Privacy Policy

Our role

For barbershops and salons (“Operators”) and visitors to our site, we act as a controller of the account and usage data we collect. For the data an Operator collects about its own clients through the Service (such as a client's booking history and contact details), we act as a processor on that Operator's behalf; the Operator is responsible for its own privacy practices toward its clients.

Information we collect

• Your name and mobile phone number
• For Operators: account email and login credentials
• Appointment details (shop, barber, service, date and time)
• Payment status (processed by Stripe; we do not store card numbers)
• Basic device and usage data (such as IP address and pages viewed) needed to operate and secure the Service

How we use it

We use your information to provide the booking service and, where you have opted in, to send transactional appointment text messages (confirmations, reminders, and payment/tip links) for the shops you book with, and, only if you separately opt in to marketing, occasional offers and discounts from shops you've visited. We also use it to operate, secure, support, and improve the Service.

Cookies, tracking, and your choices

Strictly necessary. These keep you signed in, secure your session, and protect the Service (for example, our authentication cookies and Cloudflare's security cookies). They are always on because the Service cannot work without them.

Analytics. For website analytics we use Umami, which is cookieless. It measures aggregate page views and clicks without cookies and without collecting personal information, so it needs no consent.

Advertising. On our marketing pages we use Google Ads (the Google tag and Google Tag Manager) to measure ad performance and record conversions. This sets Google advertising cookies and shares online identifiers (such as cookie IDs and IP address) with Google for cross-context behavioral advertising. Under California law this is a “share” of personal information. When a shop owner starts a free trial, we also send Google a one-way hashed (SHA-256) copy of the owner's account email so Google can match the signup to the ad that led to it (Google “enhanced conversions”); the email itself is never sent. We do not share your name, phone number, or booking history for advertising, and we never send clients' data to Google.

Demo booking. When you click to book a demo, we load a scheduling widget from Koalendar. It loads only after you click and is subject to Koalendar's own privacy practices.

Your choices. In the EEA, the UK, and Switzerland, advertising cookies are off by default; we show a banner and load Google Ads only if you click Accept. Elsewhere, including the United States, we show a short notice and honor opt-outs. You can change your choice anytime from the “Cookie settings” link in our footer, opt out through the “Do Not Sell or Share My Personal Information” link, or enable a Global Privacy Control (GPC) signal in your browser, which we detect and honor automatically as a valid opt-out.

Mobile information & SMS consent

Text messages fall under two separate opt-ins: transactional appointment messages (reminders and tip links), which you agree to when booking, and optional marketing messages (offers and discounts from shops you've visited), which require a separate opt-in and are never a condition of booking. Message frequency varies, and message and data rates may apply.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing to subcontractors in support services, such as customer service, is permitted. All other use case categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

You can opt out of text messages at any time by replying STOP. See our SMS Terms for details.

Sharing

We share booking details with the specific shop you book with so they can serve you. We use service providers (e.g., Twilio for messaging, Stripe for payments) solely to operate the Service. We do not sell your personal information for money. We do “share” online identifiers with Google for advertising, as described in “Cookies, tracking, and your choices” and “Your privacy rights.”

AI assistants you connect

You can connect your own AI assistant (such as Claude or ChatGPT) to barber.rsvp. While connected, it can search shops and open times, see your upcoming and recent appointments, the shops you visit and your memberships and credits, and book, reschedule or cancel appointments for you after showing you the details. What the assistant receives from us is then handled under its provider's privacy policy.

We receive only the requests your assistant makes to our booking tools, such as a shop search or a booking. We never receive your conversation with the assistant, its memory, or your files. We store the assistant's name, where it returns you after sign-in, and hashed connection tokens. Access lasts one hour at a time, and the connection ends 90 days after you connect or as soon as you disconnect it in Account, then Preferences, then Connected assistants. Shops see that a booking was made through an AI assistant. The assistant never sees card details; any payment is finished on Stripe's page.

Subprocessors

We use the following third-party providers (“subprocessors”) to operate the Service. Each processes only the data needed for its function, under its own security and privacy commitments, and not for its own purposes. Google (below) is the exception: for advertising it acts as an independent party, not a subprocessor, as described in “Cookies, tracking, and your choices.”

• Stripe, payment processing for subscriptions and shop payouts. Card details go directly to Stripe; we never store card numbers.
• Twilio, sending appointment text messages and verifying mobile numbers.
• Resend, sending transactional emails (sign-in links, booking confirmations, and billing notices).
• Cloudflare, content delivery, DNS, and file storage (such as shop photos).
• Fly.io, application hosting and database infrastructure.
• Sentry - error monitoring and diagnostics to keep the Service reliable.
• Umami, cookieless website analytics (aggregate page views and clicks). No cookies, and no personal information.
• Google, advertising measurement and conversion tracking on our marketing pages (Google Ads and Google Tag Manager). Google acts as an independent party for advertising; see “Cookies, tracking, and your choices.”
• Koalendar, the demo-scheduling widget, loaded only when you choose to book a demo.

Data retention & security

We retain your information for as long as your account is active or as needed to provide the Service and meet legal obligations, after which we delete or anonymize it. We use reasonable administrative, technical, and physical safeguards to protect your information, though no method of transmission or storage is completely secure.

Your privacy rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, and to opt out of the sale or sharing of it. California residents have these rights under the CCPA/CPRA, including the right not to be treated differently for exercising them.

We do not sell your personal information for money. We do “share” online identifiers (advertising cookie IDs and IP address) with Google for cross-context behavioral advertising. You can opt out at any time using the “Do Not Sell or Share My Personal Information” link in our footer, through your cookie settings, or by enabling a Global Privacy Control (GPC) signal in your browser, which we detect and honor as a valid opt-out. We do not knowingly sell or share the personal information of anyone we know to be under 16.

To exercise any of these rights, or to request deletion of your account and associated data, email support@barber.rsvp or reply STOP to opt out of text messages. If your data was collected by a shop through the Service, we may direct your request to that shop.

Children's privacy

Accounts are for adults 18 and over. The Service is not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided us information, contact us and we will delete it.

Data location

We operate in the United States, and your information is processed and stored there. By using the Service, you understand your information may be processed in the U.S.

EEA, UK, and Swiss visitors

If you are in the EEA, the UK, or Switzerland, we act as a controller for our website and account data. Our legal bases are consent (for advertising cookies), legitimate interests (to operate, secure, improve, and measure the Service using cookieless analytics), and performance of a contract (to provide the Service you request). You have the right to access, correct, delete, restrict, or object to processing, to data portability, and to withdraw consent at any time without affecting processing already carried out. You may lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner's Office). Your information is processed and stored in the United States; where required we rely on appropriate safeguards for that transfer. To exercise any right, email support@barber.rsvp.

Changes to this policy

We may update this Privacy Policy from time to time. We will update the “Last updated” date above, and material changes may be communicated through the Service.

Contact

barber.rsvp is operated by BullsAI LLC. Questions about this policy? Email support@barber.rsvp.