Privacy Policy

1. The two hats we wear

ChairBack is used by barbershops, salons, and similar personal-care businesses (“Shops”) to take bookings and payments and to run loyalty and rebooking programs for their clients (“Clients”). We handle personal information in two distinct roles:

• For Shop accounts, Client app accounts, and our own websites, we decide how data is used — we act as the data controller / business.
• For Client Data (information about a Shop’s clients — names, phone numbers, emails, bookings, visit history, punch balances, notes), we process it on behalf of the Shop as a service provider / processor. The Shop decides why and how that data is used; we follow the Shop’s instructions as expressed through the Service.

2. Information we collect

From Shop owners and their team

• Account data: your name, email address, and a password (stored only as a salted hash — we cannot read it). If you sign in with Google or Apple, we receive your name, email, and that account’s identifier instead of a password.
• Shop profile data: shop name, booking link, timezone, logo, photos, bio, hours, services and prices, booking policies, social handles, themes, reward and promotion configuration, and message templates.
• Billing and payout data: your subscription is billed by Stripe, and payments from your clients are paid out through your own Stripe account. We receive your plan, subscription and payout status from Stripe; we do not receive or store full card or bank account numbers.
• Scheduling integration data: if you connect Acuity Scheduling or Square, we store encrypted access tokens and sync appointment and client records from that account.

About Clients (on behalf of their Shop)

• Name, phone number, email address, and an optional Instagram handle (from the Shop’s scheduling system, entered by the Shop, or entered by the Client when booking).
• Bookings and visit history: dates, times, status, services, add-ons, prices (including any price changes and who made them), answers to the Shop’s own booking questions, which version of the Shop’s booking policy the Client agreed to, waitlist requests, and, for a group booking, the names the booker gives for the people in the party.
• Payments: when a Client pays a deposit, pays ahead, saves a card, leaves a tip, or pays a balance by card after a visit, the card is handled by Stripe. We receive the amount, status, card brand and last four digits, and refunds — never the full card number. A card is saved only when the Client chooses to save it.
• Loyalty activity: punches earned and redeemed, reward redemptions, promotion usage, and visit-cadence estimates derived from visit history.
• Messaging records: the content, time, and delivery status of texts, emails, and app notifications sent on the Shop’s behalf, and opt-in and opt-out status.
• Private notes the Shop records about a client.

From Clients who use the ChairBack app

• App account: the phone number or email address you confirm with a one-time code, and the name you give. Your account is linked to a Shop’s record of you only when the contact you confirmed matches that record unambiguously, or when the Shop gives you your own link.
• App data: the shops you save or join, your waitlist requests, and a notification token for your device if you allow notifications.

Automatically

• Log data: IP address, browser type, pages requested, and timestamps, used for security, rate limiting, and debugging.
• Error reports: when something breaks, a report of the error is sent to our error-monitoring provider, with personal details removed where we can.
• Cookies and on-device storage: we use a small number of first-party cookies that make the Service work — a signed, httpOnly session cookie that keeps Shop accounts signed in, and short-lived cookies for sign-in and invitation steps. Booking pages can remember a Client’s contact details and the policy versions they agreed to in that browser only, so they don’t retype them; “Not you?” clears it. The app keeps its session in the device’s secure storage.
• Site analytics: we use Vercel Web Analytics to count page views in aggregate. It does not use cookies or build a profile of you. We do not use advertising cookies or third-party tracking pixels.

3. How we use information

• Provide, operate, secure, and improve the Service.
• Take and manage bookings, sync visits from scheduling providers, compute punch balances, and render rewards, booking, and public pages.
• Process payments the Client agrees to — deposits, pay-ahead bookings, tips, card-on-file charges under the Shop’s policy the Client accepted, and refunds — through Stripe.
• Send booking confirmations, reminders, receipts, and account emails; send app notifications and Apple Wallet pass updates the Client turned on; and send texts and promotions that Shops initiate or configure, enforcing opt-ins and opt-outs and keeping delivery records.
• Offer openings to Clients who joined a Shop’s waitlist or asked to hear about them.
• Communicate with Shop owners about their account, billing, and important Service changes.
• Detect, prevent, and respond to fraud, abuse, and security incidents.
• Comply with legal obligations.

4. Text messaging data — no marketing use, ever

Clients can opt out of texts at any time by replying STOP, and can get help by replying HELP or emailing support@getchairback.com. Opt-outs are enforced platform-wide for the opted-out phone number. See the SMS Messaging Policy.

Promotional emails are sent only to Clients who agreed to receive them, and each one carries an unsubscribe link. Emails about a booking you made (confirmations, changes, receipts) are not promotional. App notifications can be turned off in your phone’s settings at any time.

5. How we share information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share information only with:

• Service providers (subprocessors) that host and run the Service under contractual confidentiality obligations — currently: Supabase (database hosting), Vercel (web hosting and aggregate site analytics), Railway (API hosting), Stripe (subscription billing, payments, and payouts), Twilio (SMS delivery), Resend (email delivery), Expo (delivering app notifications), Apple (Apple Wallet passes, app notifications, and Sign in with Apple), Google (only if you sign in with Google), Sentry (error monitoring), Squarespace / Acuity Scheduling and Square (scheduling data sync, only for Shops that connect them), and Anthropic (AI model processing — only for Shops that enable the AI receptionist, whose client text-message conversations are processed to generate replies).
• AI tools a Shop connects: a Shop can connect an AI assistant of its own choosing to its ChairBack account (for example through our MCP connector). When it does, that assistant can read the parts of the Shop’s account the Shop allowed when connecting it, which can include Client Data, at the Shop’s direction and under that provider’s own terms. The assistant built into the ChairBack dashboard answers from our help content and does not send your data to an AI provider.
• The Shop you patronize: if you are a Client, your information is visible to your shop — that is the point of the Service. A Shop sees your app account’s details only for shops you joined or that hold a matching record of you.
• Legal and safety: when required by law, subpoena, or to protect the rights, safety, or property of ChairBack, our users, or the public.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

6. Security

We use safeguards appropriate to the data we handle, including TLS encryption in transit, encryption of scheduling-provider access tokens at rest (AES-256-GCM), password hashing with argon2id, signed httpOnly session cookies, per-tenant database isolation enforced at both the application and database (row-level security) layers, rate limiting, and removal of personal details from our logs. Card numbers are entered into Stripe’s own secure forms and never reach our servers. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security. If we learn of a breach affecting your personal information, we will notify affected parties as required by law.

7. Data retention and deletion

• Shop account data and Client Data are retained while the Shop’s account is active.
• When a Shop closes its account (or asks us to), we delete the Shop’s data, including its Client Data, within a reasonable period, except where we must retain records to comply with law, resolve disputes, or enforce agreements (for example, opt-out records are kept so opt-outs stay honored, and payment records are kept as tax and accounting law requires).
• Shops can delete individual client records from their dashboard. Clients can erase a shop’s record of them with “Delete my data” on that shop’s page, or request deletion through the shop or via support@getchairback.com.
• Clients can delete their ChairBack app account at any time from the app’s Profile screen. That removes the account, its links to shops, its devices, and its pending sign-in codes. Each shop’s own record of the Client stays with that shop and can be erased as described above.

8. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, and to opt out of certain processing. State privacy laws (such as the California Consumer Privacy Act and similar laws in other states, including Delaware) may grant some or all of these rights. We honor valid requests regardless of where you live:

• Shop owners: you can view and edit most of your data in the dashboard, and can request an export or deletion at support@getchairback.com.
• Clients: because we process a shop’s records of you on that shop’s behalf, we may refer your request to your shop, or fulfill it with their direction. Your ChairBack app account is ours to answer for directly. We will never discriminate against you for exercising your rights.
• Messages: reply STOP to any text, use the unsubscribe link in any promotional email, or turn off notifications in your phone’s settings.
• Authentication of requests: we may need to verify your identity before acting on a request, and you may use an authorized agent where the law allows.

9. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child’s information has been provided to us, contact support@getchairback.com and we will delete it.

10. Where data is processed

The Service is operated from the United States and intended for U.S. businesses and their clients. If you access it from elsewhere, you understand your information will be processed in the United States.

11. Changes to this Policy

We may update this Policy from time to time. If a change is material, we will give notice (for example by email to Shop owners or a notice in the dashboard) before it takes effect. The dates above show when this Policy was last updated and when that version takes effect.

12. Contact us

Privacy questions or requests: support@getchairback.com.