Privacy Policy
1. Introduction
Taperfy ("Taperfy," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our website, progressive web application, and related services (collectively, the "Platform").
This Privacy Policy is designed to comply with the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's federal privacy legislation, and The Freedom of Information and Protection of Privacy Act (FOIP) of Saskatchewan, where applicable.
By using the Platform, you consent to the collection, use, and disclosure of your personal information as described in this Privacy Policy. If you do not agree, please do not use the Platform.
2. Information We Collect
2.1 Information You Provide Directly
Account Registration
- Full name
- Email address
- Phone number (when registering via phone OTP or provided optionally)
- Password (stored in hashed form by our authentication provider)
- Google account information (when using Google sign-in): name, email, and profile identifier
Barber Profile Information
- Professional title and biography
- Profile photo (avatar)
- Portfolio photos with captions
- Instagram handle
- Business address (shop address)
- City and neighborhood
- Services offered, including names, descriptions, durations, and pricing
- Availability schedule (days and hours of operation)
- Cancellation and deposit policies
Booking Information
- Selected service and style preferences
- Appointment date and time
- Special requests or notes you include with a booking
Payment Information
- Payment card details are collected and processed directly by Stripe, Inc. Taperfy does not store your full card number, expiration date, or CVV on our servers.
- We store a Stripe customer identifier and Stripe payment intent identifiers to track deposit and payment status.
Communications
- Emails or messages you send to us for support
- Notification preferences (SMS and email opt-in/opt-out choices)
Product Demo Requests
- Name and email address
- Shop or business name and team size
- Information you provide about your booking needs or business challenges
- Selected meeting time, timezone, and video meeting details
2.2 Information Collected Automatically
Device and Usage Data
- IP address
- Browser type and version
- Device type and operating system
- Pages visited and features used
- Date and time of access
- Referring URL
Location Data
- With your consent: We may collect your precise geolocation (latitude and longitude) from your device's browser to show nearby barbers and provide location-based discovery. You can grant or revoke location permission at any time through your browser settings.
- City preference: Your selected default city is stored to personalize your discovery experience.
Analytics
- We use PostHog for product analytics to understand how users interact with the Platform. This may include anonymized usage patterns, feature engagement, and session data.
Error Tracking
- We use Sentry for error monitoring. When errors occur, technical information such as stack traces, request context, and your user identifier may be captured to help us diagnose and fix issues.
2.3 Information Created Through Platform Use
- Appointment history and status (confirmed, completed, cancelled, no-show)
- Deposit and payment transaction records
- Cancellation history and reasons
- No-show count
- Barber-created client notes (private notes that a Barber may add about you for their own reference)
- Client flagging status (a Barber may flag clients for their own records)
- Notification delivery records (whether messages were sent, delivered, or failed)
- Waitlist entries and preferences
3. How We Use Your Information
We use your personal information for the following purposes:
| Purpose | Legal Basis (PIPEDA) |
|---|---|
| Creating and managing your account | Consent, contractual necessity |
| Processing and managing bookings | Contractual necessity |
| Processing deposits and payments | Contractual necessity |
| Sending appointment confirmations and reminders (email, SMS) | Consent, contractual necessity |
| Providing barber discovery and search by location | Consent (for geolocation), legitimate interest |
| Barber profile verification and admin review | Legitimate interest, platform safety |
| Managing subscriptions and billing | Contractual necessity |
| Scheduling, conducting, and following up on product demos | Consent, legitimate interest |
| Preventing fraud, no-shows, and platform abuse | Legitimate interest |
| Analyzing usage to improve the Platform | Legitimate interest |
| Diagnosing technical errors and issues | Legitimate interest |
| Complying with legal obligations | Legal obligation |
5. Data Storage and Security
5.1 Where Your Data Is Stored
Your personal information is stored on servers operated by Supabase in the Canada Central (ca-central-1) region. Backend API services are hosted on Fly.io in the Toronto (yyz) region. Some third-party service providers (Stripe, SendGrid, Twilio, PostHog, Sentry, Cal.com, and Google Meet) may process data in other jurisdictions, including the United States. Demo-booking information submitted through Cal.com is transferred to and processed in the United States.
When your data is transferred outside of Canada, we ensure that appropriate safeguards are in place, including contractual data protection agreements with our service providers that meet the requirements of PIPEDA.
5.2 Security Measures
We implement reasonable technical and organizational measures to protect your data, including:
- Encryption of data in transit (TLS/HTTPS)
- Encryption of data at rest (database encryption provided by Supabase)
- Secure password hashing (managed by Supabase Auth)
- JWT-based authentication with ES256 cryptographic signing
- Role-based access controls
- Row Level Security (RLS) policies on all database tables
- Tokenized payment processing through Stripe (no card data stored on our servers)
- Regular security reviews and monitoring
While we take reasonable steps to protect your information, no method of transmission over the internet or method of electronic storage is 100% secure. We cannot guarantee absolute security.
6. Data Retention
We retain your personal information for as long as necessary to:
- Provide the services you requested
- Comply with legal obligations (including financial record-keeping requirements)
- Resolve disputes and enforce our agreements
- Maintain business records as required by applicable law
Specific retention periods:
- Account data: Retained for the duration of your account. You may deactivate your account (data preserved, reactivate anytime) or request permanent deletion through your account settings. Upon deletion request, your account enters a 30-day grace period during which you can cancel. After 30 days, personal data is permanently removed. Financial transaction records are retained in anonymized form (your identity is removed) for a minimum of 7 years as required by Canadian tax law.
- Appointment and booking records: Retained for a minimum of 7 years for financial record-keeping and tax compliance purposes.
- Payment and transaction records: Retained for a minimum of 7 years as required by Canadian tax law.
- Communication logs (email/SMS delivery records): Retained for up to 2 years for service quality and dispute resolution.
- Product demo records: Retained for up to 2 years for sales follow-up and business record-keeping, unless you request deletion sooner.
- Analytics data: Retained in anonymized form. Anonymized data is not considered personal information.
- Error logs: Retained for up to 90 days.
7. Your Rights
Under PIPEDA and applicable privacy legislation, you have the right to:
- Access: Request a copy of the personal information we hold about you.
- Correction: Request correction of inaccurate or incomplete personal information.
- Withdrawal of consent: Withdraw your consent for the collection, use, or disclosure of your personal information at any time, subject to legal or contractual restrictions. Withdrawing consent may affect your ability to use certain features of the Platform.
- Deletion: Delete your personal information directly from your account settings. Account deletion includes a 30-day grace period, after which your data is permanently removed. Certain financial records are retained in anonymized form as required by law.
- Complaint: File a complaint with the Office of the Privacy Commissioner of Canada if you believe your privacy rights have been violated.
Account deletion can be done directly from your account settings. For access requests, corrections, or other privacy inquiries, contact us at privacy@taperfy.co. We will respond to your request within 30 days.
9. Children's Privacy
The Platform is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16, we will take steps to delete that information promptly. If you believe a child under 16 has provided us with personal information, please contact us at privacy@taperfy.co.
10. Location Data
We request access to your device's location to provide barber discovery features. Location access is optional and requires your explicit browser-level consent.
- Your last known latitude and longitude may be stored to personalize discovery results.
- You can revoke location permission at any time through your browser settings or by updating your preferences in the Platform.
- Your precise location is not shared with other users. Barbers see that you are in a general area, not your exact coordinates.
11. SMS and Email Communications
By providing your phone number and/or email address, you may receive:
- Transactional messages: Booking confirmations, appointment reminders (24 hours and 1 hour before), cancellation notices, payment confirmations, and account verification codes (OTP).
- Service messages: Stripe verification updates, subscription billing notices, profile approval notifications, and shop invitation notices.
You can manage your notification preferences (SMS and email opt-in/opt-out) in your account settings. Please note that certain transactional messages related to active bookings and account security cannot be opted out of.
Standard message and data rates may apply for SMS messages. Message frequency depends on your booking activity.
12. Barber-Specific Privacy Considerations
12.1 Public Profile
When you create a Barber profile, certain information is publicly visible, including your name, title, bio, profile photo, portfolio photos, services, pricing, shop address (if associated with a shop), city, neighborhood, and availability. You control what information you add to your profile.
12.2 Discoverability
Your profile may appear in search results and discovery pages. You can control your discoverability through the "accepting bookings" toggle. Profiles are only discoverable after admin approval.
12.3 Client Data
As a Barber, you may access client booking history, contact information, and no-show records through the Platform. You agree to handle this data responsibly and not to use it for purposes unrelated to your barbering services. You must not share client data with third parties without the client's consent.
12.4 Financial Data
Barber earnings, payout history, and Stripe account status are accessible only to the respective Barber and Taperfy administrators. This data is not shared publicly.
13. Third-Party Links
The Platform may contain links to third-party websites or services (such as Instagram profiles or Stripe) and embedded services such as Cal.com. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party services you access through the Platform.
14. International Data Transfers
While we primarily store data in Canada, some of our service providers operate in the United States and other jurisdictions. When your data is processed outside of Canada, it may be subject to the laws of those jurisdictions.
We ensure that all cross-border data transfers comply with PIPEDA requirements by entering into appropriate contractual arrangements with our service providers that ensure comparable levels of data protection.
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:
- Posting the updated Privacy Policy on the Platform
- Updating the "Last updated" date at the top of this page
- Sending you an email notification for material changes that affect your rights
Your continued use of the Platform after changes are posted constitutes acceptance of the updated Privacy Policy.
16. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Privacy Officer:
If you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada.