Privacy Policy
This policy sets out what personal data barber.box collects, the purposes for which it is used, who it is disclosed to, and the rights available to the User. It covers the barber.box website, the barber.box app and the Studio app.
Last updated: 8 October 2026
The controller
barber.box is a Portuguese platform on which barbershops are found and appointments are booked, and on which owners manage the schedule, the services and the team. The controller, within the meaning of the RGPD, is:
Hugo Abreu, a private individual resident in Portugal.
Any matter concerning personal data should be addressed to [email protected].
No data protection officer has been appointed. Privacy questions are handled at the address given above.
Data collected
The data collected depends on the use made of barber.box and is limited to what the service needs in order to work.
- Customers who book
- Name, email address and, where provided, phone number. The Google or Apple account identifier. Bookings, with barbershop, barber, service, date, time, status, price and any notes entered. Reviews and comments left after a booking. Payments made in the app. The preferred language. Where notifications are enabled, the device push token.
- Barbershop owners
- The same account data, together with the details of the barbershop managed: name, address, contact details, opening hours, services, prices, photographs and team. Where a plan is subscribed, the Stripe subscription identifiers, its status and the renewal date are retained.
- Barbershop staff
- Account data and the barber profile: name, photograph, the barbershop the barber is attached to and the corresponding schedule. When recording a walk-in booking, staff may enter the customer's name and phone number on that booking.
- Site visitors
- No account or profile is created and visitors are not tracked from page to page. The servers log ordinary technical requests, in order to serve the pages and prevent abuse.
No passwords are stored. Sign-in is carried out through Google or Apple, so barber.box has no access to the User's credentials.
Where the data comes from
The data has five sources:
- The User: the information entered in the app when creating an account, booking, reviewing or completing the barbershop's details.
- Google, on sign-in with a Google account: the account identifier, the email address, confirmation that the address is verified, the name and the profile photograph.
- Apple, on sign-in with an Apple account: the account identifier and the email address. The name is returned only on the first authorisation.
- Stripe, on payment: the status of the payment, the method used and the transaction identifier. Card details are handled by Stripe.
- Public sources of establishment information, for the directory pages, as set out in the section on barbershop listings.
Purposes and lawful bases
Each use corresponds to a specific purpose and to a lawful basis provided for in the RGPD.
- Managing accounts and bookings
- Creating and maintaining the account, showing availability, recording and confirming bookings, connecting customers to barbershops and communicating changes. Basis: performance of the contract.
- Collecting payments and subscriptions
- Processing payment for services and the subscription taken out by barbershop owners, handling refunds and resolving disputes. Basis: performance of the contract.
- Invoicing and tax obligations
- Retaining the transaction records that Portuguese law requires to be kept. Basis: compliance with a legal obligation.
- Maintaining the barbershop directory
- Publishing and keeping current a complete list of the barbershops in Portugal, with facts about the establishment. Basis: legitimate interest in maintaining a complete directory.
- Publishing reviews
- Publishing on the barbershop's page the rating and comment left after a booking, together with the author's first name. Basis: legitimate interest in publishing reviews from people who actually attended the establishment.
- Security and abuse prevention
- Detecting false accounts, fraudulent bookings and abuse of the service, and protecting the site from attack. Basis: legitimate interest in keeping the platform secure.
- Push notifications
- Communicating confirmations, reminders and changes to bookings. Basis: consent, given when notifications are accepted on the device and withdrawable at any time.
The data is not used for advertising, for behavioural profiling, or for automated decisions producing effects concerning the User.
Data outside the EU
Some of the recipients above, including Google and Stripe, are based in the United States, so some data is processed outside the European Union.
Those transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the provider is certified, and on the Commission's Standard Contractual Clauses otherwise. The User may request a copy of these safeguards by email.
Retention periods
Each type of data is retained only for as long as it serves the purpose that justifies it, or for as long as the law requires.
- Account and profile
- For as long as the account exists. Where deletion is requested, the account data is removed, save for the records the law requires to be kept.
- Bookings and payments
- 10 civil years counted from the end of the year of the transaction, the period the Código do IVA, article 52.º(1), sets for invoices and their supporting documents. It is why a booking and its payment survive account deletion, by then with no identifying element attached.
- Reviews
- They remain published for as long as the barbershop appears in the directory. Removal may be requested at any time.
- Push token
- Deleted when the session ends or when notifications are switched off.
- Session and access token
- They expire automatically. Ending the session deletes them from the phone or the browser.
- Notifications received
- They remain in the account history for as long as the account exists.
- Directory listings
- For as long as the barbershop exists. The page is removed at the owner's request, or once the closure of the establishment becomes known.
- Server technical logs
- They record the method, the path, the status and how long the request took, and nothing else. They contain no element identifying the User.
Rights of the User
The RGPD confers the following rights, and each has a concrete route here:
- Access: a copy of the data is requested at barber.box/en/data-request, and everything held against the account is gathered.
- Rectification: name, email address and phone number are changed in the app, under Account. Barbershop details are changed in the Studio app.
- Erasure: deletion of the account is requested at barber.box/en/data-request. Everything the law does not require to be kept is deleted.
- Portability: by the same route, the data is provided in a structured format that can be taken to another service.
- Objection: the User may object to processing that rests on legitimate interest, including the listing of their barbershop in the directory, by writing to [email protected].
- Withdrawal of consent: notifications are switched off in the phone's settings. Sending stops and the token is deleted.
- Restriction of processing: the User may request that processing be restricted while a dispute is being considered.
Any of these requests is answered within one month, extendable to three months where the request is complex, and free of charge. Where the identity of the requester has to be confirmed, only the minimum needed for that purpose is asked for.
Barbershop listings
The site publishes a page for every barbershop in Portugal, including shops that never signed up to barber.box. That data did not come from the shop. It came from publicly available sources of business information.
Publication rests on the legitimate interest in maintaining a complete directory of Portuguese barbershops. For a sole-trader barbershop the contact number can be personal data, and it was not collected from the person it belongs to.
An unclaimed page shows:
- The name of the establishment.
- The address and the location on the map.
- The opening hours.
- The phone number and the business category.
That data is protected as follows:
- The phone number is shown only after a click to reveal it.
- Reviews, ratings and photographs from those sources are not republished.
- Services and prices are never invented. An unclaimed page shows no price list at all.
The owner of the establishment may claim the page in the Studio app and take control of it, correcting the address, hours and contact details and adding services, prices and team.
Where the listing is not wanted, the request is sent to [email protected] or made at barber.box/en/data-request, with the name and address of the establishment, and the page is removed. Anything incorrect is likewise corrected, or the phone number alone removed, where that is preferred. No justification and no account is required.
Notifications
Once notifications are accepted, the phone's operating system issues a token for the device, which works as a delivery address. That token is retained on the account and transmitted to the service that delivers the message.
The token does not identify the User and does not indicate their location. It serves only to bring the message to the right device.
Permission may be withdrawn at any time, in the phone's settings. The token is deleted when the session ends.
Age
barber.box is intended for people aged 16 or over. Accounts are not created for anyone below that age and their data is not knowingly collected.
The existence of an account held by someone under 16 should be reported to [email protected], and the account and associated data are deleted.
Contact and complaints
Questions about personal data are addressed to [email protected]. All other matters, to [email protected]. Replies are given in Portuguese or in English.
Where the User considers that their data has been mishandled, raising it with barber.box first will as a rule resolve the matter.
There is also a right to complain to the Portuguese supervisory authority: Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, [email protected], www.cnpd.pt.
Changes
Material changes to this policy are notified in the app before they take effect.
The updated date shown at the top of this page governs: if that date has changed, the policy has changed. The previous version may be requested by email.