Privacy and data security
What protects your data, how to answer a customer who asks “where is the guarantee?”, and what the owner should switch on.
What is already protected
- A separate database per business. Your clients, sales and bank live in their own file; another salon or store cannot see them.
- Encryption. All traffic runs over HTTPS. Bank data and the Stripe, Square and Twilio keys are encrypted on disk with a key kept outside the database.
- Cards never pass through the program. Card payments are taken by Stripe and Square (PCI DSS Level 1); card numbers are stored nowhere.
- Bank without a password. The feed comes through Plaid: you sign in on the bank's page, the program gets read-only transactions.
- Passwords are not stored, only their hash. Five wrong attempts lock sign-in for 15 minutes.
- Two-step sign-in by email code and remembered devices — Settings → Sign-in security.
- Staff permissions per section and action are enforced by the server; a removed employee loses access at once.
- Client photos are visible only to signed-in users of your business; signed agreements keep a trail — time, IP, device.
- Backups of every database are taken daily and kept 30 days.
If a customer asks “where is the guarantee?”
Answer like this: “Your data is stored in the KAIZER Store program by Kaizer Inc. (USA). It belongs to our salon; the platform does not sell it or use it for advertising. Card payments go through Stripe/Square, we do not keep your card number. You can ask us at any time to show, correct or delete your data.” For those who want details there are four documents in three languages: Security & Privacy, Privacy Policy, Terms of Service and the Data Processing Addendum with the list of every service the data goes to. They live at /legal/store/ on the program's site; you can put the link on your store page or in a signature.
Who is responsible for customer data
By law the owner of your customers' data is you (the controller) and the platform is the processor: it acts only on your instructions and never writes to your customers on its own behalf. So customer requests are handled by you: to show data, open the card; to export, Clients → Excel; to delete, the “Delete client” button in the card (cannot be undone); to unsubscribe, the mark in the card. If a customer writes to the platform's support, the request is forwarded to you.
What the owner should switch on
- Two-step sign-in and a quarterly review of remembered devices — Settings → Sign-in security.
- A personal login for every employee with only the sections they need — Settings → Users. When someone leaves, delete the login the same day.
- Retention of the Email and SMS journals — Settings → Journals: the shorter, the less personal data sits idle.
- A password longer than 12 characters, not the same as your mailbox.
If something happens
You suspect someone else signed in, lost a phone with the program open, got a strange email “from the program” — change the password at once and write to Support (button in the menu). If the platform confirms a breach affecting your data, you will be told by email within 72 hours: what happened, which data and what was done.
Inside the program the same article is under Help.