Data Processing Information

1. Scope

This page describes the current data processing model. It is informational only and is not a binding Data Processing Addendum unless separately agreed in writing.

2. Data Processed

Based on the current service, Kyoskgo may process the following categories of data on behalf of a customer:

• Customer names, email addresses, phone numbers, and delivery or booking details
• Business profile data, catalog content, reviews, and support notes
• Order, booking, quote, and related service metadata
• Uploaded media, including item images and other file attachments
• Consent records, consent timestamps, and privacy preferences
• IP hashes, user-agent hashes, session data, and QR scan events
• API key metadata and audit logs related to account and business activity

3. Purpose of Processing

Kyoskgo processes personal data only to provide the services described in the Terms of Service, to keep accounts secure, to support orders, bookings, and customer communications, and to meet legal, security, and fraud-prevention requirements. Kyoskgo does not sell personal data.

4. Sub-processors

Kyoskgo currently uses third-party services for OAuth sign-in, file uploads, phone verification, analytics, error monitoring, email delivery, and mapping. This includes Google OAuth, UploadThing, MSG91, PostHog, Sentry, SMTP/email infrastructure, and Mapbox or similar mapping services when configured. Kyoskgo is hosted on self-managed VPS infrastructure provided by Hetzner, using Docker and self-hosted Coolify for deployment management.

This page is informational and does not create a binding processor list, transfer commitment, or contractual DPA on its own.

5. Security Measures

Current security controls include:

• Password hashing and session-based authentication
• CSRF protection and content security policy controls
• Tenant-scoped access checks for business data
• Hashed storage of selected technical identifiers such as IP addresses and user agents
• Audit logging for sensitive account and business events
• Rate limiting and provider-side checks for selected public endpoints

6. Data Subject Rights Assistance

Kyoskgo provides self-service tools for export, consent management, and account deletion from Settings. When a request cannot be completed through self-service tools, support can assist on a reasonable-effort basis.

7. Retention and Deletion

Data is deleted or anonymized when an account is removed, except where retention is required for legal, security, fraud-prevention, or financial recordkeeping purposes. Exact retention periods vary by record type.

8. Contact

Questions about this page should be directed to [email protected]. Enterprise customers that need a signed version should request legal review through the same channel.