Privacy Policy

Professional Account Information

• Name, email address, phone number
• Business name, address, and hours of operation
• Professional role (owner, stylist, barber, esthetician, etc.)
• Service offerings, pricing, and scheduling preferences
• Authentication credentials (managed by our auth provider)

Client Information

• Name, email address, phone number
• Appointment history and preferences
• SMS consent status (whether the client has opted in to text message communications)
• Notes recorded by Professionals about services provided (including voice-dictated notes)
• Intake form responses, including text answers and uploaded photographs (current hair photos, inspiration images, selfies)

Appointment and Transaction Data

• Appointment date, time, service type, and assigned Professional
• Checkout details, service totals, and payment status
• Payment card information, which is collected and processed directly by our payment processor (Stripe); Koureia does not store full card numbers
• Cancellation and rescheduling history

Usage Data

• Pages visited, features used, and interactions with the Service
• Browser type, device information, and IP address (collected automatically)

• Service delivery: Schedule appointments, process checkouts, and manage client records
• Communications: Send checkout receipts via email, and when enabled, appointment reminders and confirmations via SMS and email
• Professional tools: Enable voice note transcription, client summaries, and inventory management
• Improvement: Analyze aggregate usage to improve the Service
• Support: Respond to inquiries and troubleshoot issues
• Security: Detect and prevent unauthorized access or abuse

Koureia uses AI to transcribe voice notes and structure them into organized sections. This processing works as follows:

• Audio recordings are sent to OpenAI for transcription (speech to text)
• Transcribed text is sent to AI providers via OpenRouter for structuring into professional note sections
• We do not send client names, phone numbers, or account credentials to AI providers
• AI-generated content (structured notes, client summaries) is stored in our database
• AI outputs are suggestions and should be reviewed by the Professional before relying on them

Intake Form Photos

When Clients submit photos through intake forms (current hair photos, inspiration images, or selfies), AI may analyze the images to provide quality feedback (e.g., lighting or clarity). These observations are shared with the Professional to support consultation. Photos are not used for any purpose beyond the consultation they were submitted for.

Koureia may send SMS text messages to Clients on behalf of Professionals for appointment-related communications. When SMS features are enabled, Clients who provide a phone number and opt in to SMS notifications during booking consent to receive text messages including:

• Appointment confirmations
• Appointment reminders (typically 24 hours before)
• Scheduling changes, cancellations, or rescheduling notices

Opt-Out

Clients may opt out of SMS communications at any time by replying STOP to any message. After opting out, no further text messages will be sent unless the Client opts in again. Opting out of SMS does not affect the ability to book or receive services.

SMS Data Protection

Text messaging opt-in data and consent information will not be shared with any third parties. Phone numbers collected for SMS communications are used solely for the purposes described in this policy.

Message Frequency and Costs

Message frequency varies based on appointment activity. Standard message and data rates may apply depending on your mobile carrier and plan.

We share data with the following service providers, solely to operate the Service:

• Stripe: Payment processing and secure storage of saved payment methods (cards on file). Stripe handles your card details directly; Koureia does not store full card numbers.
• Supabase: Database hosting and authentication
• OpenAI: Voice note transcription (audio to text)
• OpenRouter: AI model access for note structuring
• Twilio: SMS message delivery
• Resend: Transactional email delivery
• Vercel: Application hosting and deployment

We do not sell, rent, or trade your personal information to third parties for marketing purposes. We may disclose information if required by law or to protect our rights.

• Data is stored in Supabase-hosted databases in the United States
• Appointment and client records are retained for the duration of the Professional's active use of the Service
• Professional accounts and associated data are retained until account deletion is requested
• Voice recordings are processed for transcription and are not retained after processing is complete
• Intake form photos are retained for the duration of the client–Professional relationship and deleted upon request or when the Professional's account is closed
• Aggregate, anonymized data may be retained indefinitely for Service improvement

The Service uses:

• Authentication cookies: To maintain login sessions (essential)
• Local storage: To cache application state for performance

We do not use marketing or advertising cookies. We do not use third-party analytics tracking.

You have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Ask us to correct inaccurate or incomplete information
• Deletion: Request deletion of your personal data (subject to legal retention requirements)
• Portability: Receive your data in a structured, machine-readable format
• Objection: Object to the processing of your personal data in certain circumstances

To exercise these rights, contact us at support@hypandra.com. We will respond within 30 days.

Some information collected through the Service may qualify as consumer health data under state laws, including the Washington My Health My Data Act (MHMDA). This may include notes about services provided that reference skin conditions, hair treatments, or other health-adjacent information.

Professionals are responsible for obtaining appropriate consent from Clients before recording health-related information in notes or other Service features. Koureia does not use consumer health data for advertising or marketing purposes.

Washington state residents may exercise additional rights regarding consumer health data by contacting us at support@hypandra.com.

Koureia is not intended for use by individuals under the age of 18, and we do not knowingly collect personal information from individuals under 18. If we become aware that a person under 18 has provided us with personal information, we will take steps to remove it. If you believe a child has provided us with personal data, please contact us at support@hypandra.com.

We implement reasonable technical and organizational measures to protect your data, including:

• HTTPS encryption for all data in transit
• Token-based authentication with signed sessions
• Role-based access controls

No system is completely secure. We cannot guarantee the absolute security of your data.

We may update this Privacy Policy at any time. We will provide reasonable notice of material changes, such as by updating the effective date at the top of this page or by notifying you via email. Changes take effect upon publication. Continued use of the Service after changes are posted constitutes acceptance of the revised policy.

• Organization: Hypandra, Inc.
• Email: support@hypandra.com
• Website: hypandra.com