Privacy policy

Barbertab is a booking and client-management service for barbershops, run as a sole trader business in England. It is not a limited company.

If you want to ask us anything about this policy, email support@barbertab.com.

Most of this page is written for the shops that use Barbertab. If you followed a link from a booking page, this part is for you.

• The shop you booked with holds your details and decides what happens to them. They are the ones responsible for your record.
• Barbertab is the booking system they use. We hold the data on their behalf and only do what they ask us to with it.
• Your name, number and email are used to manage your appointment and to send you a confirmation, a reminder, and a message if the shop cancels or moves it. That is all.
• We do not use your details to market anything to you, and we do not sell them or pass them to advertisers.

To see, correct or delete what is held about you, ask the shop — they control your record and can do all of it from their dashboard. If you cannot get hold of them, email us and we will help.

Every confirmation email carries a private link to your booking, which you can use to change or cancel it without an account.

This is the important distinction, and it decides who is responsible for what.

• Your shop's data — your name, email, shop details and billing. We decide how this is used, so for this data we are the data controller.
• Your clients' data — the names, numbers, emails, appointments and notes you keep about the people who sit in your chair. You decide what goes in and why, so for this data you are the controller and we are your processor. We only handle it to run the service for you.

That means your clients' rights requests come to you, not to us, and we will help you answer them.

• Your name, email address and password (stored hashed, never in readable form).
• Your shop name, address, opening hours, services and prices.
• Your subscription tier, how many barbers you have, and billing records.
• Basic technical data when you use the app: IP address, browser, and pages visited, so we can keep it working and secure.

You choose what to keep. Typically that is a name, a phone number, an email address, appointment history and any notes you write. Keep notes professional and relevant — anything about someone's health counts as special category data under UK GDPR and needs a stronger justification, so it is better left out.

You are responsible for having a lawful basis to contact your clients, including for appointment reminder texts.

• Running your account and your public booking page.
• Taking deposits and subscription payments.
• Sending appointment reminders and cancellation notices on your behalf.
• Support, security, fraud prevention and keeping the service up.
• Telling you about changes to the service. We will not use your clients' details to market anything to them.

Our lawful bases are performing our contract with you, our legitimate interest in running and securing the service, and consent where we ask for it.

We use a small number of sub-processors, each for one job:

• Supabase — the database your shop's and clients' records live in.
• Vercel — hosting and delivery of the app.
• Stripe — subscription billing and client deposits.
• Twilio — sending appointment reminder texts.
• Resend — sending transactional email such as verification and receipts.

That is the whole list. We run no analytics, no advertising tags and no session recording of any kind. We do not sell your data or your clients' data, and we never pass it to advertisers.

One other shop may see a little about you: if you signed up with another barbershop's invite link or code, that shop sees your shop's name and whether you have started paying, because that is what earns them their referral reward. They see nothing else about your account or your clients.

Your shop's records and your clients' records are stored in the United Kingdom — the database runs in London, and so does the application that reads it. Nothing about an appointment leaves the UK in the ordinary course of using the service.

Three of our suppliers are organisations that operate internationally: Stripe, Twilio and Resend. Where any of them processes data outside the UK, that transfer relies on the UK International Data Transfer Addendum or on an adequacy decision for the country concerned.

Your shop's data is kept while your account is open and for 90 days after you close it, then deleted. The 90 days exist so that closing an account by mistake, or changing your mind, is recoverable rather than final.

You can export or delete your client records at any time from your settings, including before you close the account. Billing records are kept for six years, because HMRC requires it, and that is the one thing a deletion request cannot reach.

Under UK GDPR you can ask us for a copy of your data, ask us to correct or delete it, object to how we use it, or ask us to restrict it. Email us and we will answer within one month.

If you are a client of a shop that uses Barbertab rather than a shop owner, please contact the shop directly — they control your record. If you cannot reach them, we will help.

We use cookies that are strictly necessary to keep you logged in and to keep the service secure, and nothing else. That is why you have not been asked to accept anything: under PECR, strictly necessary cookies are the only ones that need no consent, and they are the only ones we set.

Tell us first — support@barbertab.com — and we will try to put it right. If you are still unhappy you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

If we change anything significant we will email you before it takes effect. The date at the top always shows the current version.