How Sistem.KS handles account information and the data businesses manage through the platform.
This text reflects the current implementation and remains under legal review. The data-processing agreement and international-transfer terms must be completed before use with EEA customer data.
Sistem.KS is based in Prishtina, Kosovo. We decide how account, billing, website inquiry and platform security data is used. A business using the workspace normally decides how its own client, staff and appointment data is used; Sistem.KS processes that data to provide the service on the business's instructions. For questions, write to hello@sistem.ks.
Account details include names, email addresses, sign-in records, workspace roles, subscriptions and support messages. Businesses may enter client contact details, service and staff records, appointments, payments recorded in the workspace, notes and communications. Public booking collects the details needed to request an appointment. Technical records may include device, session, security and usage information.
Do not enter medical histories or other sensitive details unless they are genuinely necessary and the business has a lawful basis and appropriate safeguards.
We use account data to provide access, run subscriptions, respond to inquiries, secure the service and meet legal obligations. We process workspace data to deliver the features selected by the business, including scheduling, communications and support. We do not use a business's client records for unrelated advertising or AI model training.
When a workspace user asks the dashboard assistant a question, their recent chat messages, the current date and the workspace timezone are sent to our AI provider to interpret the request. The assistant then retrieves permitted workspace records through our own application; it does not send the full client database to the model.
If a business enables the live AI receptionist, the provider receives up to 16 recent conversation messages, the customer's available name and contact details, business instructions, service names and prices, staff names and offered appointment times. Messages can contain personal or sensitive information supplied by the sender. The receptionist may prepare replies and appointment requests; staff confirm appointments.
Our current AI integration uses OpenAI's API with response storage disabled in each request. Sistem.KS does not authorize salon or customer content to be used for AI training. OpenAI's standard API abuse-monitoring logs may retain content for up to 30 days, or longer in stated exceptional circumstances. The business can keep the receptionist off or use human-led workflows. More detail is on our Data Protection page.
Our primary Supabase project is hosted in the Ireland region. We also use hosting, authentication, email-delivery, AI and, where connected, customer-messaging providers. Their processing and support locations can differ from the primary database location. Resend states that its primary email processing is in the United States. Our team is based in Kosovo and may access data there when providing the service or authorized support.
For EEA customer data made available to Sistem.KS in Kosovo, the business and Sistem.KS must put the appropriate international-transfer safeguards in place. Business customers should contact us to complete the required contractual terms and review subprocessors and onward transfers before EEA client data is processed. We do not describe the whole service as EU-only data processing.
We keep account and workspace information while needed to provide the service and meet applicable legal or security duties. A business controls its customer records and should set its own lawful retention periods. Deletion may take longer for backups, required records or active disputes. Request access, correction or deletion at hello@sistem.ks. If you are a business's customer, contact that business first; we will assist it with your request.
