Privacy Policy

1. Information we collect

Account and profile information: name, email address, phone number, password (stored only as a salted hash), profile photo, role (client, professional, shop owner, vendor, admin), and — for professionals and shops — business details such as display name, bio, service menu, license information, and insurance documentation submitted for Luxury Verified review.

Booking and transaction information: appointments you book or take (service, time, professional, shop), deposits, payments, tips, refunds, cancellations and no-shows, marketplace listings, orders, point-of-sale transactions, loyalty activity, and subscription status.

Payment information: handled by Stripe. We store only payment references — card brand, last four digits, expiration — never full card numbers or security codes. Stripe's own privacy policy governs the card data it processes.

Communications: messages you send through the platform (in-app and SMS threads with professionals and shops), support tickets, reviews you write, and your SMS/email consent records with timestamps.

Location information: the city or neighborhood you search, and — only if you grant the browser or app permission — your device location to show nearby professionals on the map. We don't track location in the background.

Device and usage information: IP address, browser and device type, pages viewed, and app interactions, collected through server logs and product analytics to keep the service working and improve it.

2. Where it comes from

Directly from you (signing up, booking, listing, messaging, contacting support); automatically from your device as you use the service; from professionals and shops you interact with (for example, when a pro records an in-person sale to you at the point of sale); and from our processors (for example, payment confirmations from Stripe or delivery receipts from our SMS carrier).

3. How we use it

To run the platform: create and secure your account, process bookings and payments, hold and release deposits, enforce the cancellation and no-show policies you agreed to, route messages, operate the marketplace and escrow, run loyalty and memberships, and pay professionals, shops, and vendors out.

To keep the platform honest: verify professionals, shops, and vendors (including Luxury Verified license and insurance checks), compute reliability and Legacy Scores, detect fraud and abuse, and moderate reviews under our documented integrity policy.

To communicate: transactional messages (confirmations, reminders, receipts, security notices) are part of the service. Marketing messages are sent only with your separate, recorded consent — see the SMS Terms.

To provide optional services you ask for: if you are a professional or shop and you choose to use a marketing or advertising service we make available in the platform — for example, the “Booked from Ads” advertising service powered by The Mogul Agency, an independent third party — we share the business information needed to run your campaigns with that provider, on your behalf and to deliver the service to you. See “Who we share it with” for exactly what is shared and with whom.

To improve the product: aggregate analytics on how features are used. We may use AI systems to assist with verification checks, support triage, and message drafting; an AI recommendation about your account is always logged and reviewable by a human.

4. Legal bases

We process personal information to perform our contract with you (running bookings and payments), with your consent (marketing, location), to meet legal obligations (tax and financial record-keeping), and for legitimate interests that don't override your rights (security, fraud prevention, product analytics).

5. Who we share it with

With the people you transact with: when you book, the professional (and their shop) sees your name, contact details, your appointment history with them, and your reliability standing — what any front desk would know. When you buy from the marketplace, the seller sees what's needed to fulfill the order.

With our processors, who act on our instructions and may only use what we share to provide their service to us: Stripe (payments, payouts, identity verification), Twilio (SMS delivery), Resend (email delivery), Supabase (database and authentication hosting), and our analytics and error-monitoring providers.

With an independent marketing partner, only if you choose to use it: if you are a professional or shop and you opt into the “Booked from Ads” advertising service (powered by The Mogul Agency), then — at your direction and to deliver that service to you — we share a unique identifier (your K Styles user ID, your professional or subscription status, and a marketing customer code) along with the business details needed to run your campaigns: your business name and contact information, your location and the services you offer, and any promotional video or creative content you've made available. We do this so the partner can set up and manage Meta/Facebook advertising for your business. This partner is a separate company, not our processor; it uses this information under its own terms and privacy practices to run advertising for you, and it operates on Meta's advertising platform under Meta's terms. Your ad budget is paid by you directly to the ad platform — we do not collect, hold, mark up, or control it.

When the law requires it: valid legal process, protecting our rights, or preventing harm. And in a business transfer (merger, acquisition), where this policy continues to apply to transferred data.

We do not sell your personal information, and we do not share it with third parties for their own advertising. The one place we share data with a marketing partner — the “Booked from Ads” service described above — is something you switch on yourself so the partner can advertise your business on your behalf and at your direction; that is not us selling your data, and it is not us sharing your data so a third party can advertise to you for its own purposes. Under the Texas Data Privacy and Security Act this is targeted-advertising context, and you can turn the service off at any time (see “Your rights”).

6. Cookies and analytics

We use first-party storage (cookies and local storage) for sign-in sessions, your theme preference, and product analytics. We don't run third-party advertising trackers. You can clear local storage at any time; the service will sign you out and reset preferences.

7. How long we keep it

Account data: for as long as your account is active, then deleted or anonymized within 90 days of a deletion request, except where retention is legally required.

Financial records (charges, deposits, refunds, payouts, tax records): retained for 7 years to meet IRS and Texas audit requirements, even after account deletion.

Consent records (SMS and email opt-ins and opt-outs): retained for 5 years as TCPA compliance evidence.

Messages and reviews: retained while the related accounts exist; moderated reviews are hidden, not deleted, together with the documented moderation reason.

8. Your rights

You can access, correct, export, or delete your personal information from Settings or by emailing concierge@kstyles.co. We respond within 45 days.

Texas residents: under the Texas Data Privacy and Security Act you have the right to confirm whether we process your data, to correct and delete it, to obtain a portable copy, and to opt out of targeted advertising, the sale of personal data, or profiling that produces legally significant effects. We do not sell personal data and we do not profile you in that way. The only advertising-related data sharing we do is the optional “Booked from Ads” service (see “Who we share it with”), which a professional or shop chooses to turn on so a marketing partner can advertise that business on its behalf — you control it and can stop it at any time by disabling the service or contacting us, and turning it off does not affect the rest of your account. You may appeal a refusal of any request and we'll answer the appeal within 60 days; if we still refuse, you may contact the Texas Attorney General.

Residents of other states with privacy laws have the equivalent rights those laws grant. We don't discriminate against anyone for exercising privacy rights.

Marketing opt-outs: reply STOP to any marketing text, use the unsubscribe link in any marketing email, or flip the toggles in Settings. Transactional messages (booking confirmations, receipts, security notices) continue, because the service doesn't work without them.

9. Children

K Styles is not directed to children under 13, and we don't knowingly collect their personal information. You must be 18 to hold an account; minors may receive services only when booked by a parent or guardian, who provides any information about them. If you believe a child has provided us data, contact us and we'll delete it.

10. Security

Data is encrypted in transit (TLS) and at rest. Database access is governed by row-level security so users reach only their own records; payment mutations run only in controlled server environments, never from the browser. Admin-sensitive actions are written to an audit log. No system is perfectly secure, but we design so the blast radius of any failure is small.

11. If something goes wrong

If a breach affects your personal information, we will notify you and the relevant authorities as required by law — for Texas residents, without unreasonable delay and no later than 60 days after determining a breach occurred — and tell you plainly what happened, what data was involved, and what we're doing about it.

12. Changes to this policy

When we change this policy materially, we'll notify you by email or in-app notice before the change takes effect and update the date at the top. Continued use after the effective date is acceptance of the updated policy.

13. Contact

Trust Fund Enterprises LLC, 5201 S Colony Blvd, Unit 765, The Colony, TX 75056. Privacy requests: concierge@kstyles.co.