Privacy Policy

KINSMAN AI INC.(“we”, “us”, “TheKinsman”) builds software for barbershops: online booking, appointment management, shop websites, appointment texts and emails, and related tools. This policy explains what personal information we collect, why, and the choices you have. Questions or requests: hello@thekinsman.technology(put “Privacy” in the subject line).

For visitors of this website and for our customers’ (barbershops’) accounts, KINSMAN AI INC. decides how data is used — we are the controller / business.

When you book an appointment at a barbershop that runs on TheKinsman — through the shop’s website, or through our booking form embedded on any other website — the barbershopis the controller of your booking information and we process it on the shop’s behalf as a service provider / processor, under the Data Processing Terms in our Terms of Service. Privacy requests about a booking are best sent to the shop; contact us and we will assist and route your request to the right shop.

Visitors of our own website: the basic technical data needed to serve pages (IP address, browser type), kept in short-lived server logs. Our own site sets no analytics or advertising cookies today.

If you email us (to join the waitlist, apply for a job, or ask a question), we keep your email in our mailbox until it is handled.

Barbershop accounts:owner and staff names, login email or username, hashed passwords and PINs, shop configuration, registered shared devices, the plan you are on, and — once billing launches — billing details. If a shop enters its own Anthropic API key for blog drafting, we store it encrypted.

Booking clients (processed for the shop):

• first and last name, phone number, and — if you give one — an email address used for the confirmation and calendar invite;
• chosen service, barber (or “any barber”), time, and any notes you type;
• your appointment history with that shop and notes its staff add;
• a consent record each time you accept the booking notice, tick the marketing-text box, or reply STOP or START: the wording version you saw, the time, your IP address and browser details, and the appointment it relates to;
• a phone-number check at booking: we ask Twilio whether the number is valid, to stop mistyped numbers and abuse;
• short-lived rate-limit counters keyed by phone number and IP address, kept about 2 days, so nobody can flood a shop with bookings;
• only with permission you gave the shop: photosconnected to your visits, and — only at shops that offer training recording — a separate permission to video-record you.

• Running appointments: creating, changing, reminding about and keeping a record of bookings for the shop.
• Transactional messages: booking confirmations, reminders and service messages by text or email. These are not marketing. See sections 6 and 7.
• Photos and video: where you gave permission, storing visit photos so the shop can remember your cut, and, where the shop offers it and you agreed separately, training recordings. The request for permission may reach you in person, by text or by email from the shop. We store the files only; we extract no face geometry or other biometric data. To withdraw, tell the shop (or email us and we will pass it on): the shop can remove your photos by erasing your record.
• Security and fraud prevention: phone-number validation, rate-limiting by phone number and IP address, and the consent records above.
• Compliance records: proving what you agreed to and honouring opt-outs.
• De-identified statistics: we create aggregated or de-identified data (which no longer identifies anyone) for statistics and service improvement. We commit not to re-identify it.
• Marketing texts from a shop:only if you separately opted in — the unchecked box on the booking form, or written consent the shop recorded — and you can stop them at any time (section 6). We do not send marketing email or marketing texts of our own today.
• Payments (when billing launches): processed by a PCI-compliant processor (Stripe). We will not store card numbers.

Barbershops can place our booking form on websites we do not operate — their own site or pages built by third parties. When you book through an embedded form: the form itself shows you the notice and consent language and sends your details directly to us, where we process them for the shop exactly as described in this policy; the host website is separately responsible for its own cookies, analytics and anything else it runs around the form; and our form does not read data from, or drop advertising trackers into, the page that hosts it.

Booking triggers transactional texts under the TheKinsman Appointment Alertsprogram: a confirmation, a reminder and, if the shop asks for photo permission, that request — up to 3 messages per appointment. Message and data rates may apply.

Every shop on TheKinsman sends from the same phone number. Reply STOP at any time and we stop all texts sent through that number, from every shop on the platform, and withdraw any marketing-text consent you gave any of them; you get one final confirmation and your number goes on a suppression list. Reply STARTto receive appointment texts again — marketing texts stay off until you opt in again with the shop. Reply HELP for help (or email support@thekinsman.technology). Participating wireless carriers are not liable for delayed or undelivered messages.

Marketing texts (offers and reminders from a shop, up to 4 per month) go only to clients who separately opted in: the optional, unchecked box on the booking form, or a written consent the shop recorded. Consent is never a condition of booking.

If a text cannot be sent because messaging is unavailable, we may send the reminder by email instead (section 7). STOP applies to texts; we never send the reminder by email to a number that replied STOP. When a shop has used up its monthly text allowance, its texts pause until the next month or an upgrade. Full program terms: Terms of Service §7.

Giving an email when booking is optional. If you do, we send, on the shop’s behalf: a booking confirmation with a calendar invite (.ics) attached; a link to give or refuse photo permission when the shop asks for it; and a reminder when a text cannot be sent. These arrive from “<shop name> via TheKinsman” and contain no offers. We do not send marketing email.

Our own website uses only the cookies needed to run it (for example your sign-in session) and loads no analytics or advertising scripts. Shop websites we host may run the shop’s own analytics or advertising tools (for example Google Analytics or Meta Pixel) if the shop enables them; those belong to the shop, are covered by the shop’s privacy policy, and any consent banner on a shop site is the shop’s, and the choices you make in it apply there; our own site has no such tracking to opt out of.

We sell no personal information. We share it only with service providers who run our infrastructure, under contracts limiting them to our instructions:

• Twilio (text-message delivery and phone-number validation)
• Railway (application and database hosting)
• S3-compatible object storage (images and files)
• Cloudflare (site delivery, security and custom domains for shop websites)
• Email delivery (SMTP provider)
• Anthropic (AI-drafted blog posts for shop websites — used with the shop’s own API key and under the shop’s own agreement with Anthropic; no client booking data is sent)
• Stripe (payments, when billing launches)

Our staff.KINSMAN AI INC. staff can access shop and client data to provide support, change a shop’s plan or features, and investigate abuse. That access is under confidentiality obligations, and changes our staff make to a shop’s plan or features are recorded.

We may also disclose information when the law requires it, or in a merger or acquisition (with notice).

• Appointment records: while the shop remains our customer, plus what legal and tax rules require; then deleted or de-identified.
• Consent, STOP and START records: at least 4 years, as proof of compliance.
• Rate-limit counters: about 2 days.
• Photos and video: for as long as the shop keeps them, and until you withdraw permission by telling the shop; the shop can delete them at any time.
• Erased clients:when a shop erases you, upcoming appointments are cancelled, your name, phone, email, notes and photos are removed, and past appointments are kept only as rows with no name or contact details, for the shop’s statistics. Consent and opt-out records are kept as the law requires, and the erasure itself is logged.
• Emails you send us: until handled.
• Backups: expire on a rolling schedule.

Depending on where you live (including California and other US states with privacy laws), you may have the right to access, correct, delete or receive a copy of your personal information, to opt out of sale or sharing (we do neither) and of targeted advertising, and to withdraw consent at any time without affecting earlier processing. We do not discriminate against you for exercising these rights. To exercise them, email hello@thekinsman.technology; we verify requests and respond within the legally required time (typically 45 days). If your request concerns a booking at a specific barbershop, send it to the shop, which can erase your record from its dashboard; if you send it to us, we will assist that shop in fulfilling it. We do not sell personal information.

Our services are for adults. Bookings for minors (for example kids’ haircuts) should be made by a parent or guardian, and shops agree not to market to, photograph or record minors without a parent or guardian’s consent. We do not knowingly collect children’s information without that consent and we do not sell minors’ data. If you believe a child’s data was collected without consent, email us and we will help the shop remove it.

We operate in the United States and serve US barbershops; our providers store and process data in the United States. If you are outside the US, your data is processed in the US when you book with a shop on TheKinsman.

We use encryption in transit, per-shop access controls so one shop cannot see another’s data, hashed passwords and PINs, and least-privilege access for our staff. No system is perfectly secure; if a breach affects you, we will notify you, the shop and regulators as the law requires.

We version this document. Material changes get at least 30 days’ notice on this page (and by email where we have it) before taking effect, and fresh consent is collected where the law requires it. Earlier versions are available on request.

KINSMAN AI INC. — hello@thekinsman.technology