Privacy Policy

BarberDesks is a cloud till (point-of-sale recording) and shop management service for barbershops and similar businesses. It is operated by Kemal Bolat trading as BarberDesks, a sole trader based at Marlborough House, E4 9AL, United Kingdom (“BarberDesks”, “we”, “us”).

You can contact us about privacy at [email protected].

BarberDesks handles personal information in two different roles:

• As a controller, for our own service: the accounts people use to sign in, keeping the service secure, our relationship with the businesses that use BarberDesks (including billing) and our emails. This policy explains that use.
• As a processor, for the records a business keeps in BarberDesks: its staff profiles, its services and prices, its sales and voids, and its tablets. The business (for example a barbershop) is the controller of those records and decides why and how they are used; we process them only to provide the service, under our Terms of Service. If you work at, or visited, a business that uses BarberDesks, that business's own privacy notice applies, and questions about its records are best sent to it first. We will help it answer them.

Account information. Your name, your email address and whether it is confirmed, and your password, which we store only as a one-way hash (Argon2id), never in a form we can read. If you sign in with Google, see section 5.

Business information. When you create a business: its name, type of business, country, currency and time zone, and its location. Who has access to it and in which role (owner, manager or staff), and invitations sent to people's email addresses.

Staff information. The names a business gives its staff profiles, whether each is active, and, for staff who have their own login, the account details above.

Sales and till records. For each sale: the time, the staff member, the services and prices, the total and whether it was paid in cash or by card. When a price was changed for that one sale, the record also keeps the standard price, the price charged, any note given and which owner or manager approved it. Voids are kept with who made them, when and the reason given. These records are the business's (see section 2). BarberDesks does not ask for the names or details of a business's own customers, and it never receives card numbers: card payments are taken on the business's own card machine, and BarberDesks only records that a sale was paid by card.

Customer receipts. A business can email its customer a receipt for a sale. The email address typed is used only to send that receipt, through our email delivery service provider, acting for the business (section 2). It is not saved with the sale or anywhere else in BarberDesks, and it is not used for anything else. To stop the feature being misused to send unwanted email, we keep a keyed one-way code derived from the address, which cannot be turned back into it, for up to 24 hours to limit how many receipts are sent to it. We record that a receipt was sent for a sale, by which till or person, but not to whom.

Approval PINs. An owner or manager can set a personal 4-digit PIN to approve a changed price on a till. It is stored only as a salted, keyed one-way hash, never in a form we can read, and is never shown again. Failed attempts are recorded, with the till they came from, to stop guessing.

Shop tablets. A name for each paired tablet, its location and when it was last used. A paired tablet holds a device credential in a cookie (section 9).

Security and technical information. When you sign in: your session, the IP address and browser (user agent) it came from, and a record of security events such as sign-ins, failed sign-ins, password resets and changes of access. To stop abuse, we count attempts per IP address and per email address for a short time, and our security records include the email address typed in a failed sign-in or a password reset request. Our servers also keep short technical logs to run and fix the service. We do not use analytics, advertising or tracking tools.

Billing information. If a business takes a paid plan, its payment is handled by Stripe (section 7). We keep the plan, the subscription's status and Stripe's reference numbers; we never see or store full card details.

Emails and support. The emails we send you (section 6), and anything you send us when you ask for help.

Under UK data protection law (the UK GDPR and the Data Protection Act 2018):

• To provide BarberDesks (accounts, sign-in, businesses, staff access, the till, sales history, plans and billing): this is necessary for our contract with you or with the business you belong to.
• To keep BarberDesks secure (sessions, security records, rate limits, preventing misuse, backups and investigating problems): our legitimate interest in protecting the service, our users and their businesses.
• To send service emails (confirming your address, password resets, invitations, security notices and important changes): necessary for our contract, and our legitimate interest in keeping accounts secure.
• To meet legal obligations, such as keeping billing records or responding to lawful requests.
• For a business's own records (section 2): we act on the business's instructions; the business decides its own lawful basis.

We do not sell personal information, do not use it for advertising and do not make decisions about you by automated means that have legal or similarly significant effects.

If you choose “Continue with Google”, Google tells us your name, email address, whether Google has verified it, your Google profile picture address and an identifier for your Google account. We use these only to sign you in and to keep your account details; we ask Google for nothing else, and we do not read your Google data, contacts or files. Google's own use of your information is covered by Google's Privacy Policy.

We only connect Google to an existing BarberDesks account when both Google and BarberDesks have confirmed the same email address. Google's sign-in tokens are stored encrypted and are not used for anything after you have signed in.

We send emails that the service needs: confirming your address, password resets, invitations to join a business, notices about your account's security and important changes to the service or these documents. A business can also send its customer a receipt (section 3), for which the customer's address is used only to send it. We do not send marketing emails. Emails are delivered for us by an email delivery service provider, which handles your email address and the message on our behalf.

We share personal information only with service providers who process it for us under contract, and only as needed:

• DigitalOcean: provides the hosting and database infrastructure that runs BarberDesks and stores its data.
• Backblaze: stores our encrypted database backups, in its EU (Central) region.
• An email delivery service provider: sends our emails (section 6).
• Stripe: takes payment for paid BarberDesks plans and provides the billing portal. Stripe is the controller of the payment details you give it; see Stripe's Privacy Policy.
• Google: only if you choose to sign in with Google (section 5).

Within a business, the people the business gives access to (owners and managers, and staff for their own records) can see that business's records. We may also disclose information where the law requires it, to protect people from harm, or to a buyer of our business, who would have to keep protecting it as this policy says.

Some of our providers, including DigitalOcean, Stripe, Google and Backblaze, are based in, or may access data from, countries outside the UK, including the United States. Our backups are stored in Backblaze's EU (Central) region. Where personal information is transferred outside the UK, we rely on UK adequacy regulations (for example the UK Extension to the EU–US Data Privacy Framework, for providers certified under it) or on safeguards approved under UK law, such as the International Data Transfer Agreement or Addendum, in our providers' data processing terms.

BarberDesks uses only what it needs to work. We use no analytics or advertising cookies.

• Session cookie (__Host-bd.session_token): keeps you signed in, for up to 30 days of activity.
• Tablet cookie (__Host-bd.device): only on a paired shop tablet, so it stays connected to its business.
• Short-lived cookies: one protects a Google sign-in while it is in progress, and one carries a single message (such as “Sale voided”) to the next page.
• Local storage (bd.theme): remembers the Light, Dark or Automatic theme you chose on that device. It never leaves your device.

These are strictly necessary for the service you asked for, so they do not need your consent. Blocking them will stop sign-in or the till from working.

• Accounts: while your account exists. You can ask us to delete it (section 12).
• Sessions: until you sign out, or 30 days after you were last active.
• A business's records (sales, voids, staff and services): while the business uses BarberDesks. Sales records are never altered after the event, because businesses rely on them for their accounts and tax. When a business closes its account, we delete or return its records as it asks, unless the law requires us to keep them.
• Security records and technical logs: as long as needed to protect the service and investigate misuse.
• Billing records: as long as the law requires us to keep them.
• Backups: encrypted copies of the database expire automatically, the oldest after about three months, so deleted information can remain in a backup until then.

We use measures appropriate to the information we hold, including: encrypted connections (HTTPS); passwords stored only as strong one-way hashes; separate permissions for owners, managers and staff; database rules that keep each business's records separate from every other business's; limits on repeated sign-in attempts; encrypted, off-site backups; and a record of security-relevant actions.

No service can promise perfect security. If a personal data breach affects you and is likely to put your rights at risk, we will tell you and, where required, the ICO.

You have the right to ask for a copy of your personal information, to have it corrected, to have it deleted, to restrict or object to how we use it, and to receive it in a portable form. Some rights have limits (for example, where we must keep records by law). Write to [email protected]. We will reply within one month, and we may need to confirm who you are first.

For a business's own records (section 2), please contact that business; we will help it respond.

If you are unhappy with how we have handled your information, please tell us first at [email protected]. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint, or 0303 123 1113.

BarberDesks is a business tool for adults. It is not intended for anyone under 18, and we do not knowingly create accounts for them.

We may update this policy when the service or the law changes. The “Last updated” date at the top shows the current version. If a change is significant, we will tell account holders by email or in the app before it takes effect.

Kemal Bolat trading as BarberDesks, Marlborough House, E4 9AL, United Kingdom. Email: [email protected].