Privacy Policy

Personal data flows through Kasura in two main contexts:

• Operator account data. Information about you and your team — for subscription billing, authentication, support, and platform operation. Kasura is typically the controller for this data.
• End customer data. Information your end customers submit through public booking pages, portals, or communications you configure. You are typically the controller; Kasura processes this data as a processor on your instructions, as described in the DPA.

Operators remain responsible for privacy notices, lawful bases, and end customer rights for data they control. Kasura provides tools and assistance as described in the DPA.

Kasura does not determine how Operators use personal data relating to their own end customers. Operators decide what personal data is collected, the purpose of processing, applicable retention periods, and the lawful basis for processing.

Depending on platform usage, Kasura may collect and process information such as:

• Name and account details
• Email address
• Workspace and subscription information
• Authentication and session information
• Technical device and browser information
• Usage-related platform activity
• Support communication records
• Billing or subscription status information
• End customer information submitted through your booking flows and portals
• Profile information
• Workspace configuration
• Booking information
• Asset information
• Uploaded files and documents
• Payment status information (excluding payment card details)
• Audit logs
• Security logs

Kasura may process information for purposes including:

• Account access and authentication
• Platform functionality
• Security and fraud prevention
• Billing and subscription management
• Customer support
• Product improvements
• Service reliability and diagnostics

Where required by applicable law, Kasura processes personal data on one or more of the following legal bases:

• Performance of a contract
• Compliance with legal obligations
• Legitimate business interests
• Consent, where required by law

The applicable legal basis depends on the nature of the processing activity and the relationship between Kasura, Operators, and end customers.

Operators may choose available communication methods for operational notifications, reminders, booking updates, authentication messages, support communication, or related platform activity.

Depending on enabled integrations and platform functionality, communication channels may include email, push notifications, messaging platforms, or related communication services.

Kasura may process contact information, notification preferences, message delivery status, and related technical metadata where reasonably necessary to provide these communication features.

Operators remain responsible for ensuring that communication with their end customers through connected or enabled channels complies with applicable consent, marketing, privacy, consumer protection, and messaging laws.

Kasura may allow Operators to configure certain notification preferences. Some service-critical messages, security notifications, billing notices, or legally relevant communications may still be sent where necessary.

Kasura may rely on third-party infrastructure and service providers to operate parts of the platform.

These providers may include services related to:

• Authentication
• Hosting
• Database infrastructure
• Payment processing
• Email delivery
• Push notifications
• Messaging integrations
• Error monitoring
• Related technical infrastructure

A current list of subprocessors Kasura uses is published on our Subprocessors page. Operators connecting their own payment or messaging providers may use additional third parties outside that list.

Some third-party services may process information outside your country or jurisdiction.

Where required by applicable law, Kasura uses appropriate safeguards for international transfers, including Standard Contractual Clauses (SCCs) or other legally recognised transfer mechanisms where applicable.

International transfer information for processor activities is described in the DPA.

The list of subprocessors may change over time as Kasura's infrastructure and service providers evolve. The current list is maintained on the Subprocessors page.

For additional information about Kasura's technical and organisational security measures, please see our Security page.

Kasura subscription fees are processed through Stripe as described in our Payment Terms. Taxes are calculated securely by Stripe during checkout.

Operators may connect their own Stripe account to collect payments from end customers. Kasura is not the merchant of record for those transactions. Operators remain responsible for Stripe policies, disputes, and compliance.

Information may be retained for operational, security, legal, billing, fraud prevention, backup, and support purposes where reasonably necessary.

Retention periods may vary depending on platform usage, subscription status, legal obligations, and security requirements.

Kasura retains personal information only for as long as reasonably necessary to provide the Services, comply with legal obligations, resolve disputes, prevent fraud, enforce agreements, protect platform security, and meet accounting or regulatory requirements.

When information is no longer required, it is deleted or anonymised where reasonably practicable.

Following account closure, certain information may continue to be retained where reasonably necessary for legal obligations, fraud prevention, dispute resolution, accounting requirements, or platform security.

Depending on applicable laws and jurisdiction, Operators and individuals may have rights related to:

• Accessing their information
• Correcting inaccurate information
• Requesting deletion
• Objecting to certain processing activities
• Requesting export of available account data
• Request restriction of processing
• Request data portability where applicable

Some requests may be limited where operational, legal, security, fraud prevention, or contractual obligations apply.

For data Kasura processes as a processor on your behalf, contact us and we will assist as described in the DPA.

Kasura is not intended for children below the minimum age required by applicable law and does not knowingly collect personal information directly from children.

Kasura does not use automated decision-making or profiling that produces legal or similarly significant effects on individuals.

For privacy requests, security concerns, or questions about this Privacy Policy, you may contact us using the appropriate address below.

Privacy-related requests and questions may be sent to:

• Privacy and data protection: legal@kasura.app
• General support: support@kasura.app
• Security incidents: security@kasura.app