Skip to content
← Back to BarberJarvis

Privacy Policy — BarberJarvis

Last updated: May 7, 2026 · Compliant with LGPD (Brazil) and GDPR-aligned

1. Who we are

BarberJarvis is developed and operated by Play Hard Studio, a Brazilian digital product studio based in São Paulo, Brazil. For the purposes of this Policy, we are the controller of your personal data.

Data Protection Officer (DPO): [email protected]

2. What we collect

2.1. Data you provide

  • Customer signup: name, email, password (stored as bcrypt hash — never seen in plain text).
  • Optional profile: phone, profile picture, notification preferences.
  • Barbershop owner signup: business name, tax ID, address, billing details (processed by Asaas — we do not store card numbers).

2.2. Data collected automatically

  • Usage: bookings created, services purchased, barbers chosen, times, amounts paid.
  • Technical: device model, OS version, language, time zone, anonymous installation identifier (push token).
  • Audit logs: who changed what and when, for critical tables; retained for 12 months for support and incident investigation.

2.3. What we do NOT collect

  • Precise location (GPS) — the app never requests location permission.
  • Phone contacts.
  • Microphone, camera or photos (except if you choose to upload a profile picture — in which case only the picture you select).

3. How we use your data

We process data under these legal bases:

  • Contract performance — operate the booking service, process payments, send reminders.
  • Legitimate interest — improve product, detect fraud, generate anonymized aggregate reports.
  • Consent — send promotional push notifications (revocable in Settings → Notifications).
  • Legal obligation — preserve fiscal and accounting records as required by Brazilian law.

4. With whom we share

We do not sell your data. We share with the following essential processors only:

  • Supabase (database, authentication) — self-hosted on our own VPS in Brazil.
  • Asaas (payment processing) — owners only, minimum necessary data for recurring billing.
  • Apple Push Notification service (APNs) and Firebase Cloud Messaging (FCM) — to deliver push notifications.
  • Public authorities — only upon valid judicial or administrative request.

5. Retention

  • Active account: while your account exists.
  • After cancellation: 30 days for data export, then permanently deleted.
  • Fiscal data (invoices, receipts): 5 years per Brazilian tax law.
  • Audit logs: 12 months.

6. Your rights

You may:

  • Confirm we process your data
  • Access your data
  • Correct incomplete, inaccurate or outdated data
  • Anonymize, block or delete unnecessary data
  • Request data portability (export in readable format)
  • Withdraw consent

To exercise any of these rights, write to [email protected]. We respond within 15 business days.

7. Security

Technical measures we take:

  • TLS 1.2+ for all client-server traffic.
  • Row-Level Security at the database — each barbershop only accesses its own data, validated by cross-tenant invasion tests in May 2026.
  • Passwords stored with bcrypt — we have no access to the original text.
  • Audit log of all writes to critical tables.
  • Daily database backups with 30-day retention.

8. Children and minors

BarberJarvis is intended for users 18+. We do not knowingly collect data from minors. If we identify a minor's signup without parental consent, the account will be terminated immediately.

9. Cookies and identifiers

The mobile app only uses secure local storage (Keychain/Keystore) for your login session. There are no third-party tracking cookies or advertising pixels.

10. Policy updates

This Policy may be updated. When changes are material (affecting your rights or how we process data), we will notify you by email and/or push notification at least 30 days in advance. Historical versions are available upon request to the DPO.

11. Contact

Questions, rights exercise, or complaints related to this Policy:
Play Hard Studio — Data Protection Officer
[email protected]