Privacy policy

Our BarbSnap Privacy Policy describes how and why we may collect, store, use and/or share your personal information when you use our services, including when you visit https://barbsnap.com or any site that links to this policy.

If you have questions or concerns, reading this policy will help you understand your privacy rights. The data controller is Brian Agustín Diez Lozano (individual, Uruguayan ID No. 4.996.386-1), operator of the BarbSnap service. If you do not agree with our practices, please do not use the Services. For any inquiry, email us at privacy@barbsnap.com.

Key points summary

• What data we process: what you provide (registration, business data, your customers' data) and some collected automatically (technical usage data).
• Sensitive data: we do not process sensitive personal data.
• Third parties: we share data only with providers that help us operate the Service (payment processor, hosting, database, messaging).
• How we use it: to provide, improve and administer the Service, communicate with you, prevent fraud and comply with the law.
• Your rights: depending on your location, you can access, rectify, export or delete your data.
• How to exercise them: from the dashboard at Settings → Account, or by emailing privacy@barbsnap.com.

1. What information we collect

1.1 Information you provide (barbershops: owners and staff)

• Name, email and password (stored with bcrypt hash).
• Business information: name, address and phone.
• Billing data (processed by Mercado Pago — we do not store card numbers).

1.2 Information about barbershops' end customers

• Name and phone number when they book an appointment.
• Email, if provided.
• History of appointments, services and amounts paid.
• WhatsApp/Instagram messages exchanged with the barbershop through BarbSnap.

1.3 WhatsApp and Instagram integration (Meta)

When a barbershop connects its account through Meta's "Embedded Signup" flow, we receive and store:

• Its WhatsApp Business Account identifier (WABA ID).
• The phone number identifier (Phone Number ID).
• An access token issued by Meta — encrypted at rest with AES-256-GCM.
• Incoming and outgoing messages processed by our webhook.

The token never leaves our servers. It is only decrypted in memory when sending messages on behalf of the barbershop.

1.4 Information collected automatically

When you use the Service we automatically collect certain technical information that does not reveal your identity: IP address, browser and device characteristics, operating system, language preferences, country and data about how and when you use the Service. We use it to maintain the security and operation of the Service and for internal analysis. These technical logs are retained for 30 days.

2. How we process your information

• Operate the Service: agenda, bookings, notifications and analytics.
• Send transactional messages (appointment confirmation, reminders) to end customers on behalf of the barbershop.
• Provide support and resolve incidents.
• Bill barbershops for their subscription.
• Prevent fraud and protect the Service's security.
• Improve the product through aggregated, non-identifiable analytics.
• Comply with legal obligations.

We process your information only when we have a valid legal basis to do so.

3. Who we share your information with

• Meta Platforms — only the messages we send via the WhatsApp Cloud API on behalf of each barbershop.
• Supabase — PostgreSQL database provider (data encrypted in transit and at rest).
• Vercel — application hosting.
• Mercado Pago — payment processing.
• Upstash — task queues (scheduled reminders).

We do not sell personal data to third parties and we do not use it for advertising.

4. Cookies and tracking technologies

We use cookies and similar technologies to operate the Service, authenticate your session and understand how it is used. Details are in our Cookie Policy.

5. International transfers

Our servers and those of some of our providers may be located outside your country. If you access the Service from another region, your data may be transferred, stored and processed in those locations. We take reasonable measures to protect your personal information in accordance with this policy and applicable law.

6. How long we keep your information

• Active account data: while the subscription is in effect.
• WhatsApp/Instagram messages: 12 months, then anonymized.
• Technical logs: 30 days.
• After account cancellation: we delete everything within a maximum of 30 days, except what the law requires us to retain (for example, billing).

7. Children's information

We do not knowingly collect or solicit data from children under 13, nor market to them. By using the Service you declare that you are at least 18 years old, or that you are the parent or guardian of a minor and consent to their supervised use. If we become aware that we collected data from a child under 13 without the corresponding parental consent, we will delete it promptly.

8. Your privacy rights

Depending on where you live, you have the right to access, rectify, export and delete your personal data, and to withdraw your consent at any time. To exercise them:

• If you are a BarbSnap user: from the dashboard at Settings → Account, or by emailing privacy@barbsnap.com.
• If you are an end customer of a barbershop: contact the barbershop directly, or us if you get no response.

See also Data deletion for the deletion process.

9. "Do-Not-Track" signals

Most browsers include a "Do-Not-Track" (DNT) feature. Since there is not yet a uniform technology standard for recognizing these signals, we currently do not respond to them. If a standard is adopted in the future, we will inform you in a revised version of this policy.

10. Security

• Traffic encrypted with TLS 1.3.
• Passwords with bcrypt hash.
• Third-party tokens (WhatsApp, Mercado Pago) encrypted with AES-256-GCM before storage.
• Database access restricted to authorized IPs.
• HMAC signature verification on all incoming webhooks.

11. Changes to this policy

We may update this policy from time to time. If the changes are material, we will notify you by email at least 7 days before they take effect. The "Last updated" date above always reflects the current version.

12. Governing law

This policy is governed by the laws of the Oriental Republic of Uruguay. Any dispute will be resolved in the competent courts of Montevideo.

13. How to contact us

Questions, complaints or requests about this policy or your data:

BarbSnap — Brian Agustín Diez Lozano (individual)
Uruguayan ID No. 4.996.386-1
Montevideo, Uruguay
privacy@barbsnap.com