Legal

Privacy policy

1. Who we are

Kiexus is a WhatsApp booking automation service for UK barbers, salons, nail techs and beauticians. The service is operated by Luke Barry, trading as Kiexus, based in Surrey, United Kingdom. Our registered address is 3 Ledbury Road, Reigate, Surrey, RH2 9HN. Our website is kiexus.com. For all privacy enquiries contact hello@kiexus.com.

2. What data we collect

From our clients

• Name, email, phone number, and business name
• Google Calendar OAuth token - used solely to read and write appointments
• Booking and business data in your Google Sheets spreadsheet
• Payment information - processed by our payment provider; we don't store card details

From your end-clients

• WhatsApp phone number and display name
• Booking details: date, time, service type, confirmation status
• Reminder and follow-up message delivery status

This data is stored in a Google Sheet linked to your account, accessible only by you. You are the data controller for your clients' data; Kiexus acts as a data processor on your behalf.

From website visitors

• Anonymous usage data via Google Analytics 4
• IP address (anonymised by GA4 before storage)
• Form submissions when you contact us

3. How we use your data

• To deliver the service - processing bookings, sending WhatsApp messages, syncing with Google Calendar
• To manage your account - onboarding, billing, and account communications
• To provide support - responding to queries and resolving issues
• Legal compliance - where required by law

4. Legal basis (UK GDPR)

• Contract performance - processing necessary to deliver the service
• Legitimate interests - website analytics and service improvement
• Consent - where relied upon, you can withdraw at any time

5. Data sharing

• Twilio - WhatsApp message delivery
• Google Workspace - Calendar and Sheets data storage
• Make.com - workflow automation
• Google Analytics 4 - anonymised website analytics

We do not sell, rent, or share your data with any third party for marketing purposes.

5a. International data transfers

Some of our third-party service providers are based outside the UK. Where data is transferred internationally, we ensure appropriate safeguards are in place:

• Twilio (USA) - WhatsApp message delivery. Twilio participates in data transfer frameworks providing equivalent protection to UK GDPR.
• Make.com (EU) - workflow automation. Make.com processes data under standard contractual clauses approved for UK transfers.
• Google (USA/global) - Calendar, Sheets, and Analytics. Google operates under adequacy-equivalent protections for UK data transfers.

We only transfer data where necessary to deliver the service and require all providers to handle it securely and in line with UK data protection law.

6. Your rights and complaints (UK GDPR)

• Access, rectification, erasure, restriction, portability, and objection
• Withdraw consent at any time without affecting prior processing

To exercise any right, email hello@kiexus.com. We will respond within 30 days.

Complaints procedure: If you have a concern about how we handle your data, please contact us first at hello@kiexus.com so we can try to resolve it. If you remain unsatisfied after contacting us, or if we do not respond within 30 days, you have the right to lodge a complaint directly with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

7. Retention

• Client account data retained for subscription duration plus 12 months, then deleted
• End-client booking data remains under your control in your Google Sheet
• Anonymised analytics data may be retained indefinitely

8. Changes

We may update this policy from time to time. The "last updated" date will reflect any changes. For material changes we will notify active clients by email.