s Office (ICO): https://ico.org.uk/.

Cookies and similar technologies

We use necessary cookies and similar technologies to run the website (for example security, payments-related flows, forms, remembering your privacy choices, and keeping a barbershop admin signed in). With your permission on KERSIVO marketing pages, we also use analytics technologies as described in our Cookie Policy.

Admin login uses necessary first-party session cookies so you can stay signed in while managing your shop. Full names, purposes and durations are listed in the Cookie Policy.

You can accept, reject or change optional technologies at any time using Cookie settings in the website footer, or by revisiting the cookie banner when your consent version is updated.

Security

We apply appropriate technical and organisational measures appropriate to the nature of the service, including access controls for admin areas and encrypted connections (HTTPS) for site traffic. No online service can be guaranteed 100% secure.

Changes to this policy

We may update this policy from time to time. The “Last updated” date will change when we do. We will notify active clients of any material changes via email. Material changes to cookie purposes may also require a new consent choice.