Privacy policy

Last updated 2026-10-12

Cutseat is online appointment booking software for barbershops. This policy explains what personal data we handle, why, and what rights you have over it. It covers both the shops that pay for Cutseat and the clients who book an appointment through a shop’s page.

Who is responsible for your data

Cutseat is operated by Cutseat, a sole operator based in Ethiopia. You can reach us at hello@cutseat.com.

There are two different relationships here, and the distinction matters for your rights:

• Shop accounts. When a barbershop signs up, we are the controller of that shop’s account data — we decide how it is used.
• Booking data. When a client books an appointment, the barbershop is the controller of that client’s data and we act as its processor. We handle the data on the shop’s instructions, to run the booking service. If you are a client wanting your details changed or deleted, the shop can do that directly, and you can also contact us and we will act on it.

What we collect

From barbershops

• Account details: name, email address, password (stored hashed, never in readable form).
• Shop details: shop name, address, opening hours, logo, time zone, barbers, services and prices.
• Subscription status and billing history. Card details are handled entirely by our payment provider and never reach our servers.
• Basic technical logs — IP address, browser, pages visited — used to keep the service secure and working.

From clients booking an appointment

• Name and mobile number. Email address only if you give one.
• Your appointments with that shop: barber, service, date and time, and whether you attended, cancelled or did not show up.
• A record of your consent to receive WhatsApp messages, including the time you gave it and the IP address it came from. WhatsApp requires us to be able to prove that consent was given.
• A log of the messages we sent you and whether they were delivered.

You do not need an account to book, and we do not ask you to create one.

Why we use it, and our legal basis

• To run the booking service — taking the appointment, showing it to the shop, letting you cancel or move it. This is necessary to perform the contract between the shop and us, and between you and the shop.
• To send appointment messages on WhatsApp — confirmations and reminders. We send these on the basis of the consent you give on the booking form, and you can withdraw it at any time.
• To take payment from shops — necessary to perform our contract with the shop.
• To keep the service secure and prevent abuse — rate limiting, spam protection and error logging, on the basis of our legitimate interest in a service that is not abused. This matters particularly because every booking sends a paid message.

We do not sell personal data, we do not use it for advertising, and we do not advertise other barbershops to a shop’s clients.

Who we share it with

We use a small number of service providers, each handling data only to provide their part of the service:

• Supabase — database and account hosting, in the United Kingdom (London).
• Vercel — application hosting.
• Twilio and Meta (WhatsApp) — delivering your appointment messages. Meta’s own handling of WhatsApp messages is governed by its terms.
• Resend — sending email, where an email address was given.
• Dodo Payments — subscription payments from shops. Dodo acts as merchant of record and handles card data; we never see it.
• Cloudflare — protecting the booking form from automated abuse.
• Sentry — error reports, used to find and fix faults.

We may also disclose data where the law requires it. We are not in the business of handing over your details otherwise.

Where your data is stored

Shop and client data is stored in the United Kingdom (London). Because Cutseat is operated from Ethiopia and some of the providers listed above operate internationally, your data may be accessed from or transferred outside the United Kingdom. Where that happens we rely on appropriate safeguards, such as the UK International Data Transfer Agreement or an adequacy decision, and we limit access to what is needed to run and support the service.

How long we keep it

• Appointment and client records — kept while the shop’s account is active, because shops rely on visit history. Deleted within 90 days of a shop closing its account, unless the shop asks us to delete sooner.
• Message and consent logs — kept for two years, to evidence consent and to investigate delivery problems.
• Billing records — kept as long as tax and accounting rules require.
• Technical logs — kept for up to 90 days.

Stopping WhatsApp messages

Reply to any message asking us to stop, and we will stop sending to that number. We record the opt-out so it is not overridden by a later booking. Your appointment itself is unaffected — you would simply not receive reminders, so the shop may call you instead.

Your rights

If you are in the UK or the EU, you have the right to ask for a copy of your personal data, to have it corrected or deleted, to object to or restrict how it is used, to withdraw consent, and to receive it in a portable form. Email hello@cutseat.com and we will respond within one month.

If you are unhappy with how we have handled your data, you can complain to the UK Information Commissioner’s Office at ico.org.uk, or to your local data protection authority.

Cookies

The booking page sets no tracking or advertising cookies. The shop dashboard sets a cookie to keep you signed in, which is necessary for it to work. We use no advertising networks and no third-party analytics that profile you.

Children

Cutseat is sold to businesses and is not aimed at children. A parent or guardian booking an appointment for a child should give their own contact details.

Changes

If we change this policy we will update the date above, and we will tell shops by email about any change that materially affects them.