1. Who we are
Barbly is online booking software for UK barbershops. It is run by Jonty Oglesby, a sole trader trading as Barbly (“Barbly”, “we”, “us”). For the personal data described in this policy, we are the controller: we decide how and why it’s used.
- Business
- Jonty Oglesby, a sole trader, trading as Barbly
- Address
- Postal address available on request at hello@barbly.uk
- hello@barbly.uk
- Data protection
- ICO registration: in progress
- VAT
- Not VAT registered
For anything about your data, email hello@barbly.uk. We read every message ourselves.
2. Who this policy covers
- Barbers and shop owners who sign up for Barbly, and their staff who have a Barbly login.
- Visitors to barbly.uk.
Booking a cut at a shop that uses Barbly? Then the shop is in charge of your details (it is the controller) and Barbly handles them for the shop, only on its instructions (we are its processor). Each shop has its own privacy notice, linked from its booking page and from every email it sends you, at an address like yourshop.barbly.uk/privacy. Below we explain what we do with that data on the shop’s behalf.
3. What we collect and why
Your account
- Your name, email address and password. We store passwords only as a scrambled one-way hash (scrypt), never as you typed them.
- 2-step verification, if you turn it on: your authenticator-app secret (stored encrypted), recovery codes (stored only as hashes) and passkeys (we hold only the public key; the private key stays on your device).
- Your role (owner or barber) and which shop and chair you work.
Your shop
- Shop name, address, phone, email and Instagram handle, your booking page’s words and design, your logo and photos, opening hours, services and prices, and your barbers’ names, roles, photos, working hours and time off.
- For each barber, the pay rule you set (owner, employed, commission or chair rent) and its history, and the takings, commission and rent Barbly works out from their bookings.
- Uploaded photos are resized and stripped of hidden metadata, such as the GPS location phones add.
Billing and payments
- Your plan, trial dates and subscription status. Card details for your Barbly subscription go straight to Stripe; we never see or store them.
- If you connect Stripe to take deposits, your Stripe account ID and whether card payments are switched on. Stripe collects your identity and bank details itself.
Security and support records
- Login sessions (when they started and when they expire), password-reset requests, and records of when Barbly support logged in to your account and why.
- Our servers see your IP address when you use Barbly, to deliver pages and to slow down repeated wrong passwords. To do that we keep short-lived counters keyed by IP address or email address, which are deleted automatically when their time limit ends (within 24 hours at most). We don’t otherwise store IP addresses.
When you contact us
- Your emails to us and our replies.
Visitors to barbly.uk
We don’t use analytics, advertising or tracking of any kind, and our pages don’t load anything from other companies’ servers (our fonts are hosted by us). If you’re not logged in, we don’t collect anything about you beyond what any web server needs to send you the page, unless you choose to join our waitlist, when we keep the details you give us (see below).
4. Our lawful bases
UK data protection law says we must have a lawful basis for each thing we do with personal data. Ours are:
| What we do | Lawful basis |
|---|---|
| Run your account and shop: booking pages, diary, client records, emails to your customers | Contract: it's the service you signed up for |
| Take payment for your plan, and manage trials, renewals and cancellations | Contract |
| Emails about your account: trial ending, payment problems, security alerts, deletion warnings, changes to our terms | Contract, and legitimate interests (keeping you informed about a service you use) |
| Keep accounts secure: 2-step verification, session records, limits on repeated logins, security alerts | Legitimate interests (protecting your account and your customers' data), and our legal duty to keep data secure |
| Support, including logging in as you to fix a problem (always recorded) | Legitimate interests (solving problems you've reported and keeping the service working) |
| The waitlist before launch: your name, shop name, email, mobile (optional), town, number of chairs, current booking system and any message, used only to contact you about joining Barbly | Steps you asked us to take before a contract: you asked us to contact you about joining |
| Keep invoices and payment records | Legal obligation (tax and accounting law) |
| Deal with legal claims or disputes | Legitimate interests (establishing or defending legal claims) |
| Process your customers' data on your behalf | We act as your processor under our Data Processing Agreement; you, the shop, choose the lawful basis |
Where we rely on legitimate interests we’ve weighed them against your rights, and you can object (see Your rights). We don’t send marketing emails at the moment. If we start, we’ll only email existing customers about Barbly, and every email will have a one-click unsubscribe.
5. Your customers' data: we're your processor
When customers book with your shop, their name, email, phone number, bookings, notes and payment status are stored in Barbly. For that data you are the controller and Barbly is your processor. We use it only to provide the service to you, as set out in our Data Processing Agreement, which is part of our Terms. We never sell it, never use it to market to your customers ourselves, and never share it with other shops.
The same applies to what you record about your staff in Barbly: their working hours and time off, pay rules, and the bookings and earnings Barbly works out for them. Staff who have their own login also have an account with us, covered by this notice.
We publish a privacy notice for your customers on your booking page (at /privacy on your shop’s address), filled in with your shop’s name and contact details, and link to it from the booking form and from every email we send for you. Please check it describes how you work.
6. Who we share data with
We use a small number of providers to run Barbly. Each only gets what it needs, is bound by a contract to protect it, and (apart from Stripe) may use it only on our instructions.
| Provider | What for | Where | Safeguards |
|---|---|---|---|
| IONOS (IONOS Cloud Ltd) | Hosts the Barbly servers, database, uploaded photos and nightly backups. | United Kingdom | Data stays in the UK. IONOS's data processing agreement applies. |
| Resend (Resend, Inc.) | Sends Barbly's emails: booking confirmations, reminders, cancellations, rebook emails and account emails. | Sent from Resend's EU region (Ireland). Resend is a US company and may access data from the USA. | Ireland is covered by UK adequacy regulations. For any access from the USA we rely on Resend's data processing agreement, which uses the International Data Transfer Addendum to the EU Standard Contractual Clauses (the "UK Addendum"), or on the UK Extension to the EU-US Data Privacy Framework where Resend is certified. |
| Cloudflare (Cloudflare, Inc.) | Runs the DNS for barbly.uk (turns names into server addresses). It does not carry or see our web traffic. | Global network, US company | Cloudflare only handles DNS lookups, which normally don't identify you. Where any transfer to the USA happens we rely on the UK Extension to the EU-US Data Privacy Framework (Cloudflare is certified) and Cloudflare's data processing agreement. |
| Stripe (Stripe Payments UK Ltd, Stripe Payments Europe Ltd and Stripe, Inc.) | Takes card payments: Barbly's own subscriptions, and deposits and prepayments that customers pay to shops through each shop's own Stripe account. | UK, Ireland and the USA | Stripe is an independent controller of payment data and has its own privacy policy (stripe.com/gb/privacy). For transfers to the USA, Stripe relies on the UK Extension to the EU-US Data Privacy Framework and the UK Addendum. |
Stripe is not our processor: it decides how to use payment data itself, under its own terms and privacy policy, as an independent controller. Shops contract with Stripe directly for card payments.
We may also share data with professional advisers (such as an accountant or solicitor) under a duty of confidentiality; with the police, HMRC, courts or regulators when the law requires it; and, if Barbly or its business is ever sold, with the buyer, who would have to treat it as this policy says.
Transfers outside the UK. Barbly’s servers and backups are in the UK. Where a provider handles data outside the UK, we rely on UK adequacy regulations (for the EEA), the UK’s International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework, as shown in the table. Email us for a copy of the relevant safeguards.
7. How long we keep data
| Data | How long |
|---|---|
| Your account, shops, and your customers' records | While your account is open |
| After you close your account | Deleted 30 days after you close it, in case you change your mind |
| Accounts that pause (trial ended without a plan, or the subscription ended or went unpaid) | Deleted 60 days after the account pauses. We email the owner 7 days before |
| Backups | Nightly, kept for 30 days, so deleted data is gone from backups within 30 days |
| Login sessions | Up to 30 days, or until you log out; expired ones are removed automatically |
| Password-reset links | Work for 1 hour; removed within a day of being used or expiring |
| 2-step sign-in in progress | 5 minutes |
| Records of support access and of account deletions | 24 months |
| Waitlist sign-ups | Deleted 12 months after you sign up if you haven't joined, or 6 months after we decline a sign-up. Once you join, kept with your account and deleted with it. Ask us to remove you at any time |
| Invoices and payment records | As long as tax law requires (at least 5 years after the 31 January filing deadline for the tax year) |
| Emails you send us | As long as needed to deal with them, and no more than 2 years after the conversation ends |
| Server error logs | Up to 30 days |
You can download your data at any time from Account & data in Barbly, and close your account there too.
8. How we keep data safe
- Every connection to Barbly is encrypted (HTTPS/TLS), including shop booking pages.
- Passwords, login sessions, reset links and recovery codes are stored only as one-way hashes. Authenticator secrets are encrypted (AES-256-GCM).
- 2-step verification (authenticator app or passkey) is available to every account, and required for Barbly staff.
- Repeated wrong passwords are slowed down, and we email you when security settings change.
- Everything is hosted on our own server in the UK, with nightly backups. Only Barbly’s operator has access to the server.
- Support can log in to your account only through an audited “log in as owner” tool that records who, when and which shop, and ends after 2 hours.
- Card numbers never touch our servers: Stripe handles them.
- Each shop’s data is kept separate from every other shop’s, and every request is checked against the logged-in shop.
No system is perfectly secure. If a breach affects your data and puts you at risk, we’ll tell you without undue delay, and tell the ICO within 72 hours where the law requires.
9. Your rights
You have the right to:
- Access: get a copy of the personal data we hold about you.
- Rectification: have anything wrong corrected (you can edit most of it yourself in Barbly).
- Erasure: have your data deleted (closing your account does this), unless we must keep something by law.
- Restriction: ask us to limit how we use your data while a concern is sorted out.
- Objection: object to anything we do based on legitimate interests, and to marketing at any time.
- Portability: get your data in a common machine-readable format (Account & data has CSV and JSON downloads).
To use any of these, email hello@barbly.uk from the address on your account (or tell us how we can confirm it’s you). It’s free, and we’ll answer within one month. For complicated requests we may need up to two more months, and we’ll tell you within the first month if so.
A shop’s customer? Contact the shop: it decides what happens to your booking details. If you can’t reach it, email us and we’ll pass your request on straight away.
10. Complaints
Please tell us first at hello@barbly.uk and we’ll try to put it right. You can also complain to the Information Commissioner’s Office, the UK’s data protection regulator: ico.org.uk or 0303 123 1113.
12. Children
Barbly accounts are for businesses, and you must be 18 or over to open one. Shops’ booking pages may be used by younger customers or by parents booking for them; the shop is responsible for those bookings as controller.
13. Changes to this policy
We’ll update this policy when the way we handle data changes. The date at the top shows the latest version. If a change matters to you, for example a new provider handling your data or a new use of it, we’ll email account owners before it takes effect.
Questions about this page? Email hello@barbly.uk.