Privacy Policy

Last updated: March 14, 2026

1. Introduction

Kenko, Inc. ("the Company," "we," "us," or "our") operates kenkohq.org and the Kenko platform (the "Service"), an AI-powered marketing and front-desk automation tool built specifically for boutique fitness studios. This Privacy Policy explains what information the Company collects through the Service, how the Company uses it, and the choices you have. It applies to information collected through the Service and through direct communications with you.

The Company is based at 6255 Sunset Boulevard, Suite 720, Los Angeles, CA 90028 and can be reached at [email protected].

2. Who This Policy Covers

Kenko serves two groups of people, and this Policy covers both:

• Studio owners and their team members who hold a Kenko account, configure the platform, and use it to run marketing campaigns and front-desk workflows. The Company acts as a data controller for this group.
• Studio clients whose contact information is uploaded into Kenko by a studio owner so that Kenko can send review requests, class-fill promotions, or lead-nurture messages on the studio's behalf. For this group, the Company acts as a data processor: the studio owner is the controller, and the Company processes client data only under their instructions.

If you are a studio client who received a message sent via Kenko and have questions about your information, contact the studio directly. If you need to escalate, reach the Company at [email protected].

3. Information We Collect

3.1 Information Studio Owners Provide

When a studio owner creates an account or uses the Service, the Company collects:

• Account details: name, email address, phone number, studio name;
• Billing information (processed by our payment provider; the Company does not store full card numbers);
• Integration credentials for connected booking systems (Mindbody, Vagaro, Pike13, Glofox, WellnessLiving) used to read class schedules and client rosters;
• Brand-voice configuration: message templates, preferred tone, studio-specific copy settings entered by the studio owner;
• Support and onboarding communications sent to us.

3.2 Studio Client Data Processed on the Studio's Behalf

Studio owners upload or sync contact lists containing their clients' names, email addresses, and phone numbers. The Company uses this data exclusively to send the outreach sequences the studio owner configured (review requests, class promotions, lead follow-up). The Company does not use studio client contact data for its own marketing, and does not sell or share it with third parties beyond the messaging infrastructure providers that deliver the messages.

3.3 Information Collected Automatically

When you visit kenkohq.org, the Company automatically collects limited technical information:

• IP address and approximate location (city or region level);
• Browser type, operating system, and device class;
• Pages visited, referring URLs, and time on page;
• Cookie and similar identifiers (see Section 6).

3.4 Children's Data

kenkohq.org is not directed to children under 13. The Company does not knowingly collect personal information from children. If you believe a child has provided information, contact [email protected] and the Company will delete it.

4. How We Use Information

The Company uses the information it collects to:

• Create and manage studio owner accounts and deliver the Kenko platform;
• Run review-request, class-fill, and lead-nurture sequences on behalf of studio owners;
• Connect to booking system integrations to read class schedules and roster data;
• Process billing and provide receipts;
• Respond to support inquiries and provide onboarding assistance;
• Improve the platform's automation quality, message timing, and integration reliability;
• Send service updates and (with your consent where required) product announcements;
• Detect, investigate, and prevent fraud or abuse of the Service;
• Comply with legal obligations.

The Company does not sell personal information for monetary value. Where applicable state law treats certain advertising arrangements as a "sale" or "share," see the California section below.

5. Sharing of Information

The Company shares personal information only with:

• Messaging infrastructure providers (SMS/email delivery services) acting as sub-processors under contractual data-processing agreements, used solely to deliver the outreach messages studio owners configure;
• Booking-system integration partners, to the extent of the read-only API access the studio owner authorizes;
• Hosting, database, and analytics providers acting on the Company's behalf under contractual confidentiality terms;
• Payment processors handling billing transactions;
• Legal authorities, when required by law or to protect rights, safety, or property;
• A successor entity in the event of a merger, acquisition, or asset sale, subject to this Policy.

The Company does not sell personal information to third parties.

6. Cookies and Tracking

The Company uses cookies and similar technologies to operate the site, maintain login sessions, and measure usage. For details and choices, see the Cookie Policy.

7. Data Retention

Studio owner account data is retained for the duration of the account and for up to 24 months after account closure, to support billing inquiries, dispute resolution, and legal obligations. Studio client contact data processed on a studio's behalf is deleted within 30 days of account closure or upon the studio owner's written request. Site visitor analytics are retained in aggregated form for up to 13 months. Server access logs are retained 90 days, then purged.

8. Security

The Company uses administrative, technical, and physical safeguards designed to protect personal information, including TLS encryption in transit, restricted-access databases, and least-privilege access controls. Integration credentials for connected booking systems are stored encrypted. No system is perfectly secure; the Company cannot guarantee absolute security.

9. Your General Rights

Depending on your jurisdiction, you may have rights including access, correction, deletion, and the ability to limit certain processing. To make a request, email [email protected]. The Company will respond within the timeframe required by applicable law.

10. California Residents (CCPA / CPRA)

Under the California Consumer Privacy Act ("CCPA") and the California Privacy Rights Act ("CPRA"), California residents have specific rights regarding personal information collected about them. This section supplements the rest of the Policy and applies to California residents who use kenkohq.org or hold a Kenko account.

10.1 Categories We Collect

In the past 12 months, the Company has collected the following categories of personal information defined under Cal. Civ. Code §1798.140: identifiers (name, email, phone, IP address); commercial information (account and billing records, service usage); internet activity (browsing on kenkohq.org and platform usage logs); professional or employment-related information (studio name, role); and inferences drawn from the above for service-improvement purposes. Because Kenko processes contact lists on behalf of studio owners, the Company also handles identifiers (name, email, phone) of studio clients as a data processor under studio-owner instruction.

10.2 Sources, Purposes, Disclosure

The Company obtains this information directly from studio owners during account creation and platform use, from connected booking systems via authorized API, and through automatic site instrumentation. The Company uses it to operate and improve the Service, deliver outreach sequences on the studio's behalf, process billing, and meet legal obligations. It is disclosed only to service providers under written contract and to legal authorities where required.

10.3 Your CCPA / CPRA Rights

• Right to Know: request the categories and specific pieces of personal information the Company has collected about you in the past 12 months.
• Right to Delete: request deletion of personal information the Company collected from you, subject to legal exceptions.
• Right to Correct: request correction of inaccurate personal information.
• Right to Opt Out of Sale or Sharing: the Company does not sell personal information; the Company does not "share" it for cross-context behavioral advertising as defined under CPRA.
• Right to Limit Use of Sensitive PI: the Company does not use sensitive personal information for purposes beyond those permitted without authorization.
• Right to Non-Discrimination: the Company will not deny services, charge different prices, or provide a different level of service because you exercised a right.

10.4 How to Exercise

Submit a verifiable request by emailing [email protected] with the subject line "California Privacy Request." Include enough detail for the Company to verify you are the person whose information is the subject of the request. The Company responds within 45 days, with a possible 45-day extension for which you will be notified.

10.5 Authorized Agents

You may designate an authorized agent to make a request on your behalf. The agent must provide proof of authorization; the Company may also require you to verify your identity directly.

10.6 "Shine the Light"

California Civil Code §1798.83 entitles California residents to request information regarding the Company's disclosure of personal information to third parties for direct marketing. The Company does not disclose personal information for third-party direct marketing.

10.7 Do Not Track and Global Privacy Control

Under the California Online Privacy Protection Act (Cal. Bus. & Prof. Code §22575), the Company discloses how it responds to "Do Not Track" (DNT) browser signals. Because there is no common industry standard for interpreting DNT signals, the Company does not currently respond differently to them. The Company does not authorize third parties to collect personally identifiable information about your activity across different websites when you use the Service. The Company honors an opt-out preference signal sent by a platform or browser that complies with the CPRA, such as the Global Privacy Control (GPC); when the Company detects a GPC signal, it treats it as a valid request to opt out of the sale or sharing of personal information for that browser or device.

11. Changes to This Policy

The Company may update this Policy from time to time. Material changes will be reflected by a new "Last updated" date and, where appropriate, a notice on the Service.

12. Contact

Questions, requests, or complaints can be sent to:

Kenko, Inc.
6255 Sunset Boulevard, Suite 720
Los Angeles, CA 90028
Email: [email protected]
Phone: +1 (323) 610-0158