BACKBAR · privacy policy

Privacy Policy

Last updated: June 30, 2026

This Privacy Policy explains how BACKBAR ("BACKBAR," "we," "us," or "our") collects, uses, shares, and protects information in connection with our website, dashboard, and services (the "Service"). It applies to people who visit our site, create an account, or otherwise use the Service. Your data exists to make your week easier, not to be packaged, profiled, or sold.

Two roles, in plain terms. For your account and how you use BACKBAR, we are the "controller." For the personal information you enter about your clients, you are the controller and BACKBAR acts as your "processor," handling that information only on your instructions to run the Service for you.

1. Information we collect

Information you give us

Account and profile: your name, email address, password (stored only as a salted hash), business name, public handle, role (for example stylist, salon owner, or booth renter), timezone, currency, and any profile photo or business logo you upload.
Content you create: clients and their details (name, phone, email, notes, and service history or formulas you record), appointments, services, products and shopping lists, income and expense entries, booth-rent and commission terms, in-app messages, and anything else you add.
Billing: your subscription plan and billing email. Your subscription card is collected and stored by our payment processor, Stripe; we receive limited details such as the card brand and last four digits, never the full card number.
Payments you collect from clients: when you charge a client through the Service, we store the amount, status, and related identifiers. The client's card details are handled by Stripe, not by BACKBAR.
Support and communications: messages you send us and our replies.

Information we collect automatically

Usage and device data: sign-in timestamps, approximate device and browser type, and IP address, used to operate and secure the Service and spot suspicious activity.
Cookies and local storage: we use strictly necessary cookies and browser storage to keep you signed in and to remember preferences (such as your theme). We do not use advertising or cross-site tracking cookies.

2. What we do not collect or do

We do not track you across other websites or apps.
We do not embed third-party advertising or marketing pixels.
We do not sell your personal information or your clients' personal information.
We do not read your client list or your books to build profiles, and we do not use Your Content to train machine-learning models.

3. How we use information

To provide, maintain, and improve the Service and its features.
To create and secure your account and authenticate sign-ins.
To process your subscription and the payments you collect from clients.
To send operational and transactional messages (confirmations, reminders, security and billing notices).
To provide support and respond to your requests.
To detect, prevent, and address fraud, abuse, and security or technical issues.
To comply with law and enforce our Terms of Service.

Where required, our legal bases are: performing our contract with you, our legitimate interest in operating and securing the Service, your consent (which you can withdraw), and compliance with legal obligations.

4. How information is shared

We share information only as described here:

Service providers (sub-processors) who help us run BACKBAR under contract, including Supabase (database, authentication, and hosting), Stripe (payments), and Resend (transactional email delivery). They may process data only for us, on our documented instructions, and only to provide their services. A current list of sub-processors is available on request, and we will take reasonable steps to notify affected customers before adding a new sub-processor that materially changes how we process personal data on their behalf. A Data Processing Addendum (DPA) is available on request for customers who need one.
Connections you authorize. If you connect with a salon owner or another professional, we share the limited information described in "Connections" below, and only while the connection is active.
Legal and safety. When we believe it is reasonably necessary to comply with law, enforce our terms, or protect the rights, property, or safety of anyone.
Business transfers. If BACKBAR is involved in a merger, acquisition, or sale of assets, data may transfer as part of that transaction, subject to this Policy.

5. Connections and what others can see

By default, only you can see your data. BACKBAR uses database row-level security, so every record is filtered by your user id before it leaves the server; another signed-in user cannot retrieve a record that belongs to you. If you choose to connect with a salon owner or another professional:

They see the aggregated weekly shopping list rolled up from your appointments, not the appointments themselves or which client is getting what.
If a commission or booth-rent arrangement is attached, they see the totals for the period, not the per-client detail.
They may see busy-time blocks on a shared schedule, without client names or amounts.
They never see your client list, your full appointment list, your books, or your notes.
You can revoke a connection at any time from Settings, and sharing stops immediately going forward.

6. Your clients' personal information

When you enter information about your clients, you are responsible for having a lawful basis to do so and for giving your clients any notices or choices the law requires. BACKBAR processes that information only to provide the Service to you and on your instructions, retains it while your account is active, and deletes or returns it as described below or when you direct us to. A data processing addendum is available on request at info@backbar.studio.

7. Data retention

We keep your information for as long as your account is active and as needed to provide the Service. When you delete specific records, they are removed from active systems and purged from routine backups in the normal backup cycle. When you delete your account, we hard-delete your data within 30 days, except where we must retain limited records to comply with law, resolve disputes, or enforce our agreements. We may keep aggregated or de-identified data that cannot reasonably be linked to you.

8. Security

We protect data with measures including encryption in transit (HTTPS), database row-level security, salted password hashing handled by our authentication provider, access controls, and optional two-factor authentication you can turn on in Settings. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. Keep your own copies of important data, use a strong password, and if something feels off, change your password and email info@backbar.studio. If a breach affects your personal information, we will notify you and any applicable regulators without undue delay and within the timeframes required by applicable law.

9. Your privacy rights

Depending on where you live, you may have the right to access, correct, delete, export (port), restrict, or object to the processing of your personal information, and to withdraw consent. You can do most of this yourself in the app:

Access and correct: your information is viewable and editable in-app at any time.
Export: download your account data from Settings.
Delete: delete your account from Settings.
Requests: for anything else, email info@backbar.studio. We will respond within the time the law requires and will not discriminate against you for exercising your rights.

If you are in the EU/UK, you may also lodge a complaint with your local data-protection authority. California residents have rights under the CCPA/CPRA, including the right to know, delete, and correct, and the right to opt out of "sale" or "sharing" of personal information; we do not sell or share personal information as those terms are defined.

10. International data transfers

Your data is stored in the United States by default. We can provision new accounts in the EU region on request before account creation. Where we transfer personal information across borders, we rely on appropriate safeguards such as Standard Contractual Clauses where required.

11. Children

The Service is intended for people 18 and older and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact us and we will delete it.

12. Third-party links

The Service may link to third-party sites or services (for example, Stripe). We are not responsible for their privacy practices, and this Policy does not apply to them. Review their policies before providing information.

13. Changes to this Policy

If we change this Policy in a way that materially affects you, we will email you or notify you in-app at least 14 days before the change takes effect. Minor corrections (such as typos or link fixes) may be posted here without separate notice. The "Last updated" date above always reflects the current version.

14. Contact

Questions, requests, or concerns about privacy? Email info@backbar.studio.