Privacy policy

1. Who is responsible

The controller of your data on the platform is the operator of Haircutz identified at the end of this page.

When you make a booking, the shop receives the data needed for it and is responsible for how it uses that data to provide the service.

2. What data we collect

• Account: name, email, phone, NIF and password. The password is stored hashed and the NIF is stored encrypted. The NIF is only used to make sure each person has a single account: for that we also keep a fingerprint of it, and we use it for nothing else.
• Sign-in PIN (if you choose one): we store only a hash, from which the PIN cannot be recovered, and the number of wrong attempts in a row.
• Passkeys (if you create them): the private key stays on your device (or in your Apple, Google or Microsoft account password manager) and never reaches us. We store only the public key, a name you choose for the passkey, and when it was created and last used.
• Bookings: shop, service, professional, date and time, price, booking status and any note you write to the shop.
• Reviews you write and the emails we send you (codes, confirmations and reminders).
• Suggestions you send us: the message and, if you give it, your email, only so we can reply.
• Shops that buy credits: the payment is handled by Stripe and card details never pass through our servers; we keep the amount, date and payment reference.
• Technical and security data: IP address, login attempts and action logs, used to protect accounts and limit abuse.
• Visit statistics, on public pages only (home, shop and booking pages, affiliation, suggestions, terms and privacy, sign-in and sign-up): the page viewed, the site you came from, your browser, system and device type, language, screen size and country. We use Umami, installed on our own server: it uses no cookies, does not keep your IP address and does not let us identify who visits. If your browser asks not to be tracked (Do Not Track), the visit is not counted.

3. Why we use it and on what basis

We do not sell your data, do not use it for advertising, and make no automated decisions with legal effects on you.

• To create and run your account, handle your bookings and send codes, confirmations and reminders — performance of a contract.
• To ensure one account per person and protect the platform against fraud and abuse — legitimate interest.
• To know how many people visit the site and which pages they use, so we can improve it — legitimate interest.
• To moderate reviews and handle reports of unlawful content — legal obligation (Digital Services Act) and legitimate interest.
• To meet legal obligations, including tax and accounting rules for the sale of credits — legal obligation.

4. Who sees your data

• The shop you book with. The professional only sees your full identity 10 minutes before the appointment.
• Providers that process data on our behalf under data processing agreements: Stripe (shop payments), Cloudflare (network and security) and Brevo (Sendinblue SAS, France — email delivery). The platform and its database run on our own server in Portugal.
• Stripe and Cloudflare may process data in the United States. Those transfers are covered by the EU-US Data Privacy Framework and by standard contractual clauses approved by the European Commission.
• Authorities, where the law requires it.

5. Cookies

• We use a single cookie of our own, strictly necessary, to keep you signed in on each Haircutz address you sign in to. It goes away when the session ends.
• Cloudflare, which protects the site, may set security cookies (for example __cf_bm, lasting 30 minutes, and cf_clearance, after a security check) to tell people from bots. They are strictly necessary.
• When a shop buys credits, Stripe's payment page (on a Stripe domain) uses its own cookies, described in Stripe's cookie policy.
• We do not use advertising, analytics or tracking cookies: visits are counted without cookies. As every cookie is strictly necessary, the law (Law 41/2004) does not require your consent.

6. How long we keep data

• Accounts that do not confirm their email are deleted after 24 hours.
• Ended sessions and unused login codes are deleted automatically.
• Backups are encrypted and deleted after 14 days.
• Suggestions are deleted a year after they are sent.
• Visit statistics are deleted after 13 months.
• Other data is kept while your account exists. After you ask for deletion we delete or anonymise the data within 30 days, except what we must keep by law (for example invoices and accounting records, for 10 years).

7. Your rights

You can ask for access, rectification, erasure, restriction and portability of your data, and object to processing based on legitimate interest. To exercise these rights, write to [email protected]; we reply within one month.

You also have the right to complain to the Portuguese data protection authority (CNPD) at www.cnpd.pt.

Haircutz is not intended for anyone under 16.

8. Security

We use encrypted connections (HTTPS), hashed passwords and PINs, encrypted NIF, login attempt limits, passkeys (phishing-resistant authentication), email verification by code at sign-up and encrypted backups. No system is completely secure; if a breach affects you, we will notify the CNPD and the affected people as the law requires.

9. Changes

We may update this policy. The version in force is always shown at the top of this page.

10. Who we are and contact