Get started
How it worksYour websiteDashboardFeaturesPricingFAQGet started

Privacy Policy

Last updated: 30 September 2026

Who we are

KRI is a booking and website platform for beauty businesses – barbershops, nail studios, spas, brow and lash artists, and independent practitioners. This policy explains what personal data we handle, why, and what rights you have.

KRI is operated by Iurii Rogulia, registered in Finland at Vanhanpellonkatu 5, 53850 LAPPEENRANTA, Finland (Business ID 2984587-5). For anything about your data, contact us at [email protected].

This policy covers two different situations, and it matters which one applies to you. If you run a salon on KRI, we are the data controller for your account. If you booked an appointment at a salon that uses KRI, the salon is the controller and we handle your booking on its behalf.

The two roles – whose data is whose

KRI wears two hats, and this changes who is responsible for your data.

When you are a salon (our customer), we decide how your account information is used, so we are the controller. This whole policy applies to you.

When you book an appointment with a salon through KRI, the salon – not KRI – decides why it collects your details and how long it keeps them. The salon is the controller; we are only its processor, providing the software. We do not use salon customers’ booking details for our own purposes, and we do not sell or share them. For questions about your booking data – how long it is kept, whether the salon contacts you, or deletion of your record – please contact the salon directly. They should have their own privacy information.

What we collect if you run a salon (we are the controller)

  • Account and sign-in: your name and email address. We use passwordless sign-in (‘magic links’), so we do not store passwords. We use your email to send you the sign-in link and essential service messages.
  • Salon profile: your business details, services, team members, opening hours, and page content you add – used to build and run your public booking page.
  • Billing: subscription status and payment information. You enter your card details on the payment page of our payment provider, Mollie; we never see or store your full card number, and keep only the card brand, the last four digits, the expiry date and an identifier Mollie gives us to recognise the same card. If your business is VAT-registered in an EU country other than Finland, we check your VAT number against VIES, the European Commission’s VAT-number register, through vatnode, our own VAT-validation service, to decide whether reverse charge applies. We keep records of your plan, invoices, and country for pricing and legal accounting.
  • Technical data: your session, functional preferences (such as language and country), and server logs (including IP address) generated when you use the service. We use these to keep you signed in, show the right language, understand which languages our customers use so we can decide which to support, keep the service secure, and diagnose problems.
  • Product analytics: on our website, the sign-in and onboarding pages and in the KRI dashboard we use Umami, a cookieless analytics tool that runs on our own server. It records the pages you visit (with record identifiers and search terms removed from page addresses), actions you take in the product (for example completing an onboarding step or publishing your page), your browser, operating system, device type, screen size and language, and the country and city derived from your IP address. These page views and actions are not linked to your account, name or email address. Our server also records these account events in it, without your name, email address or account identifier: a salon being created (with its country and business type), its page going public for the first time (with how long that took after the salon was created), a card checkout being started, a subscription payment (with its amount, currency and the payment provider’s reference, which lets us match it to its invoice) and a subscription being cancelled (with the reason you chose, if you chose one). We look at it only in aggregate, to see where people get stuck and improve the product.
  • Page performance: Cloudflare, which delivers all traffic to KRI, adds its Web Analytics script to our pages, including booking pages. It measures how quickly a page loads and responds, and reports it to Cloudflare with the page address, the page you came from, your browser, operating system, device type and country. It uses no cookies and stores nothing on your device, and Cloudflare discards your IP address without keeping it in its logs. We look at it only in aggregate, to keep the pages fast.

What we collect if you booked an appointment (the salon is the controller)

When you book with a salon through KRI, the salon collects your name and phone number, and may collect your email, the language you booked in, and notes related to your appointment, together with the service, time, and price of your booking. We store this on the salon’s behalf so it can manage its bookings.

Some information a salon records – for example notes about treatments – may be more sensitive. The salon is responsible for how it collects and uses that information, and we do not use it for our own purposes.

Legal bases

As controller, we rely on the following legal bases under the GDPR:

  • Performance of a contract – to provide the KRI service to salons who have an account, and to handle billing.
  • Legitimate interests – to keep the service secure, prevent abuse and fraud, keep basic logs, understand how the product is used through cookieless, aggregate product analytics, and communicate with salon owners about their account and service-critical changes. We balance these against your rights.
  • Legal obligation – to keep accounting and tax records for the period the law requires.

We do not send marketing to salon customers on our own behalf, and we do not use a salon customer’s phone or email for our marketing simply because they made a booking. Where KRI acts as a processor for salon-customer booking data, the salon is responsible for having a legal basis for that processing.

Sub-processors and third parties

We use a small number of trusted providers to run the service. They process data on our instructions, under contract, only to provide their part of the service:

Our application, database, cache, and our own analytics – Umami, open-source software we run ourselves rather than a service provided by another company – run on a server we manage ourselves, hosted in Vultr’s data centre in the European Union.

  • Vultr (United States) – the cloud infrastructure provider whose European Union data centre hosts our server, including our application, database, cache, and Umami analytics.
  • Cloudflare (United States) – DNS, content delivery, and security for all traffic to KRI, including booking pages and forms; measurement of how fast our pages load (Cloudflare Web Analytics); storage of uploaded images, of the invoices and credit notes we issue, and of encrypted database backups; and forwarding of email sent to [email protected].
  • Resend (United States) – sign-in emails, booking confirmations, reminders and cancellations sent on salons’ behalf, billing notices with their invoices, and support requests sent from the dashboard.
  • Axiom (United States) – storage and search of our server logs, in its European Union region in Frankfurt, Germany. These logs include the IP address and browser of visitors, including visitors to booking pages, with contact details redacted.
  • Sentry (United States) – error monitoring for the application and booking pages, with data stored in its European Union region in Germany. Error reports exclude cookies, request contents, and contact details.
  • Google Workspace (United States) – our email inbox, which receives mail sent to [email protected], including requests from booking customers.

Some providers are independent controllers, not our processors – they decide for themselves how they handle data, under their own privacy policies: Mollie B.V. (Netherlands), for card payments of the KRI subscription, entered on its own payment page; and GitHub (United States), which serves the typography badge script in our marketing-site footer and so receives your IP address. When we check a VAT number, the European Commission’s VIES system and the tax administration of the country concerned receive the number and answer as independent controllers. We make those checks through vatnode, a VAT-validation service run by the same business as KRI, not by a separate company; it runs on Vultr in Frankfurt, Germany. We update this list whenever we add or replace a provider.

Maps

A salon’s page shows a map only after the salon has placed its location in the dashboard. The map is drawn by OpenFreeMap, a map service run by Hyperknot Software Kft. in Hungary, from OpenStreetMap data. Your browser loads the map directly from OpenFreeMap, so OpenFreeMap receives your IP address and the address of the page you are viewing. According to its own privacy policy, it sets no cookies and keeps no IP addresses in its logs, except for up to 30 days while it investigates a security incident. It delivers the map through Cloudflare.

When a salon owner opens the Contact details page or changes the salon’s address, the dashboard looks the address up in Nominatim, the address search of the OpenStreetMap Foundation in the United Kingdom, to centre the map. Nominatim receives the address being looked up and the owner’s IP address. Under the OpenStreetMap Foundation’s privacy policy it may analyse searches to find addresses that are missing from OpenStreetMap.

Neither service works on our instructions: each decides for itself how it handles these requests, under its own privacy policy. We use them because they need no account and set no cookies. Our legal basis is our legitimate interest in showing clients where a salon is and in helping the owner put it on the map (Art. 6(1)(f) GDPR).

The Directions links under a map open Google Maps or Apple Maps. Nothing is sent to Google or Apple unless you follow one of them; from then on their own privacy policies apply.

Cookies

We use only strictly necessary cookies, such as keeping you signed in and remembering your language and country. They need no consent, and we use no analytics or advertising cookies. Our cookieless product analytics (Umami, see ‘What we collect’ above) stores nothing on your device and runs without consent; you can switch it off on our Cookie Policy page.

A salon that connects its own Google Analytics to its page on KRI asks that page’s visitors for consent itself and is responsible for that data, as the salon’s own privacy notice explains.

For the full list of cookies, their purpose and duration, and to switch Umami off, see our Cookie Policy at /legal/cookies.

How long we keep data

  • Account data – for as long as you have a KRI account, and for a short period after you close it, then we delete or anonymise it. In practice we remove account data within 90 days of account closure.
  • Billing and accounting records – for the period required by law (in Finland this is generally several years for accounting records). We keep accounting vouchers and invoices for 6 years, and financial statements and ledgers for 10 years, from the end of the accounting year, as Finnish law requires.
  • Server logs – for a limited period for security and troubleshooting, then deleted. We normally keep server logs for up to 90 days.
  • VAT-number checks – for 5 years from each check made through vatnode; after that we remove the VAT number and business details from the record and keep only the country, date and result.
  • Salon-customer booking data – the salon decides the retention period, as the controller. We delete or return this data on the salon’s instruction, and when a salon closes its account we delete the associated data after 30 days. Backups are cycled out on a rolling basis.

International transfers

We keep personal data within the European Union / European Economic Area wherever we can. Our server – including the database, cache, and our own analytics – is hosted in Vultr’s European Union data centre. Mollie processes card payments in the Netherlands. vatnode carries out VAT-number checks in Germany. Axiom and Sentry keep our server logs and error reports in their European Union regions, in Germany.

Some of our providers are established in the United States and receive data there, or can access it from there: Cloudflare, Resend, Axiom, Sentry, Google, GitHub, and Vultr. Resend keeps its email logs and metadata in the United States. For these transfers we rely on appropriate safeguards: certification under the EU–U.S. Data Privacy Framework for Cloudflare, Resend, Sentry, Google, and GitHub, and the European Commission’s Standard Contractual Clauses for Vultr and Axiom. You can ask us for a copy of these safeguards at [email protected].

Nominatim, the address search used on the Contact details page, is run by the OpenStreetMap Foundation in the United Kingdom, which the European Commission has recognised as providing adequate protection for personal data (adequacy decision renewed in December 2025).

Your rights

Under the GDPR you have the right to:

  • access the personal data we hold about you;
  • correct inaccurate data;
  • delete your data (‘right to be forgotten’), where applicable;
  • restrict or object to certain processing;
  • receive your data in a portable format;
  • withdraw consent where we relied on it; and
  • lodge a complaint with a supervisory authority.

In Finland, the supervisory authority is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto). You may also contact the authority in your own EU country. If you are a salon customer, exercise these rights with the salon you booked with, since it is the controller. If you contact us instead, we will pass your request to the relevant salon and help where we can.

How to exercise your rights

Email us at [email protected]. We may need to verify your identity before acting, to protect your data. We will respond within one month, as the law requires; if a request is complex we may extend this and will tell you if so. We do not charge for this, unless a request is clearly unfounded or excessive.

Children

KRI is a tool for businesses and is not directed at children. We do not knowingly collect data from children through our own services. Where a salon books appointments involving minors, the salon is responsible as the controller.

Changes to this policy

We may update this policy as the service evolves or the law changes. We will post the new version here with an updated date, and for significant changes we will make a reasonable effort to tell account holders.

Contact

Questions, requests, or complaints about your data:

Iurii Rogulia

Vanhanpellonkatu 5, 53850 LAPPEENRANTA, Finland

[email protected]