Privacy Policy

For Account Data about Professionals and authorized users, Kinda Salty Studio, LLC is the controller or business. For Client Records placed in Kioku by a Professional, the Professional is the controller or business and Kinda Salty Studio, LLCis a processor or service provider acting on documented instructions. The Data Processing Addendum governs Client Records.

• name, email, mobile phone number, postal address, Clerk identifiers, authentication and account-access data;
• business and account settings, timezone, and support communications;
• for paid accounts, subscription and billing data, including plan, status, card brand and last four digits, and invoice history;
• device, browser, IP, security, diagnostic, and usage information; and
• Google Analytics page-view and interaction data that excludes Client Record content.

We use Account Data to authenticate users, provide and secure Kioku, administer accounts, support users, measure product usage, improve the service, prevent abuse, comply with law, and communicate about Kioku.

Client Records may include names, contact details, personal and relationship notes, preferences, service history, service details, prices and informational payment or tip history, tasks, and photos of identifiable people. The Professional decides what is collected, why, and for how long.

We process Client Records only to provide, secure, maintain, and support Kioku on the Professional’s instructions. We do not contact or market to clients, sell or share Client Records, use them for targeted advertising, or train AI models on them. If a client contacts us about a Client Record, we direct the request to the responsible Professional.

The Professional must provide its own privacy notice, establish a lawful basis for each record, obtain photo and likeness consent where required, address biometric and minor-client rules, follow professional licensing requirements, and respond to access, correction, deletion, and other requests from its clients.

Depending on the context, we use Account Data to perform our agreement, pursue legitimate business interests such as security and product improvement, comply with legal obligations, protect rights and safety, and act with consent when law requires it. Kioku is not offered outside the United States, and this Policy does not make a GDPR, UK transfer, or adequacy claim.

Clerk uses technologies needed for sign-in and session security. Google Analytics 4 measures page use on our public marketing and legal pages only. It does not load on any signed-in page of the app, so no analytics event reports a client record, a client identifier, or which client a Professional was viewing. See the Cookie Notice for choices, including browser controls and Global Privacy Control treatment.

Kioku has no AI feature. We do not send Client Records, photos, or any other information you store in Kioku to a large language model or other AI service, and we do not use them to train any model. The product ships with no AI provider and no AI dependency.

Until July 2026 Kioku offered a schedule screenshot import that sent the selected image to a third-party model to read appointment times and client names off it. That feature has been removed, and the code that called the model has been deleted. If we ever introduce an AI feature, we will describe it here and in the Subprocessor List before it processes anything you have stored.

We use Vercel for hosting, CDN, edge services, and Blob storage; Neon for managed PostgreSQL; Clerk for authentication; Stripe for subscription billing and payment processing; and Google Analytics for page-use measurement on our public pages. See our current Subprocessor List. We may also disclose information when required by law, to protect rights and safety, during a corporate transaction, or with the user’s direction.

If you subscribe to a paid plan, payment is processed by Stripe. Stripe collects and stores your card details directly; Kioku never receives your full card number or security code and retains only your card brand, last four digits, subscription status, and invoice history. Stripe processes this data under its own terms.

We retain Account Data while an account is active and as reasonably needed for service delivery, security, disputes, and law. Client Records follow the Professional’s instructions. Archive and soft-delete fields are used today. Hard deletion and export assistance are available on request rather than through an automated self-service tool. Residual copies may remain temporarily in backups or where law requires retention.

We use server-side account authorization, tenant-scoped records, private file storage, managed infrastructure, and restricted service credentials. No method is perfectly secure. See the Security Overview. We will investigate security incidents and provide notices as required by applicable state law.

Subject to eligibility and exceptions, residents of California and other states with applicable privacy laws may request access or knowledge, correction, deletion, portability, and information about disclosures; may appeal certain decisions; and may opt out of sale, sharing, targeted advertising, or qualifying profiling.

We do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising. We do not discriminate against anyone for exercising privacy rights. We honor legally required browser-based preference signals such as Global Privacy Control where applicable.

Email requests to jwmcclung@gmail.com. Describe the right requested and the account involved. We may verify identity and authority using information already associated with the account. Authorized agents may be required to show permission. Client Record requests should first go to the Professional.

When a Professional uses Messaging, Kioku and Zoho Mail process client email addresses, campaign content, message headers, and inbound replies. Campaign images are publicly hosted so email clients can retrieve them. Kioku stores workspace-specific unsubscribe and suppression records and message history; editing or reimporting an address does not silently remove those controls. Kioku does not add open-tracking pixels or tracked-link redirects. We do not sell this information or use it for targeted advertising.

Kioku is not directed to people under 18, and Professionals must be 18 or older. If a Professional records information about a minor client, the Professional—notKinda Salty Studio, LLC—is responsible for parental or guardian notice and consent and for any additional legal requirements.

We may update this Policy by posting a new effective date and providing additional notice when appropriate. Contact us at jwmcclung@gmail.com or Kinda Salty Studio, LLC, 424 E. 11th St., Hays, KS 67601.