Privacy Policy

Barbify (“Barbify”, “we”, “us”, “our”) is the data controller for personal data collected through the Barbify platform. We are based in Dublin, Ireland.

Where barbers use Barbify to manage their clients’ appointment data, the barber acts as an independent data controller for their clients’ data, and Barbify acts as a data processor on their behalf under Art. 28 GDPR.

2.1 Barbers (B2B — Platform Users)

• Account data: full name, email address, phone number, business name, subdomain.
• Profile data: profile photo, hero banner, bio, service list, pricing, operating hours, address, social media links.
• Payment data: subscription billing is handled by Stripe — Barbify does not store card numbers. We store Stripe customer ID and subscription status.
• Communication data: email logs (recipient address, subject line) retained for 90 days.
• Login records: hashed email, IP address, user-agent retained for 30 days for fraud detection.
• Signup attribution: how you found us — an optional self-reported channel, campaign parameters (UTM source/medium/campaign) from the link you arrived through, and your country (country-level only, derived from Cloudflare; we do not store the IP address). Recorded once at signup to understand which channels work.

2.2 Booking Clients (B2C — End Users)

• Booking data: name, email address, phone number, selected service, appointment date/time.
• Account data (self-registered clients): name, email, phone, bcrypt-hashed password, consent timestamp.
• WhatsApp messages: inbound message content retained for 90 days.
• Consent records: T&C version accepted, timestamp of acceptance, and — where the client opted in — the timestamp at which they asked to be emailed about newly available appointment times.

2.3 Website Visitors (barbify.ie)

• Analytics data (with consent only): page views, session duration, referral source — collected via Google Analytics 4. Never collected without your explicit consent.
• Marketing data (with consent only): visit data for ad attribution — collected via Meta Pixel. Never collected without your explicit consent.
• IP addresses are processed by Cloudflare for DDoS protection and routing. Cloudflare’s privacy policy applies.

We share personal data with the following processors, each governed by a Data Processing Agreement. Where processors are based in the United States, transfers are covered by Standard Contractual Clauses (SCCs) under Art. 46(2)(c) GDPR.

Under Articles 15–22 of the GDPR, you have the following rights:

• Access (Art. 15) — Request a copy of all personal data we hold about you.
• Rectification (Art. 16) — Request correction of inaccurate or incomplete data. Registered clients can update most data directly in their account settings.
• Erasure (Art. 17) — Request deletion of your personal data. Registered clients can initiate self-deletion via their account settings. We will respond to other deletion requests within 30 days.
• Data Portability (Art. 20) — Receive your data in a structured, machine-readable format (JSON). Registered clients can download their data via account settings.
• Restriction (Art. 18) — Request that we pause processing of your data in certain circumstances.
• Objection (Art. 21) — Object to processing based on legitimate interests. We will cease unless we can demonstrate compelling legitimate grounds.
• Withdraw Consent (Art. 7(3)) — Withdraw any consent you have given at any time. This does not affect the lawfulness of processing before withdrawal. You can withdraw analytics consent using the cookie preference banner.

To exercise any right, email info@barbify.ie with the subject line “GDPR Request — [Right]”. We will respond within 30 calendar days as required by Art. 12 GDPR.

If you believe your data has been processed in breach of the GDPR, you have the right to lodge a complaint with the Irish supervisory authority:

We ask that you contact us first at info@barbify.ie so we have the opportunity to resolve your concern directly.

• All data in transit is encrypted via TLS 1.2+.
• Passwords and tokens are hashed (bcrypt / PBKDF2-SHA256) — we never store plaintext passwords.
• Session tokens are short-lived JWTs with revocation support.
• All dashboard mutations are protected against CSRF attacks.
• File uploads are validated for type and size; SVG files are rejected.
• Rate limiting is applied to all authentication and booking endpoints.

We use strictly necessary cookies for authentication and session management. Analytics and marketing cookies are only placed with your explicit consent. See our Cookie Policy for the full inventory.

We may update this Privacy Policy from time to time. When we make material changes, we will notify registered barbers by email at least 14 days before the change takes effect. We will also update the effective date at the top of this page. Continued use of the Platform after the effective date constitutes acceptance of the revised policy.