Privacy Policy

Scisso is an appointment coordination, online booking and SMS notification system developed by KodeKind S.R.L. (CIF: RO54603957, Reg. Com.: J2026028952000), with registered office at Str. Mihail Kogalniceanu, Camera 1, Bl.C8, Et.4, Ap.16, Timisoara, Timis, Romania. This privacy policy explains how we collect, use, and protect personal data when you use Scisso.

This policy applies to everyone whose data passes through Scisso: business owners, employees (including receptionists), clients of those businesses, people who visit our website or a business's booking page, and people who contact us directly (for example, by joining our waitlist or submitting a data request). It covers the web app and the Scisso mobile and SMS relay apps.

For questions about this policy or your personal data, contact us at: [email protected]

KodeKind is not required to appoint a Data Protection Officer under GDPR Article 37 (our processing does not involve large-scale monitoring or special categories of data). For any data protection inquiries, you can reach us at the email address above.

Under the GDPR, the business that uses Scisso is the Data Controller for all client personal data processed through the system. The business decides why and how its clients' data is used, including the legal basis it relies on.

KodeKind (the developer) acts as a Data Processor on behalf of the business, processing data only according to the business's instructions and our Data Processing Agreement (DPA). The DPA is accepted when the business owner agrees to the Terms of Service.

KodeKind is an independent Data Controller for its own relationship with businesses and visitors: business accounts and billing, sign-ups in progress, our product waitlist, our website and the usage statistics of the booking pages (Section 3), the SMS we send to business owners ourselves and the opt-outs from them, reports of content on booking pages that someone believes is illegal and our decisions on them (our own duties under the Digital Services Act), and security and abuse prevention. When a client submits a data subject request directly through Scisso, KodeKind is the Data Controller of the request record itself (confirming the contact detail, the reminders, and the record of when the request was passed on and answered), and answers any part of the request that concerns data it holds as a controller. Finding the matching client records and passing the request to each business is done on behalf of those businesses, as their Data Processor.

After a business closes its account, KodeKind keeps a limited record as an independent controller, for one purpose only: to establish, exercise or defend legal claims, such as a payment dispute or a chargeback (legal basis: legitimate interest, Art. 6(1)(f) GDPR; erasure requests are answered under Art. 17(3)(e)). For each appointment it holds the date and time, service, price, payment status and amounts, and the payment provider's references, linked by internal identifiers, together with the audit log, the record of the terms the business accepted, and the business's billing details. It holds no names, telephone numbers, email addresses, notes or comments. Only KodeKind's administrator can access it. Four years after the subscription ended (or after the trial ended, for a business that never subscribed), or later only while a claim is pending, we delete the payment provider's references, the acceptance records and the billing details. What remains after that (appointment dates, services, prices and amounts, our invoices, and the audit log, all linked only by internal identifiers) contains no names or contact details and is kept as our accounting and security record. You may object to this processing (Art. 21) and complain to the supervisory authority (in Romania, ANSPDCP; see Section 9).

KodeKind also keeps, as controller, a record of the terms each business accepted and of the consents given or withdrawn through Scisso (what, which version and wording, when, and through which page), to be able to show them (Art. 5(2) and 7(1) GDPR); and a short record of erasures and opt-outs outside the database, kept 37 days, so that restoring a backup cannot undo them.

For the advertising measurement described in Section 8, KodeKind and Meta are joint controllers (Art. 26 GDPR) for collecting the data on our website and sending it to Meta.

We collect and process the following categories of personal data:

Where the data comes from. Most of it comes from you. Client data can also come from the business: staff who enter your details, or who connect a calendar where your name or number is written in an event title. An employee's name and email address come from the owner who invites them. We add our own records of abuse (above).

Do you have to give us this data? To book, you need to give your name and a phone number or email address; without them the business cannot confirm or remind you. Billing details are needed for an invoice, as required by tax law. To open a business account you need a name, an email address and a password. Everything marked optional is optional.

For client data, the business decides the legal basis, as controller. Scisso is built around the following bases. For data we process as controller (Section 2), we rely on the bases below as well:

• Contract (Art. 6(1)(b)) for appointment messages - appointment messages (booking received, confirmation, reminder, change, cancellation, rejection) are part of providing the appointment the client booked. They are not marketing, and the client can switch them off at any time. Displaying employee names, titles, and biographies on the booking page is based on the business's legitimate interest (Art. 6(1)(f)) in letting clients choose their service provider.
• Consent (Art. 6(1)(a)) for marketing messages - follow-up and birthday messages, and any other message promoting the business, are sent only to clients who have agreed to receive marketing messages from that business. Every such message includes a link to stop them, and the consent can be withdrawn at any time.
• Contract and information (Art. 6(1)(b) and Art. 13) - when clients book online or register through a link, they accept the Terms of Use of the booking page and are informed of how their data is handled, by this notice and by the business. Consent (Art. 6(1)(a)) is asked only for marketing messages, separately, and can be withdrawn at any time.
• Contract (Art. 6(1)(b)) - Processing employee personal data is necessary to provide the Scisso service under the employee's relationship with the business, including push notification subscriptions when the employee enables them via the permission prompt. Processing billing data (company name, tax ID, VAT number, billing address) is necessary for the performance of the subscription contract and invoice generation. Keeping a sign-up in progress, and sending operational platform SMS to the account owner (such as a welcome message upon signup), are steps taken at your request before or under the subscription contract.
• Legal obligation (Art. 6(1)(c)) - Keeping SMS and email opt-out records is needed to honour opt-out requests under electronic communications law. Invoices and billing data are kept as tax and accounting law requires. Records of your agreement to immediate delivery of SMS credits are kept to show we complied with consumer law. Handling reports of illegal content on booking pages, and telling the reporter and the business what we decided, is required by the Digital Services Act (Regulation (EU) 2022/2065, Articles 16 and 17).
• Consent (Art. 6(1)(a)) for analytics and advertising measurement - We use Google Analytics 4 to understand how our website, the sign-up pages and the booking pages are used, identify usability issues, and improve the service. On our public website and sign-up pages we also use the Meta Pixel, to measure which advertising campaigns bring visitors and sign-ups. On the client booking pages only Google Analytics runs. No tracker is loaded on the legal pages (our Terms, this Privacy Policy, the Client Terms and the legal archive), on the customer self-service links, on the data request page, anywhere in the signed-in application, or in the mobile apps. Analytics and marketing cookies are only placed on your device after you click "Accept all" ("Accept" on the booking pages) in the cookie banner. If you choose "Essential only", no analytics or advertising measurement data is collected. You can change or withdraw your choice at any time from "Cookie settings" at the bottom of the page. Withdrawing stops any further collection and deletes these cookies; it does not affect what was collected before. This processing is based on your consent under Article 6(1)(a) GDPR, Article 5(3) of the ePrivacy Directive (2002/58/EC), and Article 4(5) of Romanian Law 506/2004.
• Legitimate interest (Art. 6(1)(f)) - security and abuse prevention - We verify that a business owner controls the email address used at signup, and we keep a limited record of identifiers used by accounts suspended for abuse. The interest is preventing our service from being used to send messages under a false identity, which harms the recipients of those messages, the businesses whose good name the service depends on, and our own ability to deliver messages at all. GDPR Recital 49 recognises processing strictly necessary for network and information security as a legitimate interest. Only the minimum is kept, entries expire or are deleted on the schedule in Section 6, and no automated decision with legal effect is made about anyone (see Section 9). Our servers also keep short-lived request logs (IP address, time, the address requested without its query, user agent) to investigate attacks and outages.
• Legitimate interest (Art. 6(1)(f)) - keeping the limited record described in Section 2 after a business closes its account, keeping a record of acceptances and consents, and keeping an audit log of who did what in Scisso, so that we can establish, exercise or defend legal claims and demonstrate compliance (Art. 5(2)).
• Consent (Art. 6(1)(a)) for product news - if you tick the box when you sign up, accept an invitation or join our waitlist, we may email you news about Scisso. You can withdraw it at any time in your profile, or, for the waitlist, from the link in our emails.

Scisso sends the following types of SMS to clients. The business can switch each of these on or off:

• Confirmation - sent when a new appointment is confirmed, stating the date, time, and service
• Reminder - sent approximately 24 hours before the appointment
• Updated - sent when an existing appointment is moved to a different date or time
• Cancelled - sent when an appointment is cancelled
• Follow-up - sent a set number of days after an appointment, only if the client has agreed to receive marketing messages from the business; the link to stop them is in every message
• Booking received - sent when a client submits an online booking request, confirming receipt and pending review
• Booking rejected - sent when the business rejects an online booking request, or when the request expires unanswered
• Messages you ask for or that protect you - one-time codes, a link to manage your booking, the reply to a change you asked for, an answer to HELP, and a notice to your other contact detail when a phone number or email is added or changed on your record. These cannot be switched off by the business.
• Birthday - sent on the client's birthday, only if a birthday is on file and the client has agreed to receive marketing messages from the business; the link to stop them is in every message

In addition to SMS notifications, we use your data for:

• Synchronising appointments with Google Calendar to reduce manual data entry
• Matching Google Calendar events to existing client records using email addresses, calendar colour codes, event title keywords, and client names or phone numbers written in the event, and, if the business has it on, the AI feature described in Section 8
• Showing the business statistics about its own work (bookings, visits, revenue, free time, messages) and lists that help it follow up with its own clients, such as clients who have not returned in their usual time. These are shown only to the business's own staff, according to their role.
• Allowing staff to manage client records, appointments, waiting lists and recurring appointment series
• Detecting and merging duplicate client records when the same person is entered more than once
• Processing data subject requests (confirming your phone number or email address with a one-time code and passing the request to each business that holds a matching client record)
• Generating QR codes in the browser for booking pages, registration links, and client update links. QR codes are created client-side and are not transmitted to or stored on our servers.
• Offering visitors the option to download the business contact details as a vCard file (.vcf) when the business is outside its shop hours. vCard files are generated in the browser and contain the business's name and contact details (phone, and address and website where set).
• Processing online booking requests, including matching booking visitors to existing client records by phone number or email address
• Sending email notifications to staff about new online booking requests and other account-related events (via Resend)
• Sending push notifications to staff about bookings, billing events, SMS credit levels and relay health, delivered via your browser's push service or via Google Firebase Cloud Messaging on mobile
• Analysing usage of our website, sign-up pages and booking pages (via Google Analytics 4) to improve them, identify performance issues, and prioritise feature development. Collected only with your consent (see Section 4).
• Processing online payments during booking (deposits and prepayments) via Stripe Connect on the business's own Stripe account. This includes creating payment objects, managing refunds, and letting clients manage their booking through secure links.
• Sending clients emails about their appointments (booking requests, confirmations, reminders, changes, cancellations, rejections, refunds, replies to change requests) and one-time codes, via Resend. The business can switch off some of these, and the client can unsubscribe from the link in booking request, confirmation, reminder, change, cancellation and declined-request emails; codes the client asks for are always sent.
• Letting clients manage a booking (view it, and depending on the business's settings cancel or move it or ask the business to) and update their own contact details and message preferences, through secure links
• Handling reports of content on booking pages that someone believes is illegal: a person at KodeKind reviews each report and decides; we tell the reporter (if they gave an email address) our decision, and, when content is removed or restricted, we send the business a statement of reasons and how to contest it.

We do not use client personal data for advertising. Client records, appointments, phone numbers, and message content are never shared with advertising networks and are never used for any purpose beyond managing appointments, the business relationship, and improving the service. Separately, and only on our public website and sign-up pages, we measure which advertising campaigns bring visitors and sign-ups. That measurement runs only if you accept marketing cookies, and is described in Sections 8 and 11. No decision with legal or similarly significant effect is ever taken about anyone by automated means alone (Art. 22). Optional AI features suggest which service or client a calendar event belongs to; a person always decides.

• Client records - retained for the period configured by the business owner (default: 2 years after the last visit or booking). Once a month the owner is reminded of clients past that period, and decides for each one whether to keep or erase the record. Nothing is deleted automatically while the business uses Scisso.
• SMS message content and phone number - deleted from the system immediately once the message has been sent, and equally if it is cancelled or if all retry attempts are exhausted without a send. They are never retained while awaiting a delivery report. A daily cleanup job also runs as a safeguard to remove any data that was not cleared in real time. The record that a message was sent (type, status, time, never the number or text) is kept with the appointment; the gateway's message reference is deleted after 90 days.
• SMS and email opt-out records - kept for as long as the business uses Scisso, so that your opt-out is honoured even if your number or address is entered again. An opt-out ends when you choose to receive messages again (for example by replying START or from your preferences page), or when the business switches messages back on for your record; an email opt-out that followed a spam complaint or an erasure cannot be lifted by the business. All of them are deleted when the business closes its account, because a closed business can no longer send messages.
• Employee records - anonymised when the employee leaves the business: name, nickname, title, biography, photo, date of birth, phone number, working hours, Google connection (revoked at Google and deleted), push subscriptions, days off and AI connections are deleted. The record of the consents the employee gave is kept, to show they were respected. Appointment history is retained with anonymised references for statistical integrity.
• Audit log - records who did what and when (for example who erased or exported a client, or which client records an AI assistant read), using internal identifiers and coarse context only, never names, phone numbers, email addresses or message contents. It is pseudonymous personal data. It is kept after the account is closed, as part of the record described in Section 2, and has no fixed deletion date.
• Our product waitlist - deleted when you use the link to leave it. If you switch off our emails instead, the entry is deleted 30 days later unless you agreed to product news. Every entry is deleted 2 years after you joined.
• Data subject requests - the personal data you provide in a request (phone number or email address, and any name, note or business name) is encrypted at rest and permanently deleted once every business it was passed to has marked it answered, and in any case 120 days after we receive it. A record of the request type, dates, status and which businesses received it is kept for 3 years, so that we can show each request was passed on and answered in time. It contains no contact details.
• Sign-in - the authentication cookie lapses after about 7 days without use and always 30 days after sign-in, or when you log out, whichever comes first. The mobile app's home-screen widget reads only within that sign-in: its access ends when you sign out on that phone, and at the latest 30 days after the sign-in. The record of each sign-in session is deleted 60 days after sign-in.
• Billing data - company name, tax ID, VAT number and billing address are kept for the duration of your subscription and after it ends, as tax and accounting law requires, and deleted four years after the subscription ended (Section 2). The sign-up IP address is deleted when the account is closed. Payment method details are managed entirely by Stripe and subject to Stripe's retention policies.
• SMS credit purchase history - purchase records (pack size, price, payment reference) and invoices are kept as part of our accounting records. The date of your agreement to immediate delivery is kept with them; the full record of that agreement (its wording and the page it was given on) is deleted four years after the subscription ended.
• Statistics - the business's statistics are calculated from its own records when shown, so they disappear with them. A monthly snapshot of upcoming bookings, per employee, is deleted after 12 months, or earlier when that employee's account is anonymised.
• Backups - database backups are encrypted, kept within the European Union and deleted after 30 days. If a backup ever has to be restored, erasures and opt-outs made since it was taken are re-applied before the service resumes.
• Usage statistics - Google Analytics data retention is set to 14 months for user-level and event-level data. After this period, Google deletes it automatically. Aggregated reports (which are not personal data) are kept. You can delete analytics cookies at any time from "Cookie settings" (choose "Essential only") or by clearing your browser data.
• Client billing data - billing address, company details, and Stripe customer identifier are retained on the client record for as long as the client record exists (see item 1). All billing fields are encrypted at rest (except the country) and are permanently deleted when the client is erased.
• Appointment manage links - secure links that let a client manage a booking stop working 7 days after the appointment ends and are deleted when the client is erased. A link to update your details lasts 15 minutes.
• Stripe payment references - opaque Stripe identifiers (PaymentIntent IDs, SetupIntent IDs, Invoice IDs) on appointments are kept after a client is erased, because refunds and disputes need them; on their own they do not identify anyone. They are deleted four years after the business's subscription ended (Section 2).
• AI usage records - non-content telemetry about each AI request (which feature, which employee, token counts, cost, status, timestamp). No titles, names, images, or other content are recorded. Detailed records are deleted after 13 months; a daily summary per feature and employee (counts and cost only) is kept as part of our accounting records and is not deleted when the account is closed.
• Abuse prevention records - an IP address recorded at signup is kept for as long as the business account exists, and is deleted with it. An entry on the abuse prevention list is deleted 30 days after it stops applying, 90 days after it is withdrawn, and in any case no later than 4 years after it was created. Nothing on that list is kept indefinitely.
• Phone verification records - the hash that records a number has already claimed its free SMS credits is kept while the free-credit offer exists, and is not deleted when an account is erased. Deleting it would restore the entitlement and defeat the purpose. It contains a one-way hash and a date, nothing else, and is not linked to any account. Ask us and we can tell you whether your number appears in it.
• Server logs - deleted after 14 days.
• After a business closes its account - its clients' and staff members' personal data is erased at once, except the limited record described in Section 2. A business whose subscription ended, or whose free trial ended without a subscription, is closed about six months later, after an email warning at least 14 days before.
• Acceptance and consent records - kept for as long as the business's account exists; a business's own record of the terms it accepted, and of its agreements to immediate delivery of SMS credits, is then kept with the limited record described in Section 2.
• Operational records - in-app notifications 60 days; records of emails sent 90 days; the change history of appointments and of clients 90 days (for clients, once they have nothing booked since); Google Calendar sync logs 7 days; relay connection logs 30 days; staff days off 30 days after they end; ended AI assistant connections 90 days; unfinished sign-ups 21 days (an unfinished business account is deleted after 48 hours).
• Device recognition - the token that remembers a client on a device lapses 180 days after it was last used, ends when the client chooses "Forget me" or logs out on the booking page, and is withdrawn when the client is erased. Its record is deleted 30 days after it lapsed or ended, and in any case when the business closes its account.
• Content reports - a report, with the reporter's name and email address, is deleted one year after our decision on it, or earlier if the business concerned closes its account. A report still waiting for a decision is kept until it is decided. The audit log keeps that a report was made and decided, without the reporter's name or email address.
• Business details - the details an owner publishes to identify the business as a trader stay on its pages until the owner changes or removes them, and are cleared when the business closes its account.

• Client phone numbers and email addresses are encrypted at rest using AES-256-GCM with unique initialisation vectors per record
• Google OAuth refresh tokens are encrypted at rest using AES-256-GCM
• SMS job phone numbers are encrypted at rest and permanently deleted immediately after sending
• Data subject request contact details are encrypted at rest and deleted once every business has answered the request, or 120 days after receipt at the latest
• Employee passwords are hashed using bcrypt (12 rounds); the original password is never stored or recoverable
• Two-factor authentication (TOTP) is available for all users. TOTP secrets and backup codes are encrypted at rest using AES-256-GCM.
• Changing your password or two-factor settings ends every other session immediately, and also ends the read-only access of the mobile app's home-screen widget. Signing out on a phone ends that phone's widget access too.
• All data is transmitted over HTTPS/TLS between browser and server
• Servers are EU-hosted to comply with GDPR data residency requirements
• Access to client records is role-restricted. Employees can edit only clients they work with; they can find other clients of the business when searching, with contact details masked, and see more only if the business owner allows staff to see colleagues' work. Owners and receptionists have broader access within their organisation.
• Personal data is automatically redacted from application logs. Phone numbers, names, email addresses, and other sensitive fields are never written to log files.
• When sent via the Android relay, SMS messages travel from the server to the business's own phone over an encrypted connection. The relay app keeps the number and message only in memory and never logs them, but because it is not the phone's default messaging app, Android keeps a copy of each sent message in the phone's message history, and replies from clients are kept by the phone's messaging app, until someone deletes them on that phone. The business controls that device. When sent via a third-party SMS gateway, the phone number and message body are transmitted over HTTPS/TLS to the gateway, together with an address where the gateway reports delivery, which carries our message reference. No client profile data or organisation metadata is transmitted.
• Android relay authentication uses a unique API key per device, stored as a one-way bcrypt hash on the server. The plaintext key is shown once at pairing time and is never stored or retrievable afterward.
• Staff comments on appointments and clients are encrypted at rest using AES-256-GCM. They are included in client data exports and permanently deleted when the client is erased.
• Client billing details (address, company name, tax ID) collected during payment-enabled bookings are encrypted at rest using AES-256-GCM. They are filled in on later bookings only for a client recognised on their device after a one-time code. All billing fields are permanently deleted when the client is erased.

We do not sell personal data. We share it with the sub-processors and recipients below, under contractual data protection obligations where they act for us:

• Google LLC (Google Calendar) - the business connects its calendar under its own agreement with Google (see "Services a business connects" below). Scisso has read and write access to the connected calendar: it creates events when appointments are booked, updates events when appointments are rescheduled or confirmed, deletes events when appointments are cancelled, and sets private extended properties on events to link them to Scisso records. Scisso also reads events from the connected calendar (via webhook notifications) to detect changes made directly in Google Calendar. Only appointment data (times, titles, descriptions, attendee emails, and extended properties) is exchanged. Your Google account email is used to identify your account. Your Google OAuth refresh token is encrypted at rest and is revoked at Google when you disconnect your calendar from your profile or when your account is anonymised. You can disconnect Google Calendar at any time from your profile settings. We strongly recommend connecting a dedicated work calendar rather than a personal calendar. See Google's Privacy Policy.
• Resend, Inc. - delivers email: to clients of the businesses (booking requests, confirmations, reminders, changes, cancellations, receipts, verification codes) and to staff and administrators. Resend processes the recipient's address and the email in the United States, under the EU-U.S. Data Privacy Framework, with Standard Contractual Clauses as fallback. See Resend's Privacy Policy.
• Stripe - used in two capacities: (1) as our sub-processor for KodeKind's subscription billing and SMS credit purchases (business owner's billing data shared); (2) via Stripe Connect (Standard), which the business connects under its own agreement with Stripe, to process online payments on the business's own Stripe account during booking (client billing details, email, and card data collected directly by Stripe's embedded payment form). In both cases, card details are collected directly by Stripe and never pass through Scisso servers. Stripe also acts as an independent data controller for its own fraud prevention and regulatory compliance purposes. For Stripe Connect payments, the business is the merchant of record. KodeKind does not collect any platform fee or commission on payment transactions. See Stripe's Privacy Policy.
• Cloudflare, Inc. - all traffic to Scisso passes through Cloudflare's network, which terminates the encrypted connection at its edge and so processes requests and responses (including your IP address and what you submit) in transit. Cloudflare also provides bot protection (Turnstile) on the sign-up form, the booking form, the waiting-list form and the form for reporting content, and stores and delivers uploaded images (R2, in the European Union). For Turnstile, Cloudflare also uses device signals as an independent controller to improve its bot detection. Network edge: worldwide, under the EU-U.S. Data Privacy Framework, with Standard Contractual Clauses as fallback. See Cloudflare's Privacy Policy.
• SMSAdvert (S.C. SMSAdvert S.R.L.) - the default SMS delivery provider, unless the business sets another order or uses its own Android relay device. The recipient's telephone number and the message are transmitted to SMSAdvert to deliver the message and report its delivery. See SMSAdvert's terms.
• Hetzner Online GmbH - hosts the servers, the database and the encrypted backups in Finland (European Union). It processes data only as necessary to run the servers.
• Google Analytics (Google LLC) - collects usage statistics of our website, sign-up pages and booking pages, only for visitors who accept analytics cookies. Google receives a pseudonymous identifier stored in the _ga cookie, the pages you view, the events described in Section 3, and device and approximate location data derived from your IP address. This is personal data. We do not send it your name, phone number, email address or appointment details, and we do not link it to your account (no User-ID). Our Google Analytics 4 settings: data sharing with Google products is disabled; Google Signals is disabled; user-level data retention is set to 14 months. Google processes this data under its Data Processing Amendment, partly in the United States under the EU-U.S. Data Privacy Framework. See Google Analytics' Privacy Policy.
• SmartBill (S.C. Intelligent IT S.R.L., Visma group) - used to generate and deliver invoices for subscription payments and SMS credit purchases. We share the billing entity name, tax identification number, VAT number (if applicable), billing address, and invoice line items with SmartBill. No client personal data is shared. SmartBill stores data in the European Union. SmartBill acts as a data processor under its own DPA. See SmartBill's Privacy Policy.
• Scaleway SAS - used for two optional AI-assisted features. The first classifies Google Calendar event titles to detect likely client appointments: only the event title, with any telephone numbers and email addresses removed (it may still contain a client's name), and the business's own service-catalogue labels with their catalogue identifiers are sent. No client lists or client records are sent. Scisso keeps the resulting suggestion on the event (the likely service, the client name read from the title and a reusable keyword) for staff to accept or ignore. The second lets a business build its service catalogue from photographs of its own price list: those images contain the business's own commercial information (service names, durations, prices), not client data, and camera metadata including any recorded location is removed before transmission. In both cases the data is processed transiently in France (EU) on the Mistral Small 3.2 model; the model's author does not receive it. Under Scaleway's terms, inputs are not used to train models and no prompt, response or image is stored. See Scaleway's Generative APIs data-privacy documentation. The AI features are switched on by default and an owner can switch them off at any time in Settings.
• Google LLC (Firebase Cloud Messaging) and Apple (Apple Distribution International Ltd. and Apple Inc., Apple Push Notification service) - deliver notifications to staff members' phones in the mobile apps, and wake the business's Android relay. A notification may contain a client's first name and the service booked. Processed in the EU and the United States, under the EU-U.S. Data Privacy Framework or Standard Contractual Clauses (Section 12). Web notifications use the push service of your own browser; their contents are encrypted end to end.
• Company and place lookups (KodeKind as controller) - to fill in a business's billing details, we send a VAT number to the European Commission's VIES service and a Romanian company number to SRLeads (a company registry service). When a client books as a company, the company number they type is looked up with SRLeads too. When an owner links the business to its Google listing, we send the business's name, address or phone number to Google Places. No client personal data is sent to Google Places.
• Google LLC (Firebase Crashlytics) - receives crash reports from the mobile app, only if you agreed when the app asked (you can change it in your profile).
• Services a business connects - when a business connects its own Google Calendar or its own Stripe account (Stripe Connect), it instructs Scisso to send data to that service under the business's own agreement with the provider. Those providers are recipients chosen by the business, not our sub-processors.
• AI assistants a business connects - if a business switches it on, its owners, and the staff the business allows, can connect an AI assistant (Claude, ChatGPT or Codex) to their Scisso account and ask it about the business. Scisso then sends the assistant's provider limited data that staff member can already see: clients' first names and the initial of their surname, visit dates and counts, appointment times, services and prices, and staff names. It never sends full surnames, dates of birth, comments, notes or message content, and sends a masked phone number or email only to tell apart two clients with the same name. The provider is chosen by the business and acts under the business's and the staff member's own agreement with it, which may involve processing outside the EU. The assistant can only read; it can never change anything. We record which clients' data was disclosed, so the business can answer access requests. It is off unless the business switches it on.

Advertising measurement (joint controller)

If you accept marketing cookies on our public website, the Meta Pixel (Meta Platforms Ireland Limited) collects a pseudonymous browser identifier, the page address and the pages you view. When you start a free trial, it also receives the plan you chose, its price and currency. We do not send Meta your name, email address or phone number: we pass the pixel no customer information, and Meta's automatic advanced matching, which would read them from a form, is switched off. The pixel is not loaded on booking pages, on links sent to clients, on the legal pages, in the signed-in application or in the mobile apps. We no longer use the OpenAI (ChatGPT Ads) pixel; choosing "Essential only" in "Cookie settings" deletes any cookie it left on your device during an earlier visit.

For collecting this data on our website and sending it to Meta, KodeKind and Meta are joint controllers (Art. 26 GDPR). We are responsible for asking your consent and for this notice; Meta is responsible for its own processing after it receives the data, as the sole controller, under its own terms (Meta's Controller Addendum). You can exercise your rights with us or with Meta. See Meta's Privacy Policy.

When the Android relay is used, SMS messages are delivered via the business's own phone using the native SMS system. The phone number is decrypted on the server and transmitted directly to that phone over an encrypted connection. No third-party service outside the business's own mobile operator processes the phone number or message content for relay-delivered messages. A copy may remain in the phone's message history (Section 7).

When a third-party SMS gateway (SMSAdvert) is used, the recipient's phone number and message body are transmitted to the gateway for delivery. The message is sent from the gateway's sender, not the business's phone number, but the message content identifies the business by name. The gateway processes this data to deliver the message and report its delivery.

Whether you are a client, employee, or business owner using Scisso, you have the following rights regarding your personal data under the General Data Protection Regulation:

• Right of access (Art. 15) - you can request a copy of all personal data held about you, including your appointment history and message history.
• Right to rectification (Art. 16) - you can ask us to correct inaccurate or incomplete data.
• Right to erasure (Art. 17) - you can request deletion of your personal data. The business will erase all personal fields (name, phone, email, birthday, comments and notes), your phone number and email address are added to that business's opt-out lists so you are not contacted again, and any Stripe customer record for you on the business's account is deleted. A record shell without your name or contact details (dates, services, prices and payment references) is kept for statistics and to handle refunds and disputes.
• Right to restriction (Art. 18) - you can ask us to temporarily stop processing your data in certain circumstances.
• Right to data portability (Art. 20) - you can request your data in a structured, commonly used, machine-readable format (JSON).
• Right to object (Art. 21) - you can object to processing based on legitimate interest. If you do not want to receive SMS messages, use the preferences link in a message, reply STOP to a message from the business's own number, or ask the business to switch SMS off for your record.
• Right to withdraw consent (Art. 7(3)) - you can withdraw any consent at any time (marketing messages, product news, cookies, crash reports), without affecting the lawfulness of processing before withdrawal.
• Right regarding automated decisions (Art. 22) - you have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not engage in such processing.
• Right to lodge a complaint (Art. 77) - you can complain to the data protection authority in the EU country where you live or work, or where you think the problem happened. In Romania this is the ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, [email protected], www.dataprotection.ro.

How to exercise your rights. If you are a client of a business that uses Scisso, that business is responsible for your data and for answering your request. You can contact it directly, or use our data request page. There, we ask for the phone number or email address you gave the business and send a one-time code to it, to confirm it is yours. We then pass your request to every business that holds a client record under those details. To protect your privacy, we do not tell you which businesses these are, and we do not tell any business about the others. If you name the business you mean, only we see it, to help handle your request. We never show it to any business. Each business must answer you within one month of the date we received your request, and may ask you for more information to confirm who you are. We cannot answer for a business or change its records. If a business has not answered by then, and its record of you was in use within the last two years, we give you its name and contact details, so that you can follow up with it or complain to a supervisory authority. Otherwise, email us and we will follow up. We answer requests about data we hold for our own purposes ourselves. If you are a business owner or employee, contact us directly at [email protected].

Requests will be handled within one calendar month of receipt, as required by GDPR Article 12(3). For complex requests or where multiple requests are received, this period may be extended by up to two additional months, with notification of the extension and reasons provided within the initial one-month period.

One limited exception applies to the right to object. Where we process a small amount of data specifically to stop an account that was suspended for abuse from immediately opening another one, we may decline an objection under Art. 21(1) where we can demonstrate compelling legitimate grounds. Those grounds are that the processing exists to protect other people from messages sent under a false identity, that upholding every objection would defeat the measure entirely and by design, and that the data held is minimal, is not used for any other purpose, and expires. We will tell you if we rely on this, we will explain why, and you can complain to a supervisory authority. This exception never applies to your appointment data, your marketing preferences, or anything else in this policy.

You can stop SMS from a business at any time from your message preferences page. Its link ("SMS preferences") is in every follow-up and birthday message, and in the first other message you receive through each sending route; messages about a booking may carry a link to manage the booking instead, whose page has the same choices. The page shows which business is contacting you, and also lets you stop emails and marketing messages. Once you opt out, the business sends you no further SMS until you choose to receive them again. One-time codes you request yourself are still sent. Your opt-out is kept for as long as that business uses Scisso, so it is honoured even if your number is entered again. It is deleted when the business closes its account.

If the message came from the business's own phone (the Android relay), you can also reply STOP. The relay app on that phone recognises exact keywords only (STOP, START, HELP, and common EU-language equivalents) and sends the Scisso server only the sender's phone number and the keyword, never the message itself. If the phone is offline, it keeps them encrypted on the phone until it can send them. The server keeps the number only in the opt-out list (for STOP), or not at all (for START), or only until the reply is sent (for HELP). Replying STOP also withdraws your consent to marketing messages. Replying START lets appointment messages through again; marketing messages need your consent again. Replying HELP gets you a reply naming the business. STOP does not work for messages sent through the SMS gateway; use the preferences link.

Additionally, the business owner or staff can switch off SMS or emails for an individual client at any time.

We use the following cookies and browser storage:

The essential cookies and storage items listed above are needed for the service to work, or for something you asked for, and do not require your consent. SessionStorage items are cleared when you close the tab, and the app's session items are also cleared when you log out.

The analytics and marketing items (marked "Yes - analytics" or "Yes - marketing" above) are only set if you click "Accept all" ("Accept" on the booking pages) in the cookie banner. If you choose "Essential only", none of them are set and no data is sent to Google Analytics or the Meta Pixel. You can change or withdraw your choice at any time from "Cookie settings" at the bottom of our website, the sign-up pages, the legal pages, the booking pages and the booking management pages. Withdrawing stops any further collection and deletes these cookies and items, and any cookie left by the OpenAI pixel we used before; it does not affect what was collected before. The legal pages load none of these items and show no cookie banner of their own. The booking pages use only Google Analytics, and not at all when they are embedded in a business's own website.

Our servers, database and backups are in the European Union (Finland). Some providers process data in the United States or worldwide: Resend (email), Cloudflare (network and bot protection), Stripe (payments), Google (Calendar, Analytics, Firebase), Apple (iOS notifications), the push services of staff members' browsers (web notifications, whose contents are encrypted end to end), and, after receiving it, Meta (advertising measurement). AI assistants a business connects are chosen by the business (Section 8).

For transfers to the United States we rely on the EU-U.S. Data Privacy Framework adequacy decision (Commission Implementing Decision (EU) 2023/1795), for providers certified under it, with Standard Contractual Clauses (Art. 46(2)(c) GDPR) as fallback, and Standard Contractual Clauses alone for any provider that is not certified. The General Court of the EU upheld that decision in September 2025 (case T-553/23, Latombe); an appeal is pending before the Court of Justice (case C-703/25 P). If the decision is annulled, the Standard Contractual Clauses apply. Advertising measurement is contracted with Meta Platforms Ireland Limited, established in the European Union, which transfers data onward to its United States parent company under the same safeguards. It happens only if you accept marketing cookies, and stops as soon as you withdraw that consent.

For users in the United Kingdom, transfers to Google Analytics and to the advertising measurement provider named above are safeguarded under the UK International Data Transfer Agreement (IDTA) and the UK Extension to the EU Standard Contractual Clauses, in accordance with the UK GDPR and the Privacy and Electronic Communications Regulations 2003 (PECR). Analytics and advertising cookies require the same opt-in consent standard under PECR as under the EU ePrivacy Directive.

Scisso is a business tool. Account holders must be at least 18; the sign-up and invitation forms ask for a date of birth to confirm it. We do not knowingly collect personal data directly from anyone under 16. A client under 16 should ask a parent or guardian before booking, and should not tick the marketing box. If you book for someone else, tell them, and give only details you are allowed to give. If a business keeps records of clients under 16, it is responsible, as controller, for having a valid legal basis, including a parent's or guardian's consent where GDPR Article 8 requires it.

We may update this policy from time to time. Each version has a date and stays available at its permanent address, listed at https://scisso.app/en/legal/. For a material change in how personal data is processed, we will notify business owners by email at least 30 days before it takes effect.

The list of our sub-processors and its changes are published at the same address.

For any privacy-related questions, data subject requests, or complaints, please contact us at: