Legal

Privacy Policy

Last updated: September 16, 2026

1. Who processes your data (Controller)

The data controller is Vincenzo Sorbellini. For any request about your data you can write to hello@hairdoor.app.

2. What data we collect

We only collect the data needed for you to use Hairdoor:

Account: first name, last name, email, phone number.
Addresses where you want the service, with their geographic location (to work out which barbers can reach you).
Location: if you allow it, your device’s position, used at that moment to find barbers nearby or to fill in an address. We keep no history of your movements.
Bookings and appointment history.
Payments: handled by Stripe. We do not store your card details; Stripe handles them directly. We keep the outcome of payments, any refunds with the reason you give when asking for one, and the status of disputes.
Photos for the profile and gallery, and any documents uploaded by barbers.
Messages in the chat, reviews and ratings.
Technical data: push notification tokens (if you turn them on), the sign-in data the service needs to work, and technical error records (page, message, time), which contain no personal data of yours.

3. Why we use it and on what legal basis

To provide the service (create the account, book, pay, handle refunds and disputes, communicate): performance of the contract.
For legal obligations (tax, accounting): legal obligation.
For security and abuse prevention (e.g. checking bookings and commissions): legitimate interest.
For push notifications: your consent, which you can withdraw at any time.

4. Who we share it with

We do not sell your data. We share it only with providers that help us run the service, as data processors:

Supabase (database, authentication and file storage, servers in the European Union);
Vercel (hosting of the site and the app);
Stripe (payments, commissions and subscriptions);
Resend (sending email, servers in the European Union);
Apple, Google and Expo (delivering push notifications to your phone);
RevenueCat (managing subscriptions bought on Google Play);
OpenStreetMap/Nominatim (address to coordinates and back) and OpenFreeMap (the maps you see): they receive the address searched for and the device’s IP address;
Dropbox (keeping the backups, which leave us already encrypted: whoever stores them cannot read them).

In addition, the data needed to carry out the appointment (name and address) is shown to the barber only after they have accepted the booking.

If you pay by card, the payment is collected by the barber on their own Stripe account: the barber and Stripe receive the data needed for the payment (for example the card’s type, last digits and country, the amount and, if you entered them, your name and billing details) and process it as independent controllers, including for refunds and disputes. The full card number stays with Stripe only. The reason for a refund request is visible to the barber and, where needed, to Hairdoor.

If you are a barber and connect an account to receive payments, the data Stripe asks for (identity, ID document, bank account) is processed by Stripe under its own privacy policy: Hairdoor only sees whether the account is active.

From that moment the barber handles those details — name, phone number and address — as an independent controller, to perform the service and to meet their own legal obligations.

5. Where it is stored

Data is kept on servers located in the European Union. Some providers are based in the United States and may process it outside the EU as well: Stripe, Vercel, Apple, Google, Expo, RevenueCat and Dropbox. In those cases the transfer takes place with the safeguards the GDPR requires — the European Commission’s standard contractual clauses, or the provider’s certification under the EU–U.S. Data Privacy Framework.

Every night we take a backup of the database, encrypted before it leaves our systems and kept for at most 14 days.

6. How long we keep it

We do not keep data longer than we need to. Concretely:

Account and profile: as long as the account exists. When you delete it, personal data is erased or anonymised straight away.
Bookings, payments and commissions: 10 years, as Italian tax and accounting rules require; after the account is deleted they remain without the personal data attached to them.
Chat messages and photos: as long as the account exists; they are deleted when you delete it.
Reviews: they stay published, but without your name, after the account is deleted.
Push notification tokens: as long as you keep notifications on for that device.
Technical error records: 90 days.
Backups: 14 days.

7. Your rights

You have the right to access your data, correct it, delete it, restrict or object to its processing, and to portability. To exercise them write to hello@hairdoor.app. You can also withdraw the consents given (e.g. notifications) at any time. If you believe the processing breaches the rules, you can contact the competent data protection authority. You can also delete the account yourself, at any time, from Settings → Delete account.

8. Cookies and similar technologies

We use only essential technical cookies: no advertising cookies, no profiling, no third-party analytics. That is why we do not ask you to accept anything on arrival. These are the cookies:

Session cookies (Supabase): they keep you signed in and renew while you stay signed in.
hairdoor_tema: remembers whether you chose the light or the dark theme. Lasts one year.
hairdoor_fuso: your device’s time zone, so times are shown correctly. Lasts one year.
NEXT_LOCALE: the language you chose. Lasts one year.

The app also remembers a few preferences on your device — sounds on or off, intro and tips already seen, the last place you searched — which stay there: they never reach us and they disappear if you uninstall the app or clear your browser data.

9. Minors

Hairdoor is for adults: you must be 18 to register. We do not knowingly collect data from minors. If we learn that an account was created by a minor, we close it and delete the data. If you are a parent or guardian and believe this has happened, write to us at hello@hairdoor.app.

10. Changes

We may update this policy. Changes will be published here with the new update date.