A practical overview of where business data goes, who can access it, and how our AI features use it.
This text reflects the current implementation and remains under legal review. The data-processing agreement and international-transfer terms must be completed before use with EEA customer data.
Businesses control the purposes and lawful basis for their clients' personal data. Sistem.KS operates the workspace as their processor under documented instructions. We are separately responsible for our own account, sales, billing and security data. Business customers should provide their own notice to clients and ensure their use of booking, messaging and AI has a lawful basis.
The primary Supabase project reports the Ireland region (eu-west-1). That alone does not establish the location of every backup, application log, email or AI operation. Authorized Sistem.KS personnel in Kosovo may access workspace data for service and support. Access should be limited by role and recorded. Hosting and communications providers may process data in other countries; customers can request the current provider and location information at hello@sistem.ks.
Kosovo is not covered by a European Commission adequacy decision. Where an EEA business makes personal data available to Sistem.KS as a Kosovo processor, the parties need an appropriate transfer mechanism, normally the relevant EU Standard Contractual Clauses, alongside an assessment of the transfer and any needed supplementary measures. A data-processing agreement must also cover processing instructions, security, subprocessors, requests, breaches and return or deletion of data. These arrangements need to be completed for the actual customer and service configuration.
Whether Sistem.KS must appoint a representative in the EU depends on how its services are offered to people in the EU and the processing involved. This is being assessed separately from the transfer agreement. An EU representative has not been identified on this page; contact hello@sistem.ks for the current position before relying on this service for an EU launch.
The dashboard assistant sends recent user chat messages for intent interpretation. The live AI receptionist sends recent customer messages, available contact details, service and staff context and appointment offers so it can respond. Neither feature sends a complete workspace export. Both currently call OpenAI's Responses API with store set to false.
Sistem.KS does not use salon or customer content to train AI models and does not authorize provider training with it. OpenAI says API inputs and outputs are not used for model training by default unless a customer opts in. Its standard abuse-monitoring retention is separate from model training. We will assess any proposed training or fine-tuning use separately before changing this rule.
Workspace permissions and tenant-level database controls restrict routine access. No system can promise absolute security. We investigate suspected incidents and notify affected business customers without undue delay so they can meet applicable reporting duties. Businesses can ask us to help with access, correction, export or deletion requests. Contact hello@sistem.ks for security, privacy or processor documentation.
