Privacy policy

Barbeo is the controller for business accounts (owners and team), the contact form and the website. Contact: info@barbeo.fit.

Each shop's client data (bookings, contact details, history) is handled by the shop as controller; Barbeo processes it on the shop's behalf, as processor, under the Data processing agreement. To exercise your rights over that data you can contact the shop or Barbeo, which will pass the request on.

• Account: name, email, phone, password (stored hashed, never in plain text), language, when the email was confirmed and these terms accepted.

• Business: name, addresses, services, prices, opening hours, team, page images and texts, plan and subscription status (card details are handled by Stripe and never reach Barbeo).

• Shops' clients: name, email and/or phone, bookings, notes, communication preferences and, if the shop uses them, birthday, loyalty, packages and vouchers.

• Technical: access logs, IP address (stored hashed when used to limit abuse) and logs of emails sent.

• Contact: whatever you write in the contact form.

• Providing the service, managing accounts, bookings and reminders: performance of the contract.

• Charging the subscription and meeting tax obligations: contract and legal obligation.

• Security, abuse prevention (for example limiting login attempts) and improving the service: legitimate interest.

• Shops' marketing emails to their clients: consent or an existing client relationship, always with an unsubscribe option.

• Answering contact requests: steps at your request and legitimate interest.

We don't sell data. We use these processors, under contracts that protect the data:

• Deno Land Inc. (Deno Deploy): application hosting, EU region.
• Prisma Data Inc. (Prisma Postgres): database, EU region (Frankfurt).
• Resend Inc.: sending transactional emails.
• Stripe Payments Europe Ltd.: payment of the Barbeo subscription (only the subscribing business's data).
• Google Ireland Ltd. (Google Workspace): our support email.
• OpenAI Ireland Ltd.: only if the business uses AI branding (the shop's details and images, never client data).

Some are US companies; those transfers are covered by the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

For as long as the account is active. When a business account is closed, its data and its clients' data are deleted within 30 days, except what the law requires us to keep (for example, billing data for 10 years). Contact messages are kept up to 2 years. Technical logs are kept up to 12 months.

You can ask for access, rectification, erasure, restriction or portability, object to processing, and withdraw consent at any time by writing to info@barbeo.fit. We reply within 30 days. You can also complain to the Portuguese data protection authority, CNPD (www.cnpd.pt).

We only use essential cookies: one to keep you logged in and one to remember your language. We don't use third-party advertising or analytics cookies, so we don't ask for cookie consent.

Always-encrypted connections (HTTPS), hashed passwords, sessions with secure cookies, access restricted by business and role, email confirmation for new accounts and a limit on login attempts.

If we change this policy materially, we'll let you know by email or in the back office. The date of the current version is at the bottom of this page.