Privacy Policy
This Policy describes how BarbaSync, a platform owned by EBP LTDA (CNPJ No. 11.059.503/0001-59), collects, uses, shares, and protects personal data, in compliance with the Lei Geral de Proteção de Dados (Brazilian General Data Protection Law, Lei nº 13.709/2018 — "LGPD"). By using the Platform, you agree to the practices described herein.
1. Who processes the data
With respect to the subscriber's registration data (the barbershop and its representatives), EBP LTDA (BarbaSync) acts as controller. With respect to the end customers' data entered by the barbershop (name, phone number, appointments), the barbershop is the controller and BarbaSync acts as processor, processing such data under the barbershop's instructions.
2. Data we collect
- Barbershop registration: name, e-mail, phone number, login credentials, and tax data (CPF/CNPJ, state registration, address) when provided.
- End customer data: name, phone/contact information, and appointment history, entered or generated when using the scheduling system.
- Payment data: processed by the payment provider (e.g., Mercado Pago). We do not store full card numbers.
- Usage data: technical information such as access logs, device, and browser, for security and service improvement.
3. Purposes and legal bases
| Purpose | Legal basis (LGPD) |
|---|---|
| Providing and operating the Platform (scheduling, management, reminders) | Performance of contract |
| Processing subscriptions and payments | Performance of contract / legal obligation |
| Issuing tax documents, where applicable | Legal obligation |
| Security, fraud prevention, and support | Legitimate interest |
| Communications about the service | Performance of contract / legitimate interest |
4. Data sharing
We share data only with service providers necessary to our operations, who process the information on our behalf, including:
- Google Firebase / Google Cloud — hosting, authentication, and database.
- Mercado Pago — payment processing.
- Bling — issuing orders/invoices and product management, when used.
- Correios — shipping cost calculation and delivery, where applicable.
- Google Ads — measuring the effectiveness of our ads. When a sign-up originates from an ad, we may send Google, in encrypted (hashed) form, data such as the e-mail address provided, for the sole purpose of confirming and measuring the conversion ("enhanced conversions" feature). This data is not used for any other purpose.
We do not sell personal data. Additional sharing may occur as required by law or by order of a competent authority.
5. International transfer
Some providers (such as Google) may store or process data on servers located outside Brazil. In such cases, we use providers that offer adequate safeguards for data protection, in accordance with the LGPD.
6. Cookies and similar technologies
We use cookies and local storage essential to the operation of the service (for example, keeping you logged in) and measurement/advertising cookies from Google (Google Ads), used to evaluate the effectiveness of our ads and sign-up conversions. You can manage cookies in your browser settings.
7. Data subject rights
Under the LGPD, data subjects may request: confirmation of processing, access, correction, anonymization, portability, deletion, and information about data sharing. To exercise these rights, contact us through the channel indicated below. Requests concerning a barbershop's end customer data should be directed to the respective barbershop (controller), which may engage BarbaSync as its processor.
8. Security and retention
- We adopt reasonable technical and organizational measures to protect data against unauthorized access, loss, or alteration.
- We retain data for as long as necessary for the purposes described and to comply with legal obligations. Once the account is closed, data may be deleted or anonymized, except where retention is legally required.
9. Data Protection Officer (DPO) and contact
For questions about privacy and data protection, contact our Data Protection Officer at contato@barbasync.com.br.
10. Changes to this Policy
This Policy may be updated from time to time. The "last updated" date at the top indicates the version in effect. Material changes will be communicated through the available channels.