Legal

Privacy Policy

Last updated: November 1, 2026

1. Who processes your data (Controller)

The data controller is Vincenzo Sorbellini. For any request about your data you can write to hello@hairdoor.app.

2. What data we collect

We only collect the data needed for you to use Hairdoor:

Account: first name, last name, email, phone number.
Addresses where you want the service, with their geographic location (to work out which barbers can reach you).
Location: if you allow it, your device’s position, used at that moment to find barbers nearby or to fill in an address. We keep no history of your movements.
Bookings and appointment history.
Payments: handled by Stripe. We do not store your card details; Stripe handles them directly. We keep the outcome of payments, any refunds with the reason you give when asking for one, and the status of disputes.
Photos for the profile and gallery, and any documents uploaded by barbers.
Messages in the chat, reviews and ratings.
Technical data: push notification tokens (if you turn them on), the sign-in data the service needs to work, and technical error records (page, message, time), which contain no personal data of yours.

3. Why we use it and on what legal basis

To provide the service (create the account, book, pay, handle refunds and disputes, communicate): performance of the contract.
For legal obligations (tax, accounting): legal obligation.
For security and abuse prevention (e.g. checking bookings and commissions): legitimate interest.
For push notifications: your consent, which you can withdraw at any time.
For news and promotional emails: your consent, asked separately at sign-up and withdrawable from Settings or from the link at the bottom of every email.
To promote Hairdoor with photos and reviews posted by users, crediting their name: legitimate interest. You can object at any time by writing to us (Terms, section 14).

Automated decisions. We do not take decisions about people based solely on automated systems, with one exception set by the contract with barbers: if commissions on cash payments are not paid within the limits of the Terms (section 13), the profile is suspended automatically and becomes active again, also automatically, as soon as they are paid. You can ask for a person to review the decision and give your view by writing to hello@hairdoor.app. The order of search results follows the public rules in the Terms (section 5).

4. Who we share it with

We do not sell your data. We share it only with providers that help us run the service, as data processors:

Supabase (database, authentication and file storage, servers in the European Union);
Vercel (hosting of the site and the app, and anonymous visit counting: page viewed, country, device type and referring site, without cookies);
Stripe (payments, commissions and subscriptions);
Resend (sending email, servers in the European Union);
Apple, Google and Expo (delivering push notifications to your phone);
RevenueCat (managing subscriptions bought on the App Store and Google Play);
OpenStreetMap/Nominatim (address to coordinates and back) and OpenFreeMap (the maps you see): they receive the address searched for and the device’s IP address;
Dropbox (keeping the backups, which leave us already encrypted: whoever stores them cannot read them).

In addition, your name and address (street, number, postcode, city and country) are shown to the barber as soon as you send them a request, before they accept it, so they can tell whether they can reach you. If they decline, if the request expires or if you cancel it, they no longer see them in Hairdoor. They see the notes for getting there (doorbell, floor) only after accepting.

If you pay by card, the payment is collected by the barber on their own Stripe account: the barber and Stripe receive the data needed for the payment (for example the card’s type, last digits and country, the amount and, if you entered them, your name and billing details) and process it as independent controllers, including for refunds and disputes. The full card number stays with Stripe only. The reason for a refund request is visible to the barber and, where needed, to Hairdoor.

If you are a barber and connect an account to receive payments, the data Stripe asks for (identity, ID document, bank account) is processed by Stripe under its own privacy policy: Hairdoor only sees whether the account is active.

A barber who receives those details handles them — name, phone number and address — as an independent controller, to perform the service and to meet their own legal obligations.

5. Where it is stored

Data is kept on servers located in the European Union. Some providers are based in the United States and may process it outside the EU as well: Stripe, Vercel, Apple, Google, Expo, RevenueCat and Dropbox. In those cases the transfer takes place with the safeguards the GDPR requires — the European Commission’s standard contractual clauses, or the provider’s certification under the EU–U.S. Data Privacy Framework.

Every night we take a backup of the database, encrypted before it leaves our systems and kept for at most 14 days.

6. How long we keep it

We do not keep data longer than we need to. Concretely:

Account and profile: as long as the account exists. When you delete it, personal data is erased or anonymised straight away.
Bookings, payments and commissions: 10 years, as Italian tax and accounting rules require; after the account is deleted they remain without the personal data attached to them.
Chat messages and photos: as long as the account exists; they are deleted when you delete it.
Qualification document (barbers, optional): only Hairdoor sees it, to grant the check mark. If we reject it, take the check mark away, or you upload another one, the file is deleted; otherwise it stays as long as the account exists.
Reviews: they stay published, but without your name, after the account is deleted.
Push notification tokens: as long as you keep notifications on for that device.
Technical error records: 90 days.
Backups: 14 days.

7. Your rights

You have the right to access your data, correct it, delete it, restrict or object to its processing, and to portability. To exercise them write to hello@hairdoor.app. You can also withdraw the consents given (e.g. notifications) at any time. If you believe the processing breaches the rules, you can contact the competent data protection authority. You can also delete the account yourself, at any time, from Settings → Delete account.

8. Cookies and similar technologies

We use only essential technical cookies: no advertising cookies, no profiling. To count visits we use Vercel Web Analytics, which uses no cookies and stores nothing on your device: it counts visitors anonymously, without recognising them from one day to the next, based on our legitimate interest in understanding how the site is used. That is why we do not ask you to accept anything on arrival. These are the cookies:

Session cookies (Supabase): they keep you signed in and renew while you stay signed in.
hairdoor_tema: remembers whether you chose the light or the dark theme. Lasts one year.
hairdoor_fuso: your device’s time zone, so times are shown correctly. Lasts one year.
NEXT_LOCALE: the language you chose. Lasts one year.
hairdoor_invito: the code of the barber whose business card brought you here, so the sign-up is credited to them if you register. Lasts 30 days.

The app also remembers a few preferences on your device — sounds on or off, intro and tips already seen, the last place you searched — which stay there: they never reach us and they disappear if you uninstall the app or clear your browser data.

9. Minors

Hairdoor is for adults: you must be 18 to register. We do not knowingly collect data from minors. If we learn that an account was created by a minor, we close it and delete the data. If you are a parent or guardian and believe this has happened, write to us at hello@hairdoor.app.

10. Changes

We may update this policy. Changes will be published here with the new update date.