Privacy Notice

Personal data flows through Kasura in two main contexts:

• Operator account data. Information about you and your team — for subscription billing, authentication, support, and platform operation. Kasura is typically the controller for this data.
• End customer data. Information your end customers submit through public booking pages, portals, or communications you configure. You are typically the controller; Kasura processes this data as a processor on your instructions, as described in the DPA.

Operators remain responsible for privacy notices, lawful bases, and end customer rights for data they control. Kasura provides tools and assistance as described in the DPA.

Kasura does not determine how Operators use personal data relating to their own end customers. Operators decide what personal data is collected, the purpose of processing, applicable retention periods, and the lawful basis for processing.

Depending on platform usage, Kasura may collect and process information such as:

• Name and account details
• Email address
• Workspace and subscription information
• Authentication and session information
• Technical device and browser information
• Usage-related platform activity
• Support communication records
• Billing or subscription status information
• End customer information submitted through your booking flows and portals
• Profile information
• Workspace configuration
• Booking information
• Asset information
• Uploaded files and documents
• Payment status information (excluding payment card details)
• Audit logs
• Security logs

Kasura may process information for purposes including:

• Account access and authentication
• Platform functionality
• Security and fraud prevention
• Billing and subscription management
• Customer support
• Product improvements
• Service reliability and diagnostics
• Optional marketing communications after valid opt-in

Where the GDPR or an equivalent framework applies, purposes and legal bases are assessed separately. Acknowledging this notice is not consent to every activity. In particular:

• Account access and authentication: performance of a contract where the individual is a party; for authorised staff contacts, legitimate interests in administering and securing the Operator account where permitted
• Billing and accounting: contract performance for individual customers, legitimate interests in administering business subscriptions, and applicable accounting or tax obligations
• Security and abuse prevention: legitimate interests in preventing unauthorised access and protecting users and the Service, and specific legal obligations where applicable
• Support: handling requested assistance and the legitimate interests in resolving service issues; Operator-controlled data included in a request remains subject to the DPA
• Optional marketing: consent for the disclosed email purposes; declining does not remove ordinary product access
• Optional browser diagnostics: the applicable optional-technology consent; necessary security diagnostics require a separate necessity and legal-basis assessment

The applicable legal basis depends on the nature of the processing activity and the relationship between Kasura, Operators, and end customers. Legitimate interests are subject to the required balancing of individuals' interests and rights. For rental records and AI requests processed on an Operator's instructions, the Operator determines the lawful basis and provides the relevant notice; Kasura's DPA applies. Account information is supplied by you or your Operator; technical information arises from service use and provider delivery. Staff may receive account invitations from an Operator.

Operators may choose available communication methods for operational notifications, reminders, booking updates, authentication messages, support communication, or related platform activity.

Depending on enabled integrations and platform functionality, communication channels may include email, push notifications, messaging platforms, or related communication services.

Kasura may process contact information, notification preferences, message delivery status, and related technical metadata where reasonably necessary to provide these communication features.

Operators remain responsible for ensuring that communication with their end customers through connected or enabled channels complies with applicable consent, marketing, privacy, consumer protection, and messaging laws.

Kasura may allow Operators to configure certain notification preferences. Some service-critical messages, security notifications, billing notices, or legally relevant communications may still be sent where necessary.

With your separate optional choice, Kasura may send product information, offers and ordinary survey invitations. Marketing is not a condition of contract acceptance, Privacy Notice or Cookie Policy acknowledgement, or optional diagnostics. No marketing profiling, tracking pixels or incentive programme is described as an enabled feature. You may withdraw the choice in account settings or by unsubscribe without affecting earlier lawful processing. Necessary contractual, billing, security and account messages remain separate. Consent and withdrawal records may be retained as required to demonstrate compliance; the choice does not authorise unrelated processing.

Kasura may rely on third-party infrastructure and service providers to operate parts of the platform.

These providers may include services related to:

• Authentication
• Hosting
• Database infrastructure
• Payment processing
• Email delivery
• Push notifications
• Messaging integrations
• Error monitoring
• Third-party AI model processing and audio transcription for enabled AI-assisted requests
• Related technical infrastructure

A current list of subprocessors Kasura uses is published on our Subprocessor List page. Operators connecting their own payment or messaging providers may use additional third parties outside that list.

Some third-party services may process information outside your country or jurisdiction.

Where required by applicable law, Kasura uses appropriate safeguards for international transfers, including Standard Contractual Clauses (SCCs) or other legally recognised transfer mechanisms where applicable.

International transfer information for processor activities is described in the DPA.

The list of subprocessors may change over time as Kasura's infrastructure and service providers evolve. The current list is maintained on the Subprocessor List page.

For additional information about Kasura's technical and organisational security measures, please see our Security page.

Current production database and file storage are primarily configured in Google Cloud's asia-southeast1 region (Singapore). Application functions also operate in asia-southeast1 and us-central1. Authentication, hosting delivery, provider support, account metadata and other provider processing may use additional locations under the relevant provider terms; this is not an exclusive regional-storage promise.

The production Firestore database currently has seven-day point-in-time recovery, daily backups retained for seven days and database deletion protection. The production file bucket currently has object versioning, a lifecycle rule to delete noncurrent versions after 30 days, and seven-day soft delete. Lifecycle execution and recovery-copy expiry are provider processes, not a guarantee that every copy is erased at an exact deadline. These configurations may change with lawful operational requirements; no recovery time, recovery point or successful restore is guaranteed.

Kasura and its providers may process personal data outside the individual's country, including Singapore, the United States and other locations used for provider delivery and support. Where applicable law requires safeguards for an international transfer, appropriate safeguards required by that law apply. The published Google Cloud, Stripe, Sentry and Resend data-processing terms describe Standard Contractual Clauses and applicable jurisdiction-specific arrangements. Provider terms do not establish that every transfer or every Kasura account uses the same mechanism. No universal adequacy, Data Privacy Framework participation or zero-retention assurance is given. Contact privacy@kasura.app for information about the safeguards applicable to the relevant processing.

Kasura subscription fees are processed through Stripe as described in our Payment Terms. Applicable taxes and transaction responsibilities are identified at checkout and in the Payment Terms.

Operators may connect their own Stripe account to collect payments from end customers. Kasura is not the merchant of record for those transactions. Operators remain responsible for Stripe policies, disputes, and compliance.

Subscription cancellation, account closure, deletion of active records and expiry of recovery copies are separate events. Personal data is retained only for the specific purposes and periods reasonably necessary to provide the Service, fulfil documented processing instructions, comply with legal and accounting duties, handle disputes or protect security. These purposes are not authority to retain all rental records indefinitely. Active data is deleted or anonymised when the applicable purpose ends, subject to lawful exceptions. Backups, versioned objects, soft-deleted copies and technically necessary residual copies may persist until their applicable expiry. Retained exceptions remain protected and limited to their purpose; recovery must not reintroduce deleted data into ordinary operational use.

Operators may request complete return of their authorised workspace records and original files through support@kasura.app, including after cancellation and before irreversible deletion. Delivery requires authority verification and protection of other persons' information; credentials, secrets and unrelated customer data are excluded. A limited CSV export is not a complete return. Requests under applicable data-protection law are handled within the applicable legal requirements, not an invented universal retention or deletion deadline.

Depending on applicable laws and jurisdiction, Operators and individuals may have rights related to:

• Accessing their information
• Correcting inaccurate information
• Requesting deletion
• Objecting to certain processing activities
• Requesting export of available account data
• Request restriction of processing
• Request data portability where applicable

Any restriction or refusal is based on applicable statutory requirements and exceptions, not merely an operational preference or subscription status. You may withdraw consent without affecting prior lawful processing and may complain to the relevant supervisory authority where that right applies. We verify requests proportionately and respond within the applicable legal time limits.

For data Kasura processes as a processor on your behalf, contact us and we will assist as described in the DPA.

Business-account users and dashboard staff must be at least 18 and provide a separate affirmative self-declaration. We record its explanation version and server-side confirmation time for account eligibility and compliance with the access terms. We do not describe this as age verification or require birth dates or identity copies for ordinary SaaS age confirmation. Contract acceptance additionally requires applicable legal capacity and business authority. Existing users are not retrospectively treated as confirmed from their role or earlier contract.

If prohibited under-18 dashboard access becomes known, we assess and restrict that access, contact the responsible account holder as appropriate and handle associated account data according to applicable law and retention requirements. This is not automatic deletion of rental data. Public rental accounts and booking eligibility are separate and depend on the Operator's applicable terms and law. Adults or Operators may record information about minor guests, passengers or customers in lawful rental workflows; Kasura may process those records on the Operator's instructions under the DPA. We do not promise that the Service never processes personal data relating to minors.

Kasura does not use automated decision-making or profiling that produces legal or similarly significant effects on individuals as an independent controller in the described account processing. AI-assisted rental actions are intended for authorised human review, not autonomous eligibility decisions. Operators must assess their own use, oversight and applicable rights.

For privacy requests, security concerns, or questions about this Privacy Notice, you may contact us using the appropriate address below.

Privacy-related requests and questions may be sent to:

• Privacy and data protection: privacy@kasura.app
• General support: support@kasura.app
• Security incidents: security@kasura.app

Kasura LLC, 30 N Gould St Ste N, Sheridan, WY 82801, United States. Legal: legal@kasura.app. Privacy: privacy@kasura.app. Billing: billing@kasura.app. Support: support@kasura.app. Security: security@kasura.app. These contact channels do not provide a 24/7 service, guaranteed response time or service-level agreement.