Privacy Policy

• Your phone number (to sign you in and to reach you about a booking) and, if you add it, your name.
• Your address and location. The area and address you enter, and, if you drop a pin on the map, the exact coordinates. We use these to match an artist and to time her arrival.
• Booking details: the design, date, time slot, status, price, payment records, and any cancellation reason.
• Your reviews and ratings, saved designs, and the notifications we send you inside the app.
• Your chats with Kuku, our AI consultant, if you use it: what you write, the photos of nails you choose to send, what Kuku answers, and any order it puts together with you. We also keep a note of photos the photo check refused (not the photo itself).
• Safety reports you send us: what you tell us, the booking it is about, and the notes we make about what we did.
• Sign-in and security data: your IP address when a login code is requested, your device's browser details when a session starts, and, in the Kukume app, an id the app makes for your phone and keeps on it. We use these to prevent abuse, and the phone id only so that an account we have blocked can't come back on the same phone with another number.

We do not collect your contacts or precise location in the background, and we only see photos you choose to send to Kuku. Before a photo is stored, its hidden details (such as where and when it was taken, and the phone model) are removed. We don't use advertising trackers.

• To create your account, sign you in with a one-time code, and keep your session secure.
• To take your booking, find and assign an artist, and show you when she is on the way.
• To take payment, issue refunds, and keep records we must keep.
• To send you booking updates (for example a reminder before your visit, when your artist is on the way, almost there or running late, what is left to pay, and refunds) and to answer your support requests.
• Only if you turn on refill reminders: to remind you, a few weeks after a visit, when it's usually time for your next one.
• Only if you turn on offers and news: to send you our new designs, festive looks and offers.
• To run Kuku: to understand the look you want, check the photos you send, suggest designs, price a custom order from fixed tiers and book it with you; to answer your questions in Help & support from the details of your own bookings, payments and refunds; and to read chats to help you when Kuku passes you to us and to check Kuku is working well and fairly.
• To look into safety concerns, and to protect customers and artists.
• To prevent fraud, abuse and repeated code requests, and to keep the Service running.

We do not sell your personal data, and we do not use it to send you advertising from other companies.

Kuku is an AI. It makes no decision about you on its own: prices come from fixed lists, every photo check follows written rules, and nothing is booked until you tap Pay. If Kuku refuses a photo or can't help, you can always book from Home or ask our team.

We ask for your consent on the sign-in screen, before we take your phone number. You tick a box that is never ticked for you, to confirm that you agree to us using your data for the purposes listed above. Nothing else is bundled into it, and we keep a record of which version of this policy you agreed to and when.

Your consent covers only those purposes. If we ever want to use your data for something new, we will ask you first.

Kuku asks separately. Before your first message, Kuku asks whether what you write and the photos you send may go to Anthropic, whose AI engine runs it, and it doesn't answer until you say yes. You can turn this off at any time in Profile > Privacy & data: Kuku then stops, and asks again if you open it. Chats you have already had are deleted on the usual schedule (see “How long we keep it”).

Refill reminders, and offers and news, are off unless you turn them on. In Notifications you can ask us to remind you about 3 weeks after a visit, and to send you our offers and news (the app also asks you once whether you want them, and you can say not now). Each is its own choice: we keep when you turned it on, and you can turn it off there at any time.

You can withdraw your consent at any time, as easily as you gave it: open Profile > Privacy & data and choose Erase my account. We can't run bookings without your details, so withdrawing ends your account and we delete your data as described under “How long we keep it”. Withdrawing does not undo anything we did lawfully before then.

• Your artist sees your first name, your address and the location she needs to reach you, the design, and the time. She sees this only for bookings assigned to her. For a custom order made with Kuku she also sees the photos on the order and the notes Kuku wrote for her (shown to you before you pay), while the job is offered to her and while it is hers.
• You see your artist's name, rating and, while she is travelling to you, her live location. You never see her phone number.
• Our team sees bookings, customers and payments in order to run the service and help you, and can read Kuku chats and their photos to help you and to check Kuku is working well.
• Service providers that process data for us, under contract: our cloud hosting and database provider (servers and database in Singapore), a payment gateway for payments, an SMS provider to deliver login codes, Google Maps for maps, address lookup and travel-time estimates, Anthropic, whose Claude AI runs Kuku, and Sentry, which tells us when something in the app breaks. Anthropic receives what you write to Kuku and the photos you send it, with your first name and the booking details Kuku needs (the labels and areas of your saved addresses, times and prices) and, when you ask Kuku about your bookings in Help & support, those bookings' details (code, design, date and time, status, amounts and refunds, but not your address or your artist's name); it uses them to produce Kuku's replies and to check them for safety, and under its terms for business customers it doesn't train its AI on them. Google receives the locations needed for those features. Sentry receives a technical report of the error (what failed, on which page, and your browser and device type); we set it up so that it doesn't receive or keep your name, phone number, address or IP address.
• Apple's DeviceCheck, on iPhone, only if we block an account: we ask Apple to flag the iPhones that account used, so the block stays even if the phone is reset. Apple gets only a code the phone makes for this, never your name, number or anything else about you.
• Your phone's alert service (Google for Android and Chrome, Apple for iPhone, Mozilla for Firefox), only if you turn on alerts: it delivers our alerts about your booking, so it sees your phone's alert address and when an alert is sent, but every alert is encrypted, so it can't read what it says.
• The artist named in a safety report may be told what was reported so she can respond. We do not give her your phone number or address.
• Authorities, where the law requires it, or where needed to protect someone's safety.

Because our providers run servers outside India, your data is transferred to and stored in Singapore and, for some providers, other countries (for Kuku, the United States). We only use providers that protect data to a standard we consider appropriate, and we transfer only to places the Indian government has not restricted.

We use one essential cookie that keeps you signed in for 30 days. It holds a random token, not your details, and only a hashed copy is kept on our side, so signing out ends it straight away. Your device also stores where you were in the app and your chosen location, so the app reopens where you left it. If you turn on alerts, your phone gives us an alert address for it, which we keep until you turn alerts off, sign out on that phone, or erase your account. We don't use advertising or cross-site tracking cookies.

• Login codes are kept only as an unreadable hash, expire in 5 minutes, and are deleted within a day.
• Sessions end after 30 days, or when you sign out.
• Booking and payment records are kept for as long as you have an account.
• Safety reports and our notes on them are kept for up to 3 years after a report is closed, and longer while a police or legal matter is open. If you erase your account they are kept, because they protect other people, but they are no longer linked to you.
• An artist's live location is used to show your arrival and is only kept as her latest position.
• Kuku chats are deleted 90 days after their last message. A photo you send Kuku is deleted 90 days after you send it, or 30 days after your visit if it is on a booking, in case of a question about the result. A photo the check refuses is deleted straight away.
• When you erase your account, we delete it right away, with your saved designs, notifications, sign-ins, consent records, Kuku chats and photos, and we remove your name, phone number, address and location from your bookings. What stays is the booking and payment record (design, date, amounts) for as long as tax and accounting law requires, with nothing that identifies you and no link back to you.
• If we block an account (for abuse, fraud, or putting an artist or another customer at risk), we keep its phone number, the ids of the phones it was used on and our note of why, even if the account is erased, so that it can't sign up again. If we unblock it, we remove the block and our note.
• We can't erase your account while a booking is in progress or waiting to be paid. Finish it, or contact us to cancel it, and then you can erase.

Data is sent over encrypted connections. Every request is checked so you can only reach your own records. Login codes and sessions are stored hashed, and one-time codes are limited in how often they can be requested and guessed. No system is perfectly secure. If a breach affecting your data ever happens, we will tell you and the Data Protection Board as the law requires.

Under the Digital Personal Data Protection Act you can:

• get a copy of the personal data we hold about you and how it is used: Profile > Privacy & data > Download a copy of my data, at any time;
• correct or complete it: change your name in Profile > Personal details at any time, and contact us for anything else;
• erase it and withdraw your consent: Profile > Privacy & data > Erase my account (steps for the app, the website and people without the app: how to delete your account);
• nominate someone to exercise these rights for you if you die or cannot;
• complain to us, and to the Data Protection Board of India if we don't resolve it.

For anything the app doesn't do for you, write to us through Help & support in the app from the number you signed in with, so we can be sure it is you. Kuku, our AI assistant, answers there first and passes your request to our team. We aim to answer within 30 days.

Aryan Gowda D A, our grievance contact, handles questions and complaints about your data: +91 94810 55044 · aryandevangi@gmail.com. You can also write to us through Help & support in the app. We reply within 30 days.

If we haven't resolved your complaint, you can take it to the Data Protection Board of India.

We don't knowingly collect data from children. If you think a child has given us data, tell us and we will delete it.

Every version of this policy is listed under Version history below. When we change how we use your data in a way that matters, we ask you to review and accept the update in the app before you make another booking. Related pages: Terms of Service and Cancellation & refund policy.