Privacy Policy

1. Who we are

barber.box is a Portuguese platform where you find barbershops and book a slot, and where owners run their schedule, services and team. The person who decides what data is collected and why, the controller in RGPD terms, is:

Hugo Abreu, a private individual resident in Portugal. There is no company behind barber.box.

For anything to do with your data, write to [email protected].

We have no data protection officer. Article 37 of the RGPD requires one only of public authorities, of organisations whose core activity is large-scale regular and systematic monitoring of people, and of those processing special categories of data at large scale. A barbershop directory with bookings is none of those. Privacy questions are handled at the address above.

2. What we collect

It depends on what you do on barber.box. We collect the minimum the service needs to work.

If you book as a customer

Name, email and, if you give it, a phone number. Your Google or Apple account id. Your bookings, with barbershop, barber, service, date, time, status, price and any note you write. The ratings and comments you leave after a booking. Payments made in the app. Your language preference. If you turn notifications on, your device push token.

If you own a barbershop

The same account data, plus the details of the shop you run: name, address, contacts, opening hours, services, prices, photos and team. If you subscribe to a plan, we store the Stripe subscription identifiers, its status and its renewal date.

If you are staff at a barbershop

Account data and your barber profile: name, photo, the shop you belong to and your schedule. When you take a walk-in, you can type that person's name and phone onto the booking.

If you only visit the site

We create no account and no profile, and we do not follow you from page to page. Our servers log ordinary technical requests, such as IP address and browser type, to serve the pages and stop abuse.

We store no password. Sign-in goes through Google or Apple, so we never see your credentials.

3. Where it comes from

Data reaches us in five ways:

• From you: what you type in the app when you create an account, book, review or fill in your barbershop's details.
• From Google, when you sign in with a Google account: the account id, the email, confirmation that the email is verified, your name and your profile picture.
• From Apple, when you sign in with an Apple account on iPhone: the account id and the email. The name comes through only the first time you allow it.
• From Stripe, when you pay: the payment status, the method used and the transaction id. Card details are handled by Stripe.
• From public establishment sources, for the directory pages. The barbershop listings section explains this in full.

4. Why we use it

Every use has a specific purpose and a lawful basis, which is the reason the RGPD lets us process that data.

Running accounts and bookings

Creating and keeping your account, showing availability, recording and confirming bookings, connecting customers to barbershops and telling you about changes. Lawful basis: performance of a contract.

Taking payments and subscriptions

Processing payment for services and the barbershop owner's subscription, handling refunds and resolving disputes. Lawful basis: performance of a contract.

Invoicing and tax duties

Keeping the transaction records Portuguese law requires us to keep. Lawful basis: compliance with a legal obligation.

Maintaining the barbershop directory

Publishing and keeping current a complete list of barbershops in Portugal, with establishment facts. Lawful basis: legitimate interest in a useful and complete directory.

Showing reviews

Publishing on the shop's page the rating and comment you leave after a booking, with your first name. Lawful basis: legitimate interest in showing only real reviews, from people who were actually there.

Security and abuse prevention

Spotting fake accounts, fraudulent bookings and abuse of the service, and protecting the site from attacks. Lawful basis: legitimate interest in keeping the platform safe.

Phone notifications

Telling you about confirmations, reminders and changes to your bookings. Lawful basis: consent, given when you allow notifications on the device, and which you can withdraw at any time.

We do not use your data for advertising, for behavioural profiling, or for automated decisions that affect you.

5. Who we share it with

We share only what is needed, and only with the parties that make part of the service work:

• The barbershop you book. It sees your name, your contact and the booking details, so it can serve you. The shop is responsible for what it then does with that data in its own business.
• Google: sign-in. It confirms your identity and returns basic profile data to us.
• Stripe: payments and subscriptions. It handles card, MB WAY and Multibanco and stores the transaction data. For the Studio subscription Stripe acts as merchant of record: there it does not act on our instructions, it is a controller in its own right and its own privacy terms apply.
• A notification delivery service. Your device token is sent to it so the message reaches your phone.
• A content delivery network in front of the site. It sees requests to the site in order to serve them fast and block attacks.

The servers and their backups sit inside the European Union. There is no transfer outside the EU for the hosting itself. Server access logs are kept for 30 days.

We do not sell your data and we do not hand it over for advertising. Beyond the providers above, we release data to authorities only when the law requires it.

6. Data outside the EU

Google and Stripe, and some of the other providers we use, are based in the United States, so some data may be processed outside the European Union.

Those transfers rest on the Standard Contractual Clauses approved by the European Commission, in the version that matches each company's role, and which bind them to protect your data to an equivalent European standard. You can ask us for a copy of those safeguards by email.

Some of these providers are also certified under the EU-US Data Privacy Framework, the European Commission's adequacy decision for the United States. Today that covers Google and Stripe; others rely on the Standard Contractual Clauses alone. A certification can lapse or be withdrawn, so we check each one once a year, and the Standard Contractual Clauses hold either way.

7. How long we keep it

We keep each kind of data only for as long as it is useful, or as long as the law requires.

Account and profile

For as long as the account exists. When you ask for deletion, we remove the account data, except the records the law requires us to keep.

Bookings and payments

10 civil years counted from the end of the year of the transaction. That is the period the Código do IVA, article 52.º(1), sets for invoices and their supporting documents. It is why a booking and its payment survive account deletion, by then with nothing identifying you attached to them.

Reviews

They stay published for as long as the barbershop is in the directory. You can ask for yours to be removed at any time.

Push token

Deleted when you sign out or when you turn notifications off.

Session and access token

They expire on their own. Signing out deletes them from the phone or the browser.

Notifications received

They stay in the account history for as long as the account exists.

Directory listings

For as long as the barbershop exists. We remove a listing as soon as the owner asks, or as soon as we learn the shop has closed.

Server technical logs

The servers and their backups sit inside the European Union. There is no transfer outside the EU for the hosting itself. Server access logs are kept for 30 days.

8. Your rights

The RGPD gives you these rights, and each one has a concrete route here:

• Access: ask for a copy of your data at barber.box/en/data-request and we gather everything we hold against your account.
• Rectification: name, email and phone are editable in the app, under Account. Barbershop details are editable in the Studio app.
• Erasure: ask for account deletion at barber.box/en/data-request. We delete everything we are not legally required to keep.
• Portability: through the same route, ask for your data in a structured format you can take to another service. We put the answer together by hand, request by request.
• Objection: you can object to the processing that rests on legitimate interest, including your barbershop's directory listing. Write to [email protected].
• Withdrawing consent: turn notifications off in your phone settings. We stop sending and delete the token.
• Restriction: you can ask us to freeze your data while we work through a dispute.

We answer any of these within one month, extendable to three months when the request is complex, at no cost. If we need to confirm it is really you, we ask for the minimum needed to do that.

9. Barbershop listings

The site publishes a page for every barbershop in Portugal, including shops that never signed up to barber.box. That data did not come from the shop. It came from publicly available sources of business information.

We publish it on the basis of a legitimate interest in maintaining a complete directory of Portuguese barbershops, which serves people looking for a barber and gives the business a presence at no effort to it. For a sole-trader barbershop the contact number can be personal data and, because it was not collected from the person themselves, this section is the information the RGPD requires us to give in that case.

On an unclaimed page we show:

• The establishment's name.
• Address and location on the map.
• Opening hours.
• Phone number and business category.

And we protect that data as follows:

• The phone number appears only after you click to reveal it.
• We do not republish reviews, ratings or photos from those sources.
• We invent no services and no prices. An unclaimed page carries no price list at all.

If the barbershop is yours, you can claim the page in the Studio app and take control of it: correct the address, hours and contact, and add services, prices and team.

If you do not want it listed, write to [email protected] or use barber.box/en/data-request, with the establishment's name and address. We take the page down. We also correct anything wrong, or remove just the phone number, if that is what you prefer. We ask for no justification and you need no account.

10. Cookies

The site uses a single cookie: the session cookie that keeps you signed in after you log in. It is strictly necessary for the service to work.

• We use no analytics, on the site or in the apps.
• We use no advertising, tracking pixels or ad networks.
• There is no third-party JavaScript on the public pages.

Because there is no tracking, we do not ask for cookie consent. There is no banner because there is nothing to accept or refuse.

The apps use no cookies. The session token and the cached account data are kept in the phone's secure operating-system storage and are deleted when you sign out.

11. Notifications

If you allow notifications, your phone's operating system issues a token for your device, a kind of delivery address. We store that token against your account and send it to the service that delivers the message.

The token says nothing about who you are or where you are. It exists only so the message reaches the right device.

You can withdraw the permission whenever you want, in your phone settings. The token is deleted when you sign out.

12. Age

barber.box is for people aged 16 and over. We do not create accounts for anyone younger, and we do not knowingly collect their data.

If you know of an account belonging to someone under 16, write to [email protected] and we delete the account and the data attached to it.

13. Contact and complaints

For anything about personal data, write to [email protected]. For everything else, [email protected]. We answer in Portuguese or English.

If you think we handled your data badly, tell us first. We try to put it right.

You also have the right to complain to the Portuguese supervisory authority: Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, [email protected], www.cnpd.pt.

14. Changes

When we change this policy in any material way, we announce it in the app before the change takes effect.

The update date shown at the top of this page is the one that counts: if it moved, the policy moved. You can ask us by email for the previous version.