Privacy policy

Who is responsible

For shop accounts (barbershops and salons) and this website: Raymond Paul Otto, Lukasstraße 17, 89081 Ulm, Germany, otto.ray@gmail.com.

For a shop’s client data (name, contact, photos, cut details), the shop is responsible. We process that data only on the shop’s behalf (as a processor under Art. 28 GDPR) and only to provide the service.

What data we process

Shops: email address, password (stored only as a secure hash), the shop’s name, logo, colour, phone, address and booking link, and offers.

A shop’s clients: name, mobile number and/or email, up to three photos per cut, cut details, notes, who did the cut, and the two consents (saving and sharing the cut; reminders and offers) with the time given.

Technical: when the site is visited, our hosting providers process the IP address, time and page requested in server logs to run the service securely.

Why, and on what legal basis

Shop accounts: to perform the contract of use (Art. 6(1)(b) GDPR).

Client data: on the basis of the client’s consent, which the shop collects when saving the cut (Art. 6(1)(a) GDPR). Consent can be withdrawn at any time with the shop, which then deletes the client and all their photos.

Server logs: legitimate interest in operating securely (Art. 6(1)(f) GDPR).

Who sees the data

Only the shop sees its clients’ contact details. A client’s page can only be reached through its unguessable link and shows the name, photos, cut details and shop information, never the phone number or email.

Service providers: Supabase (database, logins, photo storage; servers in Frankfurt, EU) and Vercel (website hosting; Vercel Inc., USA, under EU Standard Contractual Clauses). WhatsApp messages are sent by the shop itself from its own WhatsApp app.

How long

Client data is kept until the shop deletes it, for example at the client’s request. Shop accounts are kept until the shop asks for deletion. Server logs are deleted automatically after a short time.

Cookies

We only use strictly necessary cookies: to keep shops logged in and to remember the chosen language. There are no advertising or analytics cookies.

Your rights

You have the right to access, correction, deletion, restriction, data portability and objection (Art. 15–21 GDPR), and to withdraw consent. A shop’s clients are best served by contacting the shop directly, but you can also contact us.

You can complain to a data protection supervisory authority.