YOUR DATA
Privacy Policy
Last updated 5 August 2026
Kevonia is salon booking software operated by Kevonia (“Kevonia”, “we”, “us”). This policy explains what personal data we handle, why, and what you can do about it. It covers both salon owners who subscribe to Kevonia and the clients who book appointments through a salon’s booking page.
1. Two different roles
This is the most important thing to understand, because it decides who is responsible for what.
We are the controller of your account data
When you sign up as a salon owner, we decide how your account details are handled. Your name, email address, password and billing records are ours to look after, and this policy governs them.
We are only a processor of your clients’ data
The names, phone numbers, emails, notes and appointment histories your salon stores in Kevonia belong to your salon. You decide what to collect and why; we simply store and process it on your instructions. In data protection terms you are the controller and we are the processor.
That means your salon is responsible for having a lawful reason to hold your clients’ details, for telling them how you use it, and for answering their requests. We are responsible for keeping it secure and only using it to run the service for you. The processing terms in our Terms of Service set this out.
2. What we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Your account | Full name, email address, and a password stored only as a scrypt hash — never the password itself | You, at signup |
| Google sign-in | Your verified name and email address, if you choose to sign in with Google | Google, only after you approve it |
| Salon profile | Business name, contact email, phone, address, description, and your uploaded logo or photo | You, in Settings |
| Your team | Each professional’s display name, email, phone, colour and profile photo | You, when you add staff |
| Your clients | Name, email, phone, private notes, marketing consent flag, and visit history | You, or the client themselves when booking online |
| Appointments | Date and time, service, assigned professional, status, notes, and cancellation reasons | Created by you or by the client |
| Payments | Amount, currency, status and a Stripe reference. We never see or store card numbers. | Stripe |
| Advertising attribution | Tagged-link source, campaign, target audience, ad name and Meta campaign identifiers associated with a trial account | The advertising link you used to reach Kevonia |
If you consent, Google Analytics helps us understand visits, navigation and successful account registrations. Tagged advertising links let us record which campaign, target audience and ad introduced a trial account. Advertising measurement can also connect Google, Facebook or Instagram ads with trial registrations and verified subscriptions. We do not sell personal data.
3. Why we use it, and our lawful basis
- To provide the service — creating your workspace, showing your calendar, taking online bookings. Lawful basis: performance of our contract with you.
- To take payment — running your subscription and, if you enable it, passing client payments to your own Stripe account. Lawful basis: contract, and our legal obligation to keep accounting records.
- To keep the service secure — authenticating sign-ins and preventing abuse. Lawful basis: our legitimate interest in a secure service.
- To support you — answering questions you send us. Lawful basis: contract and legitimate interest.
- To understand and improve Kevonia — measuring visits, navigation and account registrations with Google Analytics. Lawful basis: your consent.
- To measure advertising — understanding whether a Google, Facebook or Instagram ad led to a trial or subscription. Lawful basis: your consent.
- To understand account acquisition — retaining the campaign labels attached to the link used to create a trial, so we can compare our own campaigns without identifying salon clients. Lawful basis: our legitimate interest in understanding how business customers find Kevonia.
We do not send marketing email to your clients. The consent flag on a client record exists for your salon to use lawfully; it is your responsibility to honour it.
6. Where your data is stored
Kevonia’s application and database are hosted with DigitalOcean in the United States. Stripe, Google and Meta may process data outside your country. Where personal data leaves the European Economic Area, it is protected by the European Commission’s Standard Contractual Clauses or an equivalent approved safeguard.
7. How long we keep it
- Account and salon data — for as long as your workspace is open. Close it and we delete or anonymise your data within 90 days, except where we must keep records longer.
- Client records and appointments — for as long as your salon keeps them. Removing a client hides them from your lists while preserving booking history for your accounts; tell us if you need a permanent erasure.
- Cancelled appointments — kept so you can review or restore them, until you delete the salon.
- Payment and invoice records — kept as long as tax and accounting law requires, typically six to seven years.
- Sign-in sessions — expire automatically after 30 days, or 2 hours in the public demo.
8. Your rights
If you are in the UK, EU or EEA, you can ask us to:
- give you a copy of the personal data we hold about you;
- correct anything inaccurate;
- delete your data, where we have no overriding reason to keep it;
- restrict or object to how we use it;
- send your data to another provider in a portable format; and
- withdraw consent at any time, where we relied on consent.
Write to and we will respond within one month. You can also complain to the Swedish Authority for Privacy Protection (IMY), though we would rather you gave us the chance to put things right first.
9. If you booked an appointment at a salon
If you are a client who booked through a Kevonia booking page, your details are held by the salon you booked with, not by us. They decide what to keep and why; we only store it for them.
So please contact the salon directly to see, correct or delete your details. If you cannot reach them, write to and we will help you make contact and pass on your request.
10. How we protect it
- Passwords are hashed with scrypt using a unique salt for every account, and compared in constant time. We cannot read your password, and neither can anyone who obtains the database.
- Session cookies are HttpOnly and SameSite-restricted, and are served only over HTTPS in production.
- Card details are handled entirely by Stripe and never reach our servers.
- Every workspace is scoped to its own salon, so one salon cannot read another’s data.
- Access to production systems is limited to the people who need it to run the service.
No online service can promise perfect security, but if a breach ever affects your rights we will notify you and the relevant authority as the law requires.
11. Children
Kevonia is a tool for businesses and is not intended for children. We do not knowingly create accounts for anyone under 16. A salon may hold an appointment for a minor booked by a parent or guardian; that record belongs to the salon, and it is their responsibility to handle it lawfully.
12. Changes to this policy
We will update this page when the service changes. If a change materially affects your rights we will tell you by email or in the app before it takes effect. The date at the top always shows the current version.
13. Contact us
Kevonia
Engelbrektsgatan 21 58221 Linköping, Sweden
Privacy questions:
Everything else: