Privacy and data processing policy

Data controller

The data controller is Juan David Otero Torres, the independent developer who publishes Kapi, based in Cali, Colombia. In this policy we call him "Kapi" or "we".

Email for personal data matters: juanoterot@outlook.com.
WhatsApp: +57 312 600 6315.
The controller himself handles data requests and complaints through these channels.

Definitions

We use these words with the meaning the law gives them:

Data subject: the person the data is about.
Personal data: any information that identifies you or can identify you.
Sensitive data: data that affects your privacy or whose misuse can lead to discrimination, such as health or biometric data.
Processing: any operation on data, such as collecting, storing, using, sending or deleting it.
Controller: whoever decides why and how data is processed.
Processor: whoever processes data on behalf of the controller.
Consent: your prior, express and informed authorization for us to process your data.
Transmission: sending data to a processor, in or outside Colombia, to process it on behalf of the controller.
Transfer: sending data to another controller.

Principles

We process data according to the principles of Law 1581 of 2012:

Legality and purpose: only for legitimate purposes we tell you about.
Freedom: only with your consent, unless the law says otherwise.
Accuracy and quality: complete, exact and up-to-date data.
Transparency: you can know at any time what data we hold about you.
Restricted access and circulation: only authorized people see it.
Security and confidentiality: we protect it and keep it confidential.

Salons, staff and clients

Kapi is a tool for beauty salons. Three kinds of people use it: the salon owner or admin, the stylists and the salon clients.

Client data: each salon decides what data it records about its clients and why. The salon is the controller of that data and Kapi processes it on the salon's behalf, as a processor, following its instructions.
Salon account data: Kapi is the controller of the account data of owners, admins and stylists, and of the data the salon gives us for its subscription.

If you are a salon client, your salon is your first contact for any request about your data. You can also write to us and we will pass it on to the salon.

What data we process

We only process the data the app needs to work:

Account: name, email and phone. Sign-in is handled by Amazon Cognito; we never see or store your password.
Salon staff: role, branch, ID document, specialties, commissions and working days of each stylist.
Salon: name, city, neighborhood, address, phone and WhatsApp number of the salon.
Client file: name, ID type and number, phone, email, birthday, address, invoice name, preferred stylist, salon notes and service preferences.
Technical history: color formulas (brand, shades, grams, developer, timing), notes for each visit and who recorded them. The salon can only save them if the client gave her consent.
Before and after photos: stored only with the client's consent and visible only to her salon and to her.
Appointments: date, time, service, stylist, price, status, notes and changes.
Purchases in the salon shop: products, amounts, delivery address and phone.
Payments: transaction reference and status, payment method, card brand and the last four digits of the card. We never store the full card number or its security code.
E-invoicing: ID type and number, name, email and phone of the invoice recipient, and the invoice itself (CUFE code, XML and PDF).
Care plans, follow-ups, reviews, product recommendations and messages the salon sends you inside the app.
Support chat: messages between the salon and the Kapi team.
Notification preferences: which channels you want to be notified on (WhatsApp, the app or email).
Consents: whether you accepted data processing, when, which version, whether you accept WhatsApp messages and whether you revoked your consent.
Technical logs: server logs in Amazon CloudWatch, which may include the IP address, date and result of each request.

We do not use analytics, advertising, crash reporting, third-party push notification or cross-app or cross-site tracking tools. We do not ask for your location or your contacts.

Sensitive data

Kapi does not ask for sensitive data and you are not required to provide it. If a question touches on sensitive data, answering it is optional.

Technical history and before and after photos are only recorded with your express consent. Photos are never used to recognize you or for any biometric processing. The salon should avoid writing health data in its notes unless it needs it to serve you.

Phone permissions

The app only asks for a permission when you need it, and you can deny or remove it in your phone settings:

Camera: to take before and after photos of a service.
Photos: to upload a photo you already have or save to your gallery the photos you choose to download.
Calendar: to add a salon appointment to your calendar when you ask. Kapi does not read your other calendar events.

What we use data for

Create and protect your account, and let you sign in.
Let the salon manage its schedule, clients, formulas, inventory, cash register and shop.
Let clients see their appointments, photos, care plan and purchases.
Process payments and issue e-invoices when the salon does so.
Send notices about your appointments, orders or account through the channels you chose.
Charge the salon subscription and keep the salon informed about its status.
Handle requests, complaints, claims and suggestions.
Provide support, keep the service secure, prevent fraud and comply with legal obligations.

We do not sell personal data or use it for advertising. If we want to use your data for something else, we tell you and ask for your consent first.

Children and teenagers

Kapi is not directed at children under 14 and we do not ask them to create an account. If a salon records data about a minor, it must have consent from the minor's parent or legal guardian and respect the minor's best interests and fundamental rights. If you believe we hold a minor's data without that consent, write to us and we will delete it.

Processors and third parties

We only share data with providers we need to run the service. They act as processors or on their own behalf depending on their role, and protect the data under their contract with us and their own policy:

Amazon Web Services (United States, us-east-1 region): hosts the app, database, photos and logs, handles sign-in (Cognito) and sends emails (SES).
Wompi (Bancolombia): processes card and other payments. Card data goes directly to Wompi.
E-invoicing technology provider authorized by the DIAN (Colombian tax authority): receives invoice data only when the salon issues e-invoices, and the DIAN receives it by law.
WhatsApp: Kapi does not send WhatsApp messages. When you or the salon choose to write on WhatsApp, the app opens your WhatsApp with a ready-made message to the salon's chat and you are the one who sends it. The same happens if you write to our WhatsApp support line. Those messages are governed by WhatsApp's policy.
Google Fonts: the app and the panel download fonts from Google, which receives your IP address when they do.
Apple App Store and Google Play: distribute the app and have their own policies.

We also hand data to an authority when a law or a valid order requires it. We do not transfer data to other controllers for their own purposes.

International transmission

Data is stored on Amazon Web Services servers in the United States. By accepting this policy you authorize that transmission. Amazon acts as a processor, processes the data only to provide its service to us and applies security measures equal to or stronger than those required in Colombia.

Cookies and storage on your device

We do not use analytics, advertising or tracking cookies. We only store on your device what the service needs to work:

This site does not use cookies. It stores in your browser whether you chose the light or dark theme.
The web panel uses its own cookies to keep you signed in, for up to 30 days or until you sign out. It also stores in your browser the theme, the branch you chose and whether you already saw the welcome message.
The app stores your session in the phone's secure storage, your preferences in the app's storage and a temporary copy of photos to show them faster.

If you clear cookies or browser or app data, you are signed out and settings go back to their defaults.

How long we keep data

While your account exists or the salon uses Kapi, and for as long as the purposes of this policy require.
If a client deletes her account, we delete her file, photos, technical history and messages immediately. Appointments, purchases and sales remain for the salon's accounting without her name or contact details.
If a staff member deletes their account, we delete their access and personal data (email, phone, photo and ID document). The salon keeps their appointments, sales, commissions, payroll and invoices with their name, as the law requires.
If the only owner of a salon deletes her account, the salon is closed and its data is deleted 30 days later.
E-invoices are kept with the data tax law requires (name, ID number and contact details of the recipient), for as long as that law requires.
If a salon cancels or stops paying its subscription, its information is deleted 60 days after suspension. We notify it 7 days and 1 day before.
"Download my data" and "Export data" files are deleted the next day and their link expires after one hour.
Technical logs are deleted after 30 days.

Security

Information travels encrypted and is stored encrypted. Photos are kept in private storage and only open through links that expire. Each salon only sees its own data and each person only sees what their role allows.

No system is perfect. If we detect an incident that affects your data, we will notify you and the Superintendence of Industry and Commerce (SIC) as the law requires.

Your rights

As the owner of your data you have the right to:

Know what data we hold about you and what we use it for.
Update and correct it, including when it is partial, inaccurate or incomplete.
Request proof of the consent you gave.
Learn, on request, how we have used your data.
Revoke your consent or ask us to delete your data, except when the law or a current contract requires us to keep it.
Access your data free of charge.
File a complaint with the Superintendence of Industry and Commerce (SIC) after making your request or claim to us or to the salon.

These rights can be exercised by you, your heirs, your representative or attorney, or whoever the law authorizes.

Our duties

As controller of account data, and as processor of the data each salon records, we commit to:

Guarantee that you can exercise your rights.
Keep proof of your consent and process your data only for the authorized purposes.
Protect data against loss, unauthorized consultation, use or access.
Update or correct data when appropriate.
Handle requests and claims within the legal time limits.
Follow the salon's instructions about its clients' data and not use it for anything else.
Report security incidents to the SIC and follow its instructions.

Requests and claims

Where to make your request

In the app, if you are a client: Profile > Privacy and data > "Download my data" or "Delete my account". You also manage your consents and notifications there.
In the app or on the web, if you are salon staff: in your profile, "Delete my account".
With your salon, which is the controller of your client file.
By email to juanoterot@outlook.com or on WhatsApp at +57 312 600 6315.

Include your name, the email or phone of your account, the salon, what you need and any documents you want to rely on. We confirm your identity before answering.

Requests

If you want to know what data we hold about you, we answer within 10 business days of receiving your request. If we need more time we tell you beforehand, with the reason, and answer within 5 more business days.

Claims

If you want to correct, update or delete your data, or believe we are not complying with the law, you can file a claim:

If the claim is missing information, we tell you within the next 5 business days. If 2 months go by without you completing it, we consider it withdrawn.
Within 2 business days of receiving the complete claim, we tag your data with the note "claim in progress" until it is resolved.
If the claim belongs to a salon, we forward it within 2 business days and let you know.
We answer within 15 business days of receiving the complete claim. If we need more time we tell you beforehand, with the reason, and answer within 8 more business days.

If you are not satisfied, you can go to the Superintendence of Industry and Commerce. More details on deletion in Delete your account.

Changes to this policy

If we change this policy we publish the new version here with its number and date. If the change is important, for example a new purpose or a new processor, we notify you in the app before it applies and, when the law requires it, ask for your consent again.

Effective date

This policy is effective from October 12, 2026 and replaces previous versions. The databases remain in force while Kapi provides the service and for the retention periods described above.