Privacy Statement

QBarber is a barbershop queue-management platform provided to barbershops, shop owners, barbers, and their customers. The platform includes the public website, shop-owner portal, admin console, barber tablet, in-shop kiosk, customer mobile application, and public display.

QBarber operates in the United Kingdom and processes personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Depending on the circumstances, QBarber may act as:

• Data controller for website visitors, shop-owner and staff accounts, billing information, and platform administration; and
• Data processor for operational customer queue data that a barbershop collects in the course of serving its own customers. In that case, the relevant shop is the data controller and QBarber processes that data on the shop’s instructions in order to provide the service.

By using QBarber, you acknowledge that you have read this Privacy Statement. If you do not agree with it, you should not use the service.

We collect only the information needed to operate, secure, and improve the QBarber service. The categories below depend on how you use the platform.

2.1 Customers joining a queue

Where provided or generated through check-in, this may include:

• Name or a friendly display label
• Contact details, if you choose to provide them
• Queue information, such as position, preferred barber, ticket status, estimated wait, and timestamps
• Device or client identifiers used to keep your ticket on your phone, kiosk session, or display
• Push-notification tokens or subscriptions, if you enable queue alerts

2.2 Shop owners, barbers, and administrators

• Name, email address, and phone number
• Login credentials (stored in hashed form) and session data
• Shop configuration, including shop name, address, postcode, opening hours, branding, and queue settings
• Barber profiles, availability, and status
• Billing and subscription details, including payment-related identifiers processed via our payment provider
• Support, audit, and operational logs generated when using admin or shop-owner tools
• Loyalty configuration and related customer-reward settings, where enabled

2.3 Website and service usage

• Technical data such as IP address, browser type, device type, and approximate location derived from IP or shop address
• Security and diagnostic logs needed to operate and protect the service
• Cookies and similar technologies, as described in the cookies section below
• Device identifiers and pairing tokens used to link tablets, kiosks, and displays to the correct shop

We do not require special-category data (such as health, biometric, or ethnicity data) to use QBarber, and we ask that you do not submit such information through the service.

We use personal data to:

• Provide queue management, live wait-time updates, kiosk check-in, barber status, and public display
• Create and administer shop-owner, barber, and admin accounts
• Process subscriptions, invoices, and related billing
• Send service messages, such as magic links, password resets, queue notifications, and operational alerts you have requested
• Maintain shop configuration and pairing for kiosk, tablet, and display devices
• Produce operational analytics for the relevant shop and for platform reliability (for example, queue performance and wait-time accuracy)
• Detect, investigate, and prevent fraud, abuse, and security incidents
• Provide controlled impersonation tools for authorised staff (such as administrators or shop owners) to assist with support, troubleshooting, and account recovery — these actions are logged and monitored for security
• Process shop status, billing status, and compliance information to determine whether a shop can continue using the service, including temporary suspension for non-payment or policy violations
• Operate optional loyalty or reward features offered by the shop, where enabled
• Generate queue analytics, wait-time estimates, and operational insights for shops
• Support operational features that may use automated or AI-assisted processing to improve queue predictions, reliability, or support workflows (these do not involve automated decision-making with legal or significant effects)
• Comply with legal obligations and respond to lawful requests
• Improve the safety, performance, and usability of QBarber

Impersonation and role-based access

QBarber provides controlled impersonation features that allow authorised users (such as administrators or shop owners) to temporarily view or act through another role within their own shop environment, for example to test queue behaviour, assist with support, or help staff recover access. These features are restricted to the relevant shop’s data, are subject to role-based access controls, and are logged for audit and security purposes. Impersonation is intended for legitimate operational use only. Misuse of impersonation tools may result in suspension of access and, where appropriate, notification to the affected shop or authorities.

QBarber does not sell personal data. We do not share personal data with third parties for their own marketing.

We process personal data only where a lawful basis under UK GDPR applies. Depending on the activity, this is typically:

• Contract (Article 6(1)(b)): to provide the QBarber service to shop owners and to operate a queue ticket you have requested.
• Legitimate interests (Article 6(1)(f)): to secure the platform, prevent misuse, produce operational analytics, and improve the service, where those interests are not overridden by your rights.
• Consent (Article 6(1)(a)): where required, for example optional push notifications or non-essential cookies. You may withdraw consent at any time.
• Legal obligation (Article 6(1)(c)): for example retaining billing records for tax and accounting requirements.

Where QBarber acts as a processor for a shop, the shop determines the purpose of processing customer queue data. That shop is responsible for ensuring it has a lawful basis to collect that data from its customers.

We share personal data only where necessary to provide the service, to comply with the law, or with your instruction. Recipients may include:

• The barbershop you are visiting or managing, so staff can serve the queue
• Infrastructure and hosting providers, including Vercel (application hosting) and Cloudflare (content delivery, security, and network services)
• Payment processors, including Stripe, which processes subscription and hardware-order payments. QBarber does not store full payment-card numbers
• Transactional email providers, used to send account, billing, and service emails
• Database and infrastructure operators that host QBarber’s operational systems
• Professional advisers or authorities, where required by law or to establish, exercise, or defend legal claims

We may also use limited analytics tools to understand how the website and applications are used, so that we can keep the service reliable. These tools are used for service improvement, not to sell your data.

All processors are required to process personal data only on our instructions (or the relevant shop’s instructions, as applicable) and to implement appropriate security measures.

Where QBarber acts as a processor for a shop, our Data Processing Agreement (available at https://staging.qbarber.co.uk/dpa) applies.

QBarber uses cookies and similar technologies that are necessary to operate the service. These include cookies and storage used for:

• Authentication and session management
• Keeping you signed in to shop-owner, admin, or staff tools
• Security features such as CSRF protection
• Remembering a selected shop, ticket, or interface preference during your visit

These cookies are strictly necessary for the service to function. You can block cookies in your browser, but parts of QBarber (including login and queue tracking) may then be unavailable.

If we introduce non-essential analytics or marketing cookies, we will provide appropriate information and obtain consent where required by UK law.

We retain personal data only for as long as needed to deliver the service, meet contractual and legal obligations, resolve disputes, and maintain security.

• Active queue tickets are kept while you are in the queue and for a short operational period afterwards so the shop can complete service and handle no-shows or follow-up.
• Completed or cancelled queue records may be kept for a limited period for operational analytics, support, and dispute handling, after which they are deleted or irreversibly aggregated where practicable.
• Shop-owner and staff account data is kept for the life of the account and for a reasonable period after closure to complete billing, security, and legal requirements.
• Billing and invoice records are retained for the period required by UK tax and accounting law, which is typically up to six years.
• Security and diagnostic logs are retained for a limited period unless a longer period is needed to investigate an incident.

When data is no longer required, we delete it or anonymise it so that it can no longer identify you.

Impersonation and administrative-action logs are retained for a reasonable period for security, audit, and fraud-prevention purposes.

We implement technical and organisational measures appropriate to the risk, including:

• Encryption of data in transit (HTTPS/TLS)
• Role-based access control across shop-owner, barber, support, and admin tools
• Restricted administrative access to production systems and customer data
• Hashed storage of passwords and similar secrets
• Session controls, authentication gates, and monitoring for suspicious activity
• Separation of environments and least-privilege access for operational staff

No method of transmission or storage is completely secure. We work to protect personal data, but we cannot guarantee absolute security. Please keep your login details confidential and tell us promptly if you suspect unauthorised access.

QBarber is operated from the United Kingdom. Some of our processors, including Vercel, Cloudflare, and Stripe, may process data in the United Kingdom, the European Economic Area, the United States, or other countries.

Where personal data is transferred outside the UK, we ensure that an appropriate safeguard is in place, such as:

• A UK adequacy regulation; or
• The UK International Data Transfer Agreement / Addendum, or another lawful transfer mechanism.

You may contact us if you would like more information about the safeguards that apply to a particular transfer.

Subject to the conditions and exemptions in UK data-protection law, you have the right to:

• Be informed about how we use your personal data
• Access a copy of your personal data
• Have inaccurate or incomplete data corrected
• Request erasure of your personal data in certain circumstances
• Restrict or object to certain types of processing
• Receive your data in a portable format and, where technically feasible, have it transmitted to another controller
• Withdraw consent where processing is based on consent, without affecting processing that took place before withdrawal
• Lodge a complaint with the Information Commissioner’s Office (ICO)

To exercise these rights, email hello@qbarber.co.uk. We may need to verify your identity before fulfilling a request. If QBarber holds your data only as a processor for a shop, we may refer your request to that shop as the controller.

The ICO is the UK supervisory authority. You can contact the ICO at ico.org.uk.

QBarber is a business service for barbershops and is not directed at children. We do not knowingly collect personal data from children under 16.

If you believe we have collected personal data from a child under 16, please contact us and we will take reasonable steps to delete it promptly, unless we are legally required to retain it.

We may update this Privacy Statement from time to time, for example to reflect changes in the service, processors, or the law. The “Last updated” date at the top of this page will change when we do so.

Where a change is material, we will take reasonable steps to bring it to your attention, such as a notice on the website or an email to account holders. The current version published at https://staging.qbarber.co.uk/privacy is the version that applies.

For privacy questions, requests, or complaints, contact QBarber at:

If you are not satisfied with our response, you may complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint.