Back

Privacy Policy

Courtesy translation. If there is any difference, the Brazilian Portuguese version prevails.Ler o original em português

Privacy Policy

Updated on 3 Oct 2026For everyone

In short

A summary to make reading easier. The full text prevails.

1Who is responsible

Who is who
  1. BarbershopDecides why and how customer and team data is used
  2. Barba & CabeloProcesses this data on the barbershop's behalf, only to provide the serviceController of your account and platform data
  3. Customers and teamHave rights over their own data (LGPD)

The Barba & Cabelo app (available at beauty.contheiner.digital) is operated by:

  • Legal name: PROH MEDIA AGENCIA DE MARKETING LTDA - ME
  • CNPJ (Brazilian company registration): 65.789.160/0001-07
  • Privacy contact email: contato@contheiner.digital
  • Data Protection Officer (DPO): reachable at contato@contheiner.digital, which receives requests from data subjects and communications from the Brazilian National Data Protection Authority (ANPD).

For your account data and platform data, the company above is the controller. For the data each barbershop enters about its own customers and staff, the barbershop is the controller and Barba & Cabelo acts as a processor, handling that data only to provide the contracted service. When registering the barbershop, the owner accepts the Data Processing Agreement, which sets out these roles in detail.

This policy explains what data we process, why, how we protect it and how you can exercise your rights, in accordance with Brazil's General Data Protection Law (LGPD, Law 13,709/2018) and the Google API Services User Data Policy.

2What data we process

We process only what is needed for booking and barbershop management to work:

  • Account: name (entered at sign-up or provided by Sign in with Google), email, profile photo (if you upload one or it comes from Sign in with Google) and password — stored only as a hash, never in readable text;
  • WhatsApp number: required when signing up with email, for barbershop owners and for customers (people who sign in with Google add it later, in My profile). It is used for confirmations, reminders and verification codes. The number is confirmed with a code sent from the platform's WhatsApp (customers can leave this for later, in My profile); only a confirmed number receives booking notifications and can be used to sign in and reset your password with WhatsApp. WhatsApp notifications are on by default at sign-up, and each person decides whether to keep them: they can be turned off during sign-up or at any time in My profile;
  • Appointments: service, professional, date, time, status, visit history and the barbershop's loyalty club points;
  • Barbershop data: name, address, opening hours, services, prices, staff and settings entered by the shop's managers;
  • Optional preferences: permission for usage analytics, surveys and offers — all off by default and changeable in My profile → My data and privacy;
  • Google data, only if you use Sign in with Google or connect Google Calendar/Contacts (details in section 4);
  • Technical data: authentication session and technical logs of requests to the server (such as IP address, date and time), used for security and to fix errors.
  • Record of acceptance: the date and the versions of the Terms of Use and this Policy (and, for owners, the Data Processing Agreement) that you accepted, together with your age declaration, are recorded in your profile as proof of acceptance.

We do not ask for sensitive personal data as defined by the LGPD (such as health, religion, biometrics or racial origin). Even so, we handle passwords, access tokens, verification codes and contact details with the enhanced protections described in section 5.

3Why we use it and on what legal basis

Each use has a legal basis under article 7 of the LGPD:

  • Performance of the contract and the service (art. 7, V): creating and maintaining the account, booking and managing appointments, sending confirmations and reminders and running the loyalty club;
  • Consent (art. 7, I): Sign in with Google, the Google Calendar/Contacts connection, usage analytics, surveys and offers. You can withdraw consent at any time without losing the rest of the service;
  • Legitimate interest (art. 7, IX): account security, fraud and abuse prevention and technical improvement of the service, always respecting your rights and expectations;
  • Legal or regulatory obligation (art. 7, II) and regular exercise of rights (art. 7, VI): keeping records required by law and defence in legal proceedings.

We do not sell personal data, we do not use it for third-party advertising and we do not make automated decisions that produce legal effects on you.

4Google user data

Barba & Cabelo integrates with Google in two independent ways. Each one is enabled only by your own action, on Google's own consent screen, and accesses only what is described below.

Technical details of the Google integration

Sign in with Google (openid, email and profile scopes)

We receive your name, email address, profile photo and Google account identifier, only to create your account and authenticate access. This data stays in your account record for as long as the account exists. We never receive your Google password.

Google Calendar (scope https://www.googleapis.com/auth/calendar)

  • Calendar list: we read the list of calendars in the connected account (each calendar's name, ID and access level) only to show it to you so you can choose which one to sync; this list is not stored. We store only the ID and name of the calendar you choose.
  • Events from the chosen calendar: when you tap Sync calendar, we read events from 7 days before to 60 days after the current date and store only each event's title, start, end, whether it is all-day, the source calendar and the event link. We do not store the description, attendees, organiser, location or the full event. These events are shown only to you, under Settings → Notifications and integrations → Google Calendar and Contacts, in the “Upcoming Google Calendar events” list, so you can see busy times whilst managing bookings; no other barbershop member and no member of the public has access to them. The copy is refreshed on each sync and deleted when you disconnect or delete your account.
  • Copy of appointments (optional, off by default): if you turn it on, we create, update and remove events in the chosen calendar with the service, customer name, professional, barbershop and time of each appointment.

Google Contacts (scope https://www.googleapis.com/auth/contacts)

Used only to create a contact in your Google account when you ask to save a customer (the name, email, phone and note you provide). We do not read, copy or store your contact list.

For the Calendar and Contacts connection we also store the email of the connected Google account, the granted scopes and the access and refresh tokens issued by Google, protected as described in section 5. The tokens are kept on the server only and exist only while the connection is active.

How we protect Google user data

  • Encryption in transit: all communication with Google APIs and between the app and our servers uses HTTPS/TLS.
  • Tokens kept on the server only: access and refresh tokens are stored in a database table that cannot be read by the browser or through the app's public API. Only server functions use them, and only to call Google APIs on behalf of the person who connected the account; they are never sent to your device.
  • Only you can see your events: row-level security rules (Row Level Security) and a server function that checks your session ensure that only the person who connected the Google account can see the imported events — not the barbershop's staff, not customers and not the public.
  • Only what is needed: we store only each event's title, times and link, the chosen calendar and the connected account's email. Descriptions, attendees, locations and your contact list are not stored.
  • Protected secrets and administration: the Google OAuth client secret exists only in protected server variables, and the server administration panel sits on a private network (VPN).
  • Revocation and deletion: when you disconnect, we revoke access with Google and immediately delete the tokens and imported events; events outside the sync window are removed automatically (section 8). The other security mechanisms are listed in section 5.

Our commitments regarding Google user data

  • We use Google user data only to provide the user-facing features described above: signing in, syncing the calendar, showing you your upcoming imported events and saving contacts.
  • We do not sell Google user data and we do not use it for advertising, including personalised, retargeted or interest-based ads.
  • We do not use Google user data to develop, improve or train generalised artificial intelligence or machine learning models.
  • We do not transfer Google user data to third parties, except to the infrastructure processors needed to run the service (section 6) or when required by law.
  • No one on our team reads your Google user data, unless you give express consent for a specific case (for example, a support request you make), when necessary for security purposes (investigating abuse or an incident), to comply with the law, or in aggregated and anonymised form for internal operations.

Barba & Cabelo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect the integration at any time (section 11): when you disconnect, we revoke access with Google and delete the tokens and imported events. You can also revoke access directly at Google, at myaccount.google.com/permissions. To request deletion of any Google data we still hold, write to contato@contheiner.digital.

5Security and protection of sensitive data

We give enhanced protection to passwords, Google tokens, verification codes and customers' contact details. The mechanisms in place today are:

  • Encryption in transit: traffic between the app, our servers, Google APIs, the WhatsApp service and outgoing email uses HTTPS/TLS.
  • Database access control: tables have row-level security rules (Row Level Security). Each person can access only their own data and that of the barbershop where they have a role, according to the permissions set by the owner; sensitive actions go through server functions that check permission before running.
  • Isolation of Google tokens: they are kept on the server only, in a separate table that cannot be read by the browser or through the app's public API. Only server functions read, write, change or delete them, and only to call Google APIs; no user (not even you), barbershop or app administrator can see them through the app.
  • Secrets kept out of the code: Google credentials and database service keys exist only in protected server variables, never in the app on your device or in the source code.
  • Hashed passwords: the authentication service stores passwords only as a cryptographic hash (bcrypt); no one, not even our team, can see them.
  • Protected verification codes: codes sent by WhatsApp are stored only as a hash (SHA-256), are valid for 10 minutes, work only once and have a sending limit; 5 wrong attempts invalidate the code.
  • Protected Google connection: the authorisation request is signed (HMAC), tied to your account and expires in 10 minutes. Google returns the authorisation only to the redirect address registered in our project, and the code is exchanged for tokens on the server, using the app's secret key — tokens never pass through the browser. This way, someone else cannot link their Google account to your account in the app or reuse an intercepted authorisation.
  • Data minimisation: we ask only for data tied to the features you use; optional data stays off until you allow it, and when you withdraw permission the optional usage records are deleted.
  • Restricted administrative access: only the operator manages the infrastructure; the server administration panel sits on a private network (VPN), off the public internet, and direct database access is reserved for server functions and technical administration.
  • Technical logs: the server logs incoming requests (such as date, time, origin and result), which allows us to investigate unauthorised access and errors.

Staff and processors: anyone who works with us or provides infrastructure services accesses personal data only when needed for the task, under a duty of confidentiality, and is accountable for misuse. Processors handle data only according to our instructions and this policy.

Incident response: if a security incident occurs that may cause significant risk or harm, we will contain it, investigate the cause and notify the ANPD and the affected people, as required by article 48 of the LGPD, within the deadline set by ANPD regulations (currently 3 business days), describing the data involved, the risks, the measures taken and what you can do. To report a suspected incident, write to contato@contheiner.digital.

No system is completely immune to failures, so we review these protections continuously. You can help too: do not share your password or the codes you receive.

6Who we share data with

We do not sell or rent personal data. It is shared only in these cases:

  • The barbershop where you book: the owner, partners and authorised staff see the data needed to serve you (name, contact details and appointments), according to the shop's permissions;
  • Hosting and infrastructure: the virtual private server (VPS) contracted by the operator, which runs the database, authentication and server functions, and Hostinger, which hosts the website and domain;
  • Email: Hostinger's email service, used for account messages (such as confirmation and access recovery);
  • WhatsApp: messages go through our own Evolution API installation, on our own server, and are delivered by the WhatsApp (Meta) network to the number provided;
  • Google: only if you turn on Sign in with Google or the Calendar/Contacts connection, as described in section 4;
  • CEP lookup: when you fill in the barbershop address by CEP (Brazilian postcode), your browser sends only the CEP you type to ViaCEP, a free address lookup service. We don't send your name, email, phone or any other account data; as with any internet request, the service sees your device's IP address;
  • Authorities: when there is a legal obligation, a court order or a request from a competent authority.

These processors receive only what they need to perform their part of the service.

7International transfers

Some services we use may process data outside Brazil, such as Google (when you enable the integration) and WhatsApp. These transfers happen only in the cases allowed by article 33 of the LGPD — for example, when necessary to perform the service you requested or with your consent.

8How long we keep data

  • Account and profile: while the account exists; when you delete it, personal data is erased (section 11);
  • Appointments and history: while the account and the barbershop are active; after the account is deleted, only anonymous records remain, with no link to the person;
  • Google tokens and events: until you disconnect the integration or delete the account, when they are deleted immediately. We keep only events in the window from 7 days ago to 60 days ahead: on the next sync, we remove events that ended more than 7 days ago, events deleted in Google and events from a calendar that is no longer the chosen one;
  • Verification codes: each send records the request (number, account, time and the code's hash), used to check the code and limit sends; the code is valid for 10 minutes and unusable after use or after 5 wrong attempts;
  • Optional usage records: until you withdraw permission, when they are deleted;
  • Records required by law: for the legal period, such as application access logs for 6 months (Brazilian Internet Civil Framework, art. 15).

9Browser storage and cookies

The app stores on your device only what it needs to work:

  • Sign-in session, so you stay signed in securely;
  • Preferences: language, light or dark theme and other display choices;
  • Installed app files (PWA), which make screens open faster.

We do not use advertising cookies or third-party tracking tools. You can clear this data in your browser settings; doing so ends the session and resets preferences to default.

10Your rights

Under the LGPD (art. 18), you may request at any time:

  • confirmation that we process your data and access to it;
  • correction of incomplete, inaccurate or outdated data;
  • anonymisation, blocking or deletion of unnecessary or excessive data, or data processed in breach of the law;
  • portability of your data to another provider;
  • deletion of data processed on the basis of your consent;
  • information about who we share your data with and about the option of not consenting and its consequences;
  • withdrawal of consent and objection to processing that breaches the law.

Many actions you can take yourself in the app: edit your profile, change preferences, delete your account and disconnect Google. For anything else, write to contato@contheiner.digital. We may ask you to confirm your identity to protect your data, and we reply within 15 days.

If you are not satisfied with our answer, you can also file a complaint with the Brazilian National Data Protection Authority (ANPD) or the data protection authority in your country.

11Deleting your account and disconnecting Google

  • Permanently delete the account: in My profile → My data and privacy, the account holder can delete their own account without contacting support. Name, email, WhatsApp number and other personal data are removed. The barbershop's schedule and attendance records may remain only in anonymous form (not linked to the person), for operational statistics up to the date of deletion.
  • If you are an owner or partner of a shop, transfer the partnership or leave that role before deleting the account.
  • Disconnect Calendar/Contacts: in the shop dashboard, under Settings → Notifications and integrations → Google Calendar and Contacts, use the disconnect option. We immediately revoke the authorisation with Google and delete the tokens, the connected Google account's email and the imported events from our database. If the revocation with Google fails (for example, because of a network error or an already expired token), the app still disconnects and we tell you to remove access at myaccount.google.com/permissions. Events already copied to your Google Calendar stay there and you can delete them.
  • Revoke at Google: you can also remove Barba & Cabelo's access directly at Google, at any time, at myaccount.google.com/permissions.
  • When you delete your account, we ask Google to revoke the authorisation (if a connection exists) and delete the connection, the tokens and the imported events. To check, visit myaccount.google.com/permissions. Questions or deletion requests: contato@contheiner.digital.

12Children and teenagers

The app is not directed at people under 18. Teenagers should use it only with the permission and supervision of their parents or guardians, and we do not knowingly create accounts for children. If you become aware of a child's data entered without a guardian's consent, let us know at contato@contheiner.digital so it can be removed.

13Changes to this policy

We may update this policy to reflect changes to the service or to the law. The date at the top of the page indicates the current version. For significant changes, we will seek to inform you through the app's usual channels.