Privacy policy
About this document
This policy covers the Kyuko information website and the queue application linked by Try for free and Log in. Both are run by the provider listed under Provider details. See About Kyuko and the Public offer.
Provider details
- Provider
- Individual entrepreneur Danylo Olehovych Kolesnyk
- Tax identification number
- 3728303913
- Address
- 3 Talalikhina Street, Pokrovskyi District, Kryvyi Rih, Dnipropetrovsk Region, 50031, Ukraine
- Contacts
- The email address is at the bottom of every page.
Website
- The website uses no cookies, does not load third-party scripts and has no forms requesting personal information.
- First-party scripts operate the menu, select the language and carry advertising tags to application links. A manually chosen language is saved as kyuko-language in this browser’s local storage until you clear site data. Automatic selection uses browser language settings. Tags utm_*, gclid, fbclid and msclkid pass to application links without being saved. These scripts send no separate requests.
- Try for free and Log in open the application, where this policy’s service sections apply.
- There is currently no website traffic analytics. If added, it will use no cookies and this policy will first describe the service and its data.
- The website and application share a server. Requests pass through Cloudflare, listed below. Server logs and retention are described under Service data and Retention.
Data processed by the service
- Business account
- Email, optional name, password hash; login sessions with browser, platform and IP; last activity; invited users’ emails.
- Visitor without a form
- Ticket number, times and status; device platform such as Android or iOS; ticket-token and device-code hashes. No name or phone.
- Application cookies
- The sq_device cookie lasts one year and contains a random code, stored only as a hash in the database. It is issued on opening queue or booking pages to recover tickets and bookings, prevent duplicate active tickets or pending bookings per browser and queue, and show feedback only for tickets issued in that browser.
- Visitor form
- Answers configured by the organisation, agreement to service rules and the rules revision. Organisation staff see answers.
- Time booking
- Phone, email or both as requested, with at least one required, plus form answers and consent. Specialist bookings also store selected services and specialist. Organisation staff see these data; phone is partially masked on the booking page.
- Client records
- If the organisation keeps them: form fields it marked Save in client record, internal fields entered only by its staff, the list of visits, visit and no-show counters, and the time and edition of the latest consent. The change log records who changed the records and when, without the person’s data.
- Device memory
- Answers to fields the organisation keeps in client records are remembered by the browser and filled into its forms next time. “Remember my details on this device” is ticked by default; saved answers stay only in that browser and are never sent to the server, and “Forget saved” erases them.
- Notifications
- Browser subscriptions or Telegram chats link to tickets. Messages contain ticket number, queue, service point, count ahead and manager notes when paused. The Telegram greeting also names the location; Open ticket uses a personal ticket link. No names or contacts appear in messages.
- Telegram
- Chat IDs remain while the ticket is open; the Open ticket link is stored encrypted. Closing the ticket disconnects its chat.
- Feedback
- A rating from 1 to 5, optional comment and submission time linked to the ticket, visible to organisation owners and managers.
- Organisation staff
- Who called and completed each ticket for staff reports visible to owners and managers. Specialist profiles include names, services, schedules, work locations and optional account links. Booking visitors see specialist names and services; names remain in their bookings.
- Payments
- Card numbers are entered only on the payment provider’s page. Kyuko stores a subscription charge token, masked number and card network. Payment records include amount, status, rejection reason and initiator; card-linking records include status, rejection reason and initiator.
- Trial period
- A person’s first organisation gets Business free for a month. Only organisation-creator records determine eligibility. No card is required, so no payment data or automatic charge arises. After the trial, Free applies and organisation data remain.
- Support requests
- Subject, text, correspondence, page address without tokens, browser, platform and app version.
- Support sessions
- Support access logs who opened an organisation, when and why. Owners receive an email.
- Error reports
- On an application error, the browser sends page address, app version, browser, platform and error description.
- Technical logs
- For failed requests, the server records IP, page path without parameters, browser and response code. Application logs contain route template, response code and duration, without IP or request contents.
Responsibility for data
The provider controls business accounts, payments, support and technical logs. The organisation controls visitor tickets, forms, bookings, feedback and alerts, client records and staff-report data. The provider processes those only on its instructions for service operation under the Public offer.
| Data | Purposes and grounds |
|---|---|
| Business accounts and login sessions | Dashboard access, teamwork and account security. Ground: contract performance |
| Payments | Plan payments, renewals and income accounting. Grounds: contract and tax obligations |
| Support requests, sessions and error reports | Responding, helping and fixing errors. Ground: contract performance |
| Technical logs and per-network ticket limits | Preventing attacks and abuse. Ground: the provider’s legitimate interest |
| Visitor data, client records and staff data | Queues, booking, calls, service ratings, remembering returning clients and staff records. The organisation determines grounds; visitor rules name consent and requests for service |
Retention
| Data | Period |
|---|---|
| Form answers | 30 days from the ticket date, automatically deleted; the ticket remains |
| Booking phone, email, answers and consent | 30 days from the appointment date, automatically deleted; time and status remain |
| Client record | 24 months from the last visit, or until deleted at the person’s request |
| Feedback comments | 90 days from submission; ratings remain with tickets |
| Notification subscriptions and Telegram chats | Until the ticket closes |
| Detailed account activity | 90 days |
| Expired and revoked login sessions | Those older than 30 days delete on the next login |
| Tickets and bookings without contacts: number, time and status | While the organisation exists, as its statistics |
| Accounts, organisations, invitations, support and change logs | While the account exists; deletion on request within 30 days, except legally required records |
| Payments | While the organisation exists and 1095 days after deletion, as tax law requires |
| Server technical logs | Size-limited and overwritten; suspicious-request IPs are retained by security systems for up to 7 days |
| Database backups | Up to 30 days |
Data recipients
- plata by mono (Universal Bank JSC, Ukraine): card payments and linking. Receives amount, payment purpose and organisation owners’ email addresses.
- Resend (USA): booking emails, invitations, password resets, payment and plan emails, support correspondence and support-access notices. Receives recipient, subject and message body.
- Browser notification providers Google, Apple, Mozilla or Microsoft: queue notification delivery. Message contents are encrypted and unavailable to the provider.
- Telegram: Kyuko bot messages to visitors who connect their ticket.
- Cloudflare (USA): all website and application requests pass through its network, including IPs and request contents.
- Hetzner Online GmbH (Germany): a dedicated server in Falkenstein hosting the website, application and database.
Resend, Cloudflare, Telegram and notification providers operate outside Ukraine. Only data necessary for operation is shared. Resend and Cloudflare act under data-processing agreements; Telegram and notification services are used only when visitors enable them.
We do not sell data and share it only with named recipients or as expressly required by law.
Data security
- Connections to the website and application use HTTPS encryption.
- Passwords, ticket tokens and device codes are stored only as hashes; Telegram ticket links are encrypted.
- Dashboard access is role-based: operators, managers and owners see different data.
- Kyuko support enters only through a time-limited session with a stated reason and an email to owners. Form answers, booking contacts and feedback remain hidden.
Rights and requests
Under Ukraine’s Law on Personal Data Protection, you may know what data is processed, its source, purpose and recipients; access it; request correction or deletion; object or withdraw consent; and complain to the Ukrainian Parliament Commissioner for Human Rights or a court.
Use the contacts below. We notify you within 10 working days whether the request will be fulfilled, and fulfil accepted requests within 30 calendar days of receipt.
Account or organisation deletion is not self-service. Request deletion or correction through the contacts below. Visitor data is controlled by the organisation visited; contact it directly and we will help fulfil the request.
Policy changes
Changes appear here with the latest update date above. Substantial changes in purposes, recipients or retention are emailed to owners at least 30 days before effect, except changes required by law.