# Privacy Policy — BarberShopPro **Version 1.2 — Effective August 4, 2026** --- ## 1. Who we are, and who is responsible for your data BarberShopPro (the "Platform") is operated by Developers Alternatives. Two roles coexist: - **The Platform is responsible** for your Platform account data (profile, sign-in, security logs) and for operating the service. - **Each Business (barbershop/barber) is responsible** for its own client relationship — the appointment information the Platform processes **on the Business's behalf** so it can serve you. Requests about how a specific Business uses your information can go to that Business; we help route and enforce them. ## 2. Information we collect - **Account**: first/last name, email, phone. - **Appointments & services**: barbershop, barber, services, dates, visit history. - **Payments**: amounts, breakdown (taxes, fees, tips) and processor references. **We NEVER store card numbers** — Stripe handles them. - **Security**: sign-in/out logs with IP and browser (audit). - **Location**: only with your permission, to show nearby barbershops. No background tracking. - **Appointment notes**: free-text notes you choose to write for the Business (see section 3). - **Dependents**: name and appointment details of minors you add as your dependents (see section 5). - **Kiosk / walk-in check-in**: name and phone for the waiting list — kept only days, then deleted. - **Passkeys**: the public credential of your passkey — never your fingerprint or face (see section 4). - **Reviews**: the review text and rating you publish. ## 3. Sensitive information in appointment notes Appointment notes are optional and written by you. Sometimes clients include personal or health-related details (for example, a condition a barber should know about to give better service). If you do: - We use that note **only** to deliver the appointment — it is shown to the Business serving you. - We never use notes for advertising, profiling or any secondary purpose, and we never sell or share them. - Notes are purged/reviewed when your data is anonymized (section 10). - **Please write only what the Business needs to know.** You can edit or remove your notes at any time. ## 4. Passkeys and biometrics If you sign in with a passkey (fingerprint, face, or device PIN): - Your biometric data **never leaves your device** and is never sent to us. Your device only proves to us that you verified yourself. - We store only the passkey's **public key** and a device label. We cannot reconstruct any biometric information from it. ## 5. Children and dependents Platform accounts are for adults (18+). We do not knowingly let minors create accounts. Minors appear only as **dependents** added by their parent or legal guardian, who provides and controls that information. We collect the minimum needed to manage the dependent's appointments, we never use dependents' data for marketing, and the guardian can remove a dependent at any time. If we learn a minor created an account directly, we will delete it. ## 6. How we use it To operate the Platform (appointments, payments, turn notifications), for security and fraud prevention, and service communications (reminders, receipts). **We do not sell your information.** - **Transactional messages** (confirmations, reminders, your turn) are part of the service. **Marketing messages** are sent only with separate, explicit consent, which you can withdraw anytime. - We do **not** use your personal information to train AI models, and we do not do targeted advertising. ## 7. Who we share it with - The Business serving you (your name, phone and appointment services). - Stripe (payment processing). - Infrastructure providers (hosting/DB) under confidentiality agreements. - Messaging providers, only to deliver notices you opted into: Twilio (SMS) and our transactional email provider. **Your mobile number and SMS consent are never shared with third parties or affiliates for marketing.** - Authorities, only when required by law. - If the business is ever sold or merged, data may transfer to the successor under this same policy (you would be notified). **We do not sell or share your personal information for targeted advertising** — for any state law purpose, we make no "sale" or "sharing" of personal data. ## 8. Cookies We use **first-party cookies only**, for three purposes: - **Sign-in and security** — to keep you signed in and protect your account. - **Your language preference** — so the Platform shows the language you chose. - **How you reached a Business** — if you arrive by scanning a printed QR code or tapping an NFC tag at a barbershop, we note which of the two brought you, so the Business can see how many bookings came from its own sign. **This cookie holds no personal information, cannot be read by scripts, and is deleted when you close your browser.** We set **no third-party cookies**, no advertising cookies, no tracking pixels and no session-replay tools, and we do not follow you across other websites. Because every cookie we set is first-party, limited to your session and free of personal information, no cookie consent banner is needed. ## 9. Your privacy rights No matter which state or territory you live in, you can: - **Access** — ask for a copy of the personal information we hold about you. - **Correct** — fix inaccurate data (most of it directly in your profile). - **Delete** — request deletion of your account and personal data. We will honor it except for records we must keep by law (e.g., de-identified financial records for tax purposes — see section 10). - **Opt out** of marketing communications at any time (SMS: reply STOP; email: unsubscribe link; or from your profile). - **Not be discriminated against** for exercising any of these rights. To exercise a right: use your profile, or write to customerservice@developersalternatives.com. We will verify your identity, respond within **45 days** (extendable once with notice), and you may appeal a denial by replying to our decision. An authorized agent may act for you with proof of authorization. Residents of California and other states with comprehensive privacy laws have these rights by statute; we extend them to everyone, including Puerto Rico residents. ## 10. Retention & security We keep data while your account exists or as required by law. We use encryption in transit, role-based access control and session auditing. Our retention schedule (summarized): | Data | Kept for | Then | |---|---|---| | Profile & contact info | While your account is active, up to 24–36 months after your last activity | **Anonymized** (irreversibly de-identified) | | Financial records (amounts, dates, processor references) | 7–10 years (tax law, IRS / Puerto Rico Treasury) | Kept **de-identified** — no longer linked to you | | Sign-in/security logs | 12–24 months | Deleted | | Waiting-list entries (kiosk) | Days | Deleted | | SMS/marketing consent records | At least 5 years (TCPA proof) | Deleted; opt-out list kept so we never contact you again | | Appointment notes | Until you delete them or your data is anonymized | Purged | We also **encrypt personal information at rest**. Anonymization is audited (what, when, why, by whom). ## 11. Security breaches If a security breach affects your unencrypted personal information, we will notify you without undue delay and notify authorities as required by applicable law — including Puerto Rico's Act 111-2005 (notice to the Department of Consumer Affairs within 10 days) and the breach notification laws of your state. ## 12. Where your data lives The Platform operates in the United States and Puerto Rico, and your data is stored on servers in the United States. We do not target or offer the service in other countries. ## 13. SMS terms The full SMS/Text Messaging Terms (opt-in only, STOP/HELP, frequency, no sharing of mobile information for marketing) are published on our Privacy page and form part of this policy. ## 14. Your choices Update your data in your profile, choose how to receive notifications (SMS/email), and request account deletion at customerservice@developersalternatives.com. ## 15. Changes New versions will be published and acceptance requested at sign-in. ## 16. Contact customerservice@developersalternatives.com