Privacy Policy

Account data. When you sign in with Google or email, we receive your name, email address and profile picture. We do not receive your Google password.

Booking data. The services, salon, date and time you book, your booking history, and the reviews you write.

Payment data. Payments are processed by Stripe. We store a payment reference and the amount, but never your full card details.

Location. With your permission, your device location is used to show nearby salons on the map. It is used on the device and is not stored with your account.

Device data. A push notification token, so we can send you booking confirmations and updates.

Service providers only. If you apply to offer services, we also collect your legal name, phone number, address, date of birth, bank account (IBAN) and account holder name for payouts, qualification documents you upload, and your salon details and photos.

We use your data to:

• create and secure your account;
• make, confirm and manage bookings, and notify you about them;
• process payments and pay service providers;
• verify service providers before they can accept bookings;
• prevent fraud and keep the platform safe;
• meet our legal and accounting obligations.

Our legal bases are performance of our contract with you, our legitimate interest in running a safe marketplace, your consent (for location and notifications, which you can withdraw in your device settings), and legal obligations.

We do not sell your personal data and we do not use it for third-party advertising.

When you book, the salon you book with receives your name and booking details so it can provide the service. We also use these processors to run Kosmiks:

• Clerk – sign-in and account security
• Google – "Sign in with Google" and push notification delivery (Firebase)
• Stripe – payment processing
• Neon – database hosting
• Cloudflare – image and document storage
• Vercel – server hosting
• Resend – transactional email
• Expo – app updates and push notification delivery
• Mapbox – maps

Some of these providers may process data outside the EU/EEA. Where they do, transfers are protected by the European Commission's Standard Contractual Clauses or an equivalent safeguard.

We keep your account data while your account is active. Booking and payment records are kept for as long as Finnish accounting law requires (generally six years). Provider verification documents are deleted when they are no longer needed to verify the provider. When you delete your account, we delete or anonymise your remaining personal data.

You can ask us to access, correct, delete or export your personal data, to restrict or object to how we process it, or withdraw consent at any time. To do so, email support@kosmiks.com. You also have the right to complain to the Finnish Data Protection Ombudsman (tietosuoja.fi).

Data is encrypted in transit. Provider documents are kept in private storage and are only viewable by our administrators through short-lived links.

Kosmiks is not intended for children under 16, and service providers must be 18 or older.

If we change this policy, we will update the date above and, for significant changes, notify you in the app.

Questions about this policy or your data: support@kosmiks.com