Privacy Policy

ChairBook Pro ("we", "us", "our") runs an online booking and business management platform for barbers, hairdressers and hair salons (the "Platform"). This policy explains how we handle personal data in line with the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.

For any privacy question, contact hello@chairbookpro.com.

We handle personal data in two different roles, depending on whose data it is.

• As data controller: we decide how and why we use the data of business account owners, managers and staff who sign in to the Platform, and of visitors to chairbookpro.com. This covers account details, login and security records, plan and billing information, and how we communicate with you.
• As data processor: when a customer books with a business, or a business adds a customer record, that business (the "Business") is the data controller of its customers' data. We process that data only on the Business's documented instructions, to provide the Platform to it. We do not use it for our own purposes.

If you are a customer of a Business and want to know how it uses your data, please read its privacy information or contact it directly. Its details are on its booking page. We will help Businesses respond to your requests.

Business account information: your full name, email address, password (stored only in securely hashed form), business name, web address, business type, contact phone, address, logo, branding, and the date you accepted our Terms.

Staff profiles: display names, short bios, which services each team member offers, working hours and time off, and the role each team member holds in the account.

Customer and appointment details (processed for the Business): customer name, email address, phone number, appointment date and time, the service booked and its price, the team member, appointment status, notes the customer adds when booking, and any booking preferences, internal notes and marketing-consent status the Business records.

Products and business records: services, prices, product catalogue and stock levels. These are usually not personal data.

Technical and security logs: IP address, browser and device type, the dates and times of sign-ins and requests, and error logs. We also keep audit records of important account actions, such as changes to business settings or a customer being erased.

We do not ask for special category data, such as health information. Businesses should not record it in notes unless they have a lawful basis to.

• To provide the Platform: creating and running accounts, taking bookings, showing calendars and sending service emails such as account confirmation and password resets. Lawful basis: contract.
• To keep the Platform secure: preventing fraud, abuse and spam bookings, enforcing rate limits and investigating incidents. Lawful basis: legitimate interests.
• To support and improve the service: answering your questions and fixing faults. Lawful basis: legitimate interests.
• Billing and records: managing subscriptions and keeping accounting records. Lawful basis: contract and legal obligation.
• Customer booking records: processed only on each Business's instructions. The Business is responsible for its own lawful basis.

We do not send marketing to a Business's customers. We send marketing to business account holders only where the law allows, and you can opt out at any time.

Each Business's data is kept strictly separate. Access controls built into our database mean a signed-in user can only reach the data of the Businesses they belong to, and only with the permissions of their role. One Business can never see another Business's customers, appointments or records.

We never sell personal data. We do not share one Business's data with any other Business, and we do not use customer data for advertising or profiling. The public booking page shows only what a Business chooses to publish: its services, team names and bios, opening hours and contact details.

We use a small number of trusted service providers (sub-processors) to run the Platform, under written contracts that require them to protect the data and use it only on our instructions:

• cloud hosting, database and file storage providers;
• email delivery providers for account and service emails;
• payment processors, once paid plans are billed. We never store full card details.

We may also disclose data if the law requires it, to protect people's safety or rights, or to a buyer of our business, who would be bound by this policy. Business customers can ask us for the current list of sub-processors at hello@chairbookpro.com.

Some of our providers may process data outside the UK. Where they do, we make sure there is appropriate protection, such as a UK adequacy decision or the International Data Transfer Agreement or Addendum approved by the ICO.

Under UK GDPR you have the right to:

• access the personal data held about you;
• correct data that is inaccurate or incomplete;
• erase your data ("the right to be forgotten");
• restrict or object to certain processing, including direct marketing;
• data portability: receive your data in a commonly used format;
• withdraw consent at any time, where processing is based on consent.

If you are a Business's customer, contact that Business first, as it controls your booking records. Businesses can correct a customer's details in their dashboard. Owners and managers also have an Erase customer feature, which deletes the customer record and removes the customer's name, email, phone and notes from every past appointment, leaving only anonymous totals for the Business's records. Each erasure is logged for accountability. If you cannot reach the Business, email us and we will pass on your request and support it.

If you are an account holder, email hello@chairbookpro.com. We will respond within one month, and may need to confirm your identity first. Exercising your rights is free.

• Business account data: for as long as the account is open, then deleted within 90 days of account closure, unless you ask us to export it first.
• Customer and appointment records: kept for as long as the Business keeps its account, and deleted with the account. Businesses can erase an individual customer at any time.
• Billing and accounting records: 6 years, as required by UK tax law.
• Security and technical logs: up to 12 months, unless needed longer to investigate an incident.
• Audit records: up to 6 years, to show compliance. They contain identifiers, not customer contact details.

Backups are overwritten on a rolling cycle, so deleted data may stay in backups for a short time before it is permanently removed.

• All traffic is encrypted in transit with HTTPS/TLS, and data is encrypted at rest by our hosting providers.
• Passwords are stored only as secure hashes, never in readable form.
• Row-level access controls in the database enforce strict separation between Businesses.
• Team access is role-based (owner, manager, staff), so people only get the access their role needs.
• Public booking is rate-limited to deter abuse and spam.
• Business images are stored privately and served only through controlled addresses.

If a personal data breach is likely to put your rights at risk, we will notify affected Businesses without undue delay, and the ICO within 72 hours where required.

We use only what is strictly necessary for the Platform to work. When you sign in, your browser's local storage keeps a secure session so you stay signed in, and it remembers which Business you last selected in the dashboard. Because these are essential, they do not need consent.

We do not use advertising or cross-site tracking cookies. If we ever add optional analytics, we will ask for your consent first and update this policy.

Business accounts are for adults aged 18 or over. Businesses are responsible for any bookings they accept for children, and for getting consent from a parent or guardian where needed.

We may update this policy from time to time. The date at the top shows the latest version. We will tell account holders about significant changes by email or in the dashboard.

To exercise your rights or ask about this policy, email hello@chairbookpro.com.

If you are unhappy with how your data has been handled, you have the right to complain to the UK Information Commissioner's Office (ICO): visit ico.org.uk or call 0303 123 1113. We would appreciate the chance to resolve your concern first.

See also our Terms of Service.