Client Terms of Use

These Client Terms of Use ("Terms") explain how Scisso works when a business uses it to manage your appointments and to send you messages.

Scisso is software made by KodeKind S.R.L. (CIF: RO54603957), Timisoara, Romania ("KodeKind"). Barbershops, salons and other service businesses use it to run their bookings. KodeKind provides the technology. The service you book (the haircut, the treatment) is provided by the business, and your agreement for it is with the business, not with KodeKind.

How these Terms apply to you:

• If you book online, join a business's waitlist or fill in a registration form, you are asked to accept these Terms before you submit. Below the box you are shown how the business and Scisso handle your data. That is information for you; you are not asked to agree to it.
• If the business entered your details itself, these Terms also serve as the information notice required by Article 14 GDPR. They explain how your data is processed through Scisso and what your rights are. The business is responsible for telling you that it uses Scisso.

The business that manages your appointments is the data controller under the EU General Data Protection Regulation (GDPR). It decides what data is kept about you and why.

KodeKind is the business's data processor. It runs Scisso for the business, processes your data only on the business's instructions and does not use it for its own purposes.

KodeKind is a separate controller only in these cases: the record of a data request you send through Scisso (passing it on to the businesses is done for them); the record of which version of these Terms you accepted and which consents you gave or withdrew, so that they can be shown later; a short record of erasures and opt-outs, kept for 37 days outside the database so that restoring a backup cannot undo them; server logs of requests to Scisso, kept 14 days for security; looking up a company number you type when paying as a company (Section 3); a report you send about content on a booking page, and our decision on it (Section 13); usage statistics on the booking page, collected only if you choose "Accept" in the cookie banner; and, after the business closes its account, the limited record described in the Scisso Privacy Policy, which holds no names or contact details.

Depending on how the business uses Scisso, it may hold:

• Your first and last name, and the form of address you chose (for example Mr or Ms), if any
• Your phone number, used to send you messages about your appointments and to recognise your record
• Your email address (optional), used to send you booking emails and codes and to recognise your record
• Your date of birth (optional), used for a birthday message only if you agreed to promotional messages and the business sends them
• The language you want your messages in
• Comments staff write on your client record or on your appointments (encrypted at rest). They are included in a data export and deleted if your data is erased.
• A note you add to an online booking. Staff of the business can read it.
• Your appointment history: dates, times, services and prices, and who booked or cancelled each appointment
• Requests you send through your booking link to cancel or move an appointment, and waitlist entries (which services and days you are waiting for)
• Names and phone numbers that staff write in Google Calendar events, which Scisso reads to match an event to your record
• Your billing address, if you pay online: street, city, county and postal code (encrypted at rest), and country
• Your company details (company name, tax ID, trade register number), if you book as a company when paying online (encrypted at rest). The company number you type may be looked up with SRLeads, a company register service, to fill in the company's details
• Payment details: whether you paid or were refunded, the amounts, and Stripe's reference numbers. Your card details are collected by Stripe and never reach Scisso or the business.
• If you choose to be remembered on a device, a token that recognises that device (we keep only a scrambled copy of it)

Phone numbers and email addresses are encrypted at rest using AES-256-GCM. They are never stored in plain text in the database.

Scisso may send you these SMS messages on behalf of the business:

• Appointment confirmation when an appointment is booked or confirmed for you
• Appointment reminder about 24 hours before your appointment
• Change notice if the date or time of your appointment changes
• Cancellation notice if your appointment is cancelled
• Booking received, saying that your online booking request has arrived and is waiting for the business
• Booking declined, if the business rejects your request or does not answer it in time
• Follow-up message after your appointment, only if you agreed to promotional messages
• Birthday message on your birthday, only if you agreed to promotional messages and your date of birth is on file
• Messages you ask for or that protect you: one-time codes you request, a link to manage your booking when you or the business ask for it, the answer when the business approves a change you asked for, a reply to HELP, and a security notice to your other contact detail when a phone number or email address is added to or replaced on your record

The business chooses which of these messages it sends, except the ones in the last item. Depending on the business's settings, an SMS is sent from the business's own mobile phone (through an Android device at the business) or through an SMS gateway.

The first message you receive through each sending route carries a link to your message preferences, or to your booking page, which offers the same choices. Promotional messages carry the link every time. After a message is sent, Scisso deletes its text and your phone number from its message record. A message sent from the business's own phone also stays in that phone's message history, which the business controls.

Emails. If the business has your email address, Scisso also emails you about your bookings (request received, confirmation, reminder, changes, cancellation, declined request, the answer to a change you asked for, refund) and sends you the codes you request by email. The business chooses which of these emails it sends. Booking request, confirmation, reminder, change, cancellation and declined-request emails carry a link to unsubscribe and to your message preferences.

You can stop messages at any time:

• Open the link in a message. It leads to your message preferences, where you can switch off appointment SMS, appointment emails and promotional messages, or to your booking page, which has the same switches. Switching off needs no code, and it works however the message was sent.
• Reply STOP to a message sent from the business's own phone number. This does not work for messages sent through the SMS gateway; use the link in the message instead. Reply START to receive appointment messages again (promotional messages need your agreement again), or HELP for information.
• Ask the business to switch messages off for your record.
• Use the unsubscribe link in a booking email.

Once you stop SMS, the business sends you no more SMS until you choose to receive them again, for example by replying START or on your preferences page. One-time codes you request yourself are still sent. The owner or front desk of the business can also switch SMS back on for your record. Your opt-out is kept for as long as the business uses Scisso, so it still applies if your number is entered again. It is deleted when the business closes its account.

Stopping messages does not delete your data. To have your data erased, see Section 8.

A business may give you a registration link, for example as a QR code at the counter, so that you can enter your own details for an appointment. When you register:

• The link expires after 15 minutes and works only once.
• Appointment messages are part of your booking. Promotional messages are sent only if you tick the box for them.
• You accept these Terms before you submit.
• Only your first and last name are required. Everything else is optional.

If the business offers online booking, you can request an appointment on its booking page. When you do:

• The business you book with is named on its booking page. Where it has added them, its legal name, address, registration numbers, phone number and email address are shown under "Business details" at the bottom of the page, and again before you send your booking. That business is who you make your booking with.
• You give your first name, last name and phone number, and your email address if you want booking emails. An email address is asked for when you pay online. You can add a note for the business. You accept these Terms before you submit.
• Sending a booking request does not create an appointment. It is a request that the business may accept or decline. KodeKind is not a party to it.
• Your request waits as pending until the business accepts it. Scisso checks again that the time is free when you submit. If you pay online, the time is held for you for 10 minutes while you pay.
• If the business does not answer within its response window (by default 4 business hours), your request is declined automatically. You are told by SMS or email, unless the business has switched those messages off, and anything you paid is refunded in full.
• The business may decline your request without giving a reason. Anything you paid is then refunded in full.
• If your phone number or email address matches a client record the business already has, your booking is linked to that record.
• You can separately agree to receive promotional messages from the business. The box is optional and unticked, and you can withdraw your agreement at any time. Appointment messages (confirmation, reminder, changes) are part of your booking, and you can switch them off at any time.
• The booking, waitlist and report forms are protected by Cloudflare Turnstile, which checks your browser and connection, including your IP address, to tell people from bots (see Section 11).
• Outside the business's opening hours, the booking page may offer to save the business's contact details as a vCard file (.vcf): its name, phone number, and its address and website where set. The file is made in your browser and is not sent to any server.
• The booking page may show promotional prices set by the business, which may be time-limited. The price shown when you book is the price that applies to your appointment.

Your booking link.

• If the business offers it, you receive a secure link to your booking after you book online, by SMS and/or email. The business may also offer it for bookings it made for you.
• Depending on the business's settings, the link lets you view your booking, cancel or move it, or ask the business to cancel or move it. It also lets you choose which messages you receive.
• Before you change a booking, you confirm the phone number on it. A one-time code is also sent to you when cancelling would cost you part of a payment.
• If you ask the business to cancel and it does not answer within its response window, your appointment is cancelled. If you ask to move it and there is no answer in time, it stays as it was.
• If the time you want is full, you can ask to wait for a free time on the days you choose, and say whether you keep your current booking meanwhile.
• The link stops working 7 days after the appointment ends.

Waitlist. If the business offers a waitlist, you can ask to be contacted when a time frees up. Staff of the business may contact you. Scisso never sends you messages from the waitlist.

Being remembered on a device. On the booking page you can sign in with a one-time code sent to your phone or email, so that your details are filled in for you. You can then tick "Remember me on this device". The page keeps a token in your browser for that business, which lapses 180 days after you last use it. "Forget me on this device", or logging out, removes it from your browser and also ends it on our server.

Correcting your details. A business may show you a QR code so that you can correct your own details. You unlock that page with a one-time code sent to a phone number or email address the business has on file, and a new phone number or email address is confirmed with a code before it is saved. The page never shows your details in full.

Booking for someone else. If you book for another person, tell them, and give only details you are allowed to give. If you are under 16, ask a parent or guardian before you book, and do not tick the box for promotional messages.

Some services ask for a payment when you book: a deposit, the full price, or your choice between them. In that case:

• You pay the business. The payment goes to the business's own Stripe account, and the business is the seller. KodeKind does not receive or hold your money.
• Before you pay, you see the amount you pay now, what is left to pay at the business, and the business's cancellation policy.
• You enter your billing address, and company details if you book as a company, in the Scisso form. They are passed to Stripe and kept encrypted on your record at that business for its invoices. They are filled in for you next time only if the booking page has recognised you.
• You enter your card details in Stripe's own payment form inside the booking page. They never reach Scisso or the business.
• If the business declines your request, does not answer it in time, or cancels your appointment before it starts, you get back everything you paid.
• The business's cancellation policy applies only when you cancel or do not come. It decides how much is refunded. The cancellation policy shown when you paid applies to that booking, even if the business changes it later. The business may choose to send refunds itself instead of automatically.
• If a service asks to keep your card on file instead, nothing is charged when you book. You are asked separately, with an unticked box, to agree that your card may be charged for a no-show or a late cancellation under the policy shown.
• For questions about a payment, a refund or a chargeback, contact the business. It manages its own payments, and KodeKind does not decide refunds for it.

Right of withdrawal. Your appointment is for a set date and time. EU consumer law gives a 14-day right to withdraw from many contracts made online, but it excludes some services booked for a specific date. If that right applies to your booking, you may withdraw within 14 days of booking without giving a reason, and nothing in the business's cancellation policy limits it. If your appointment falls within those 14 days, booking it is your request that the service be provided on that date.

As a data subject, you have the following rights regarding your personal data under the General Data Protection Regulation:

• Access (Art. 15) - request a copy of the personal data held about you
• Rectification (Art. 16) - have inaccurate or incomplete data corrected
• Erasure (Art. 17) - request deletion of your personal data. All personal fields are removed, your phone number is added to the business's SMS opt-out list, and your email address is blocked from its emails.
• Restriction (Art. 18) - request temporary restriction of processing
• Data portability (Art. 20) - receive your data in a structured, machine-readable format (JSON)
• Object (Art. 21) - object to processing of your data. For messages, use the link in a message, reply STOP, or ask the business to switch them off.
• Withdraw consent (Art. 7(3)) - if you gave consent when booking, joining a waitlist or registering, you may withdraw it at any time, without affecting the lawfulness of processing before you withdrew it

You can contact the business directly, or use our data request page. We confirm the phone number or email address is yours with a one-time code, then pass your request to every business that holds a client record under it, without telling you or them which others do. Each business must answer within one month of the date we received your request. If a business has not answered by then, and its record of you was in use within the last two years, we give you its name and contact details. You can also email us at [email protected].

Requests will be handled within one calendar month of receipt, as required by GDPR Article 12(3). For complex requests or where multiple requests are received, this period may be extended by up to two additional months, with notification of the extension and reasons provided within the initial one-month period.

• Your data is stored on servers in the European Union (Hetzner, in Finland). Some of the providers in Section 11 process it outside the European Union, as stated there.
• Phone numbers and email addresses are encrypted at rest (AES-256-GCM).
• After an SMS is sent or cancelled, its text and your phone number are deleted from Scisso's message record. Only the type of message, its status and its time are kept.
• An SMS sent from the business's own phone travels to that phone over an encrypted connection, and the phone keeps it in its message history like any other text. An SMS sent through the SMS gateway goes to the gateway over HTTPS with only your phone number, the message and a reference for the delivery report.
• Inside the business, access depends on role. The owner and the front desk can see every client. Other staff see in full the clients they work with; when they search, other clients' contact details are masked. The owner can let staff see more, for example colleagues' clients and bookings.

• Your personal data is kept for as long as you have an active relationship with the business. The business owner sets the retention period (default: 2 years after your last visit or booking), is reminded to review records past it, and decides whether to erase them.
• If your data is erased, at your request or by the business, every personal field is removed. A record without your name or contact details (dates, services, prices and payment references) is kept for the business's statistics and to handle refunds and disputes.
• Your SMS opt-out is kept, as an encrypted phone number, for as long as the business uses Scisso. It is deleted when the business closes its account.
• Billing details (address, company information) stay on your client record for as long as the record exists, and are deleted when it is erased. Card details are kept only by Stripe.
• Stripe reference numbers on appointments are kept even after erasure, because refunds and disputes need them. On their own they do not identify you.
• What KodeKind keeps after a business closes its Scisso account is described in the Scisso Privacy Policy.

Your data is not sold or used for advertising. Apart from the company number lookup in Section 3, it is shared only with the following:

• The business and its staff - to manage your appointments and communicate with you
• Hetzner Online GmbH - hosts the servers, the database and the encrypted backups, in Finland (European Union)
• Cloudflare, Inc. - carries all traffic to Scisso, including the booking page, so it handles your IP address and what you send while it is in transit. It also runs the bot check on the booking, waitlist and content report forms (Turnstile), which looks at your browser and connection. For the bot check, Cloudflare also uses those signals as a controller to improve its bot detection (Turnstile privacy addendum). Its network is worldwide; transfers rely on the EU-U.S. Data Privacy Framework, with Standard Contractual Clauses as fallback.
• Resend, Inc. - delivers the business's emails to you. United States, under the EU-U.S. Data Privacy Framework, with Standard Contractual Clauses as fallback.
• SMSAdvert (S.C. SMSAdvert S.R.L., Romania; if the business sends SMS through the gateway) - receives your phone number and the message only to deliver it and report whether it was delivered. Your name, email address and appointment details are not shared with it. Messages sent through it come from the gateway's number, not from the business's phone.
• Stripe (if you pay online) - your card details are collected by Stripe's own form, and Scisso passes it your billing address and email address. The payment is processed on the business's own Stripe account (Stripe Connect Standard), and the business is the seller. Stripe processes your data for the business and, for fraud prevention, as a controller itself, in part in the United States under the EU-U.S. Data Privacy Framework, with Standard Contractual Clauses as fallback. See Stripe's Privacy Policy at https://stripe.com/privacy.
• Google Calendar (if the business uses it) - Scisso keeps the business's calendars in sync both ways. An event shows the appointment time, your name and the service, and a link to the appointment in Scisso. Scisso never adds you as a guest. If the business adds you as a guest itself, your email address is used to match the event to your record. The business uses Google Calendar under its own agreement with Google.
• Scaleway SAS (France; if the business uses Scisso's AI features, which it can switch off) - receives the titles of calendar events, which may contain your first name, to suggest which events are appointments. Phone numbers and email addresses are removed from the titles first. A person at the business decides what to do with each suggestion. Under its terms, Scaleway does not keep the titles or use them to train models.
• Push notification services (Google Firebase Cloud Messaging, Apple, and the push service of a staff member's browser) - deliver notifications to the business's staff. A notification may contain your first name and the service booked. Processed in the EU and the United States, under the EU-U.S. Data Privacy Framework or Standard Contractual Clauses.
• AI assistants the business connects - if the business switches this on, its staff can connect an AI assistant (for example Claude or ChatGPT) to their Scisso account. The assistant can then read part of what that staff member can see: your first name and the first letter of your last name, your visits and appointments, services and prices. It never receives your full last name, your full phone number or email address, your date of birth, comments or messages. It can only read; it cannot change anything. The business chooses the provider and uses it under its own agreement, which may involve processing outside the European Union.
• Google Analytics (Google LLC) - only if you choose "Accept" in the cookie banner on the booking page. It receives a pseudonymous identifier stored in the _ga cookie, the pages and booking steps you reach (including the service you pick), and device and approximate location data derived from your IP address. This is personal data. It never receives your name, phone number or email address, or the date and time you book. It is not used when the booking page is embedded in the business's own website. KodeKind uses it as controller to improve the booking page. Google may process it in the United States under the EU-U.S. Data Privacy Framework. You can change your choice at any time with "Cookie settings" at the bottom of the booking page.

If you believe your data protection rights have been breached, you can complain to the data protection authority of the EU country where you live, where you work, or where the breach happened. In Romania this is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP).

Businesses publish their own names, descriptions, prices and photos on their booking pages. To report content you believe is illegal, use "Report content" at the bottom of the booking page or "Report this photo" on a photo, or write to [email protected], our point of contact, in Romanian or English. Giving your name and email address is optional. A person on our team reviews every report and may remove the content. If you give us your email address, we confirm that we received your report and tell you what we decided, and you can contest the decision by replying to that email. We never tell the business who reported its content.

Scisso is software that helps you and the business arrange appointments. KodeKind provides the technology only. It does not provide the service you book, and it does not control the business's decisions, the quality of its service, its prices or its availability.

Your appointment and any payment are between you and the business. KodeKind is not a party to them. Payments go to the business's own Stripe account; KodeKind does not receive, hold or control your money.

For questions about your appointment, the service, a payment, a refund or a cancellation, contact the business. KodeKind does not decide refunds or service complaints for businesses. If the business finds a technical problem with Scisso, it can contact KodeKind.

Limits of the service. We work to keep Scisso available and accurate, but it may have interruptions, errors or delays. In particular:

• Sending a booking request does not guarantee an appointment.
• SMS and email delivery depends on the sending route, mobile networks, email providers and your phone. A message may arrive late or not at all, and a message recorded as sent may still not have reached you.
• The times shown on the booking page are worked out live, but a time can be taken between the moment you see it and the moment you submit. Scisso checks again when you submit.

Liability.

• KodeKind is responsible to you for loss it causes through its own fault in running Scisso. It is not responsible for what the business does or fails to do, including the service itself, its prices, and its decisions to accept, move or cancel your appointment.
• If a payment is taken in error because of a fault in Scisso, KodeKind will work with the business to put it right.
• For damage to your property caused by KodeKind's simple negligence, KodeKind's liability is limited to EUR 100 (one hundred euros).

What is never limited. Nothing in these Terms excludes or limits KodeKind's liability for:

• Harm to life, physical or mental integrity, or health
• Fraud or deliberate deception
• Intent or gross negligence
• Breaches of the General Data Protection Regulation (including your right to compensation under GDPR Article 82)
• Any other liability that cannot be excluded or limited under applicable law

Your statutory rights under EU and national consumer protection law are not affected by these Terms.

These Terms may be updated. The date at the top of this page shows when this version took effect.

We tell the businesses that use Scisso about material changes, and they are responsible for telling their clients. You are shown the current Terms each time you book, join a waitlist or register, and you accept them by ticking the box.

Every version of these Terms stays available at its own address, listed at https://scisso.app/en/legal/.

These Terms are governed by Romanian law. If you are a consumer living in another EU country, you keep the protection of the mandatory consumer protection law of that country.

You may bring proceedings against KodeKind in the courts of Romania or in the courts where you live. KodeKind may bring proceedings against you only in the courts where you live. You can also complain to your data protection authority or your consumer protection authority.

These Terms are published in Romanian, English, Hungarian and Italian, and each version is authentic. If they differ, the meaning most favourable to you applies.

If a court or authority finds a provision of these Terms invalid or unfair, that provision does not apply to you, and the rest of these Terms remains in force.

For questions about these Terms, your personal data, or to exercise your rights, contact your business directly or reach us at: