Privacy policy

1. Two roles

For the data of the people who use BarbOS on behalf of a business — owners, managers, staff — and of visitors to this site, BarbOS decides how the data is used. In the law's words, we are the controller.

For the data of a shop's own customers — their name, phone, e-mail, bookings and visits — the shop decides, and BarbOS handles that data only on the shop's instructions. The shop is the controller; we are its processor (LGPD: operador).

2. What we hold

About a business and its team: the business's name and address, the names and e-mail addresses of its users, staff names and PINs (stored only as a one-way hash), and what each person did in the product.

About a shop's customers, on the shop's behalf: name, phone number, e-mail address, bookings, visits, reviews, notes the shop wrote, and the messages sent to them about their bookings.

About a customer who creates a booking account: the e-mail address or phone number they sign in with, and their bookings across shops.

About visitors to this site: what the contact form says, usage measurements as described under cookies, and the internet address of a request our protections refused.

We do not hold card numbers. Card payments are handled by the shop's own payment provider.

3. Why we use it

To provide the service a business signed up for (performance of a contract); to keep the service secure and find faults (legitimate interest); to send a customer the messages about a booking they made (performance of the booking, on the shop's behalf); to meet legal duties; and, only with consent, to measure how this site is used.

We do not sell personal data, and we do not use a shop's customers' data for our own advertising.

4. Who helps us

We use other companies to run the service, each handling data only for that purpose: hosting of the application (Fly.io) and of the database (Supabase), both in the European Union; e-mail delivery (Resend); WhatsApp delivery (Z-API); error monitoring (Sentry); site measurement (Google Analytics, only after consent, and Umami, which keeps no cookie and no identifier); sign-in with Google, when a customer chooses it; and the shop's own card provider (SumUp), under the shop's own contract.

We tell businesses before adding a provider that handles their customers' data.

5. Cookies and measurement

The product uses the cookies it needs to work: the session that keeps you signed in, your language and your theme. These do not need consent.

Google Analytics is loaded on this site only after you accept it, and you can refuse. Umami counts visits without a cookie and without identifying you.

6. Where the data is

The database is in the European Union. Some of the providers above are in other countries, including the United States and Brazil; where data leaves the European Economic Area or Brazil, it travels under the safeguards the law requires, such as standard contractual clauses.

7. How long we keep it

A business's data is kept while its account exists and deleted within 90 days after it ends, unless the law requires longer. Sales records are kept as the business's legal duties require.

A customer's booking account is deleted when they ask; the shops they visited keep their own record of the visits, which is theirs to keep or delete.

Sign-in codes last minutes; sessions last at most 30 days from the last visit.

When one of our protections refuses a request — for example, too many in a minute, or too many failed sign-ins — the internet address it came from is kept for 7 days, to keep the service secure.

8. Your rights

You can ask to see the data held about you, to correct it, to delete it, to receive a copy, to object to its use or to limit it, and you can withdraw a consent you gave. You can also complain to your data protection authority — in Ireland the Data Protection Commission, in Brazil the ANPD.

If you are a shop's customer, ask the shop first: it decides about your data, and we help it answer. A booking account can be deleted from its own page at any time.

For everything else, write to us at contact@barbos.ie. We answer within 30 days.

9. Changes

When this policy changes in a way that matters, we tell the owners of the businesses by e-mail and show the new version here with its date.