Privacy policy
1. Who we are
CutBook is operated by [Legal business name] ("CutBook", "we", "us"), [Mailing address, Ontario]. This policy explains how we handle personal information under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where they apply, provincial privacy laws such as Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25) and the Personal Information Protection Acts of British Columbia and Alberta.
2. Two different roles
Information about shops and their staff (who signs up, who signs in): we decide how it is used, and we are responsible for it.
Information a shop keeps about its own clients (names, phone numbers, appointments): the shop decides what to record and why, and the shop is responsible for it. We store and process it only on the shop's behalf, to provide CutBook to that shop. If you are a client of a barbershop and have a question about your information, please ask the shop first; we will help the shop answer you.
3. What we collect
| When | What | Why |
|---|---|---|
| You ask for access on our website | Shop name, your name, email, shop address, and optionally phone, number of chairs and a note. The internet (IP) address the request came from. | To confirm your email, check the shop is real (including looking up the address on a map), contact you, and set up your shop. The IP address is used only to stop spam. |
| You have a shop account | Owner email and password (stored only in scrambled, "hashed" form), shop name, address, timezone, hours, prices, tax settings, plan and trial dates. | To run your account and your book. |
| Someone signs in or out | Email used, time, whether it worked, IP address, approximate city and country, and browser and device type. | Security: spotting break-in attempts and showing the shop owner who has signed in. |
| A shop uses the book | Barber names, schedules, commission rates and an optional owner PIN (stored hashed); client names, phone numbers, email addresses and notes the shop adds; appointments, services, prices, discounts, tips, whether a visit was paid by cash or card, and a history of changes. | To provide the appointment book, checkout records and earnings reports to that shop. |
| You email us | Whatever you choose to send. | To answer you. |
What we never collect: card numbers or bank details. CutBook records only whether a visit was paid by cash or card; payments are taken on the shop's own card machine. We do not use advertising or analytics trackers.
4. Consent
By sending the request form or using CutBook, you agree to the uses described here. Shops are responsible for having their clients' consent to record their details and, where a shop uses appointment emails, to contact them. You may withdraw consent at any time by contacting us; if you do, we may no longer be able to provide the service.
5. Emails
We send only messages needed for the service: confirming your request, your invitation, password resets, and account notices. If a shop turns on appointment emails, CutBook sends its clients a booking confirmation and a reminder in the shop's name, and nothing else. We do not send marketing. Every message identifies who sent it, in line with Canada's anti-spam legislation (CASL).
6. Where your information is stored, and who helps us
Our database is hosted in Canada (Montréal). We use a small number of service providers, each bound by contract to protect the information and use it only to provide their service to us:
- Supabase: database, sign-in and server functions (Canada region).
- Amazon Web Services: hosting and delivering the website.
- Resend: sending email. Email addresses and message content pass through its servers, which may be located in the United States.
- Google Fonts: our home page loads fonts from Google, which receives your IP address when the page loads.
Where information is processed outside Canada, it is subject to the laws of that country, and may be accessed by its courts or authorities. For Quebec residents, we assess whether information is adequately protected before it leaves Quebec.
7. How long we keep it
- Requests whose email is never confirmed: deleted after 48 hours.
- IP addresses on requests: deleted after 30 days.
- Sign-in records: deleted after 6 months.
- A shop's data: kept while the account is open. After a shop closes its account, we delete its data within [90] days, except what we must keep by law (for example, billing records for tax purposes). Backups are overwritten within [30] days after that.
- Declined requests: deleted after [12] months.
8. How we protect it
Encryption in transit (HTTPS) and at rest; each shop can see only its own data, enforced by the database itself; passwords and PINs stored only in hashed form; two-step sign-in required for our own administrator access; limits on sign-in and request attempts; and a record of administrative actions. No system is perfectly secure, but we work to keep the risk low.
9. If something goes wrong
If a breach of security creates a real risk of significant harm, we will notify the affected shops and people as soon as possible, report it to the Office of the Privacy Commissioner of Canada (and any provincial commissioner that applies), and keep a record of it as the law requires. Where the breach involves a shop's client information, we will work with the shop so that clients are told.
10. Your rights
You can ask to see the personal information we hold about you, ask us to correct it, ask how it has been used and shared, and withdraw your consent. Quebec residents may also ask for their information in a structured, commonly used format, and ask us to stop using it or delete it in the cases the law allows. Write to [privacy@your-domain]. We answer within 30 days, free of charge, and will tell you if we need to confirm your identity first.
Shop owners can also export their client list from CutBook at any time.
11. Complaints
Please contact our privacy officer first; we would like the chance to fix it. You may also complain to the Office of the Privacy Commissioner of Canada, or, where their laws apply, Quebec's Commission d'accès à l'information, or the Information and Privacy Commissioner of British Columbia or of Alberta.
12. Children
CutBook is for businesses. We do not knowingly collect information directly from children. A shop may record a child's name for an appointment (for example, a kids' cut); that information is the shop's responsibility, as described in section 2.
13. Browser storage
CutBook stores a small amount of information in your browser so you stay signed in on that device and it remembers settings such as who is on the till. We do not use tracking cookies.
14. Changes
If we change this policy in a meaningful way, we will tell shops by email at least 30 days before it takes effect, and update the date above.
15. Contact
Privacy officer, [Legal business name]
[Mailing address, Ontario]
[privacy@your-domain]