How we collect, use, and protect your personal information.
Last updated: 24 September 2026
This Privacy Policy explains how Ntapers Brockley Limited ("Neck Tapers", "we", "us", "our") collects, uses, stores and protects your personal data when you use our mobile application (the "App") and our barbering services. We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
This Privacy Policy should be read alongside our Terms and Conditions.
We are the data controller responsible for your personal data.
If you have any questions about this Privacy Policy or how we handle your personal data, please contact us at necktapers@gmail.com.
You can create or access an account using an email address and password, Sign in with Apple, or Sign in with Google.
When you create or complete your account, we may ask you to provide:
We do not ask for your birth year through the birthday field.
When you sign in with Apple or Google, we receive certain information from those providers, which may include:
We do not receive your Apple or Google password. The information we receive is governed by the privacy settings you have chosen with Apple or Google.
Payments and saved payment methods are handled by Stripe, our payment processor. We do not collect or store your full card details.
Stripe may provide us with limited information such as:
No payment is taken and no funds are held when you make a booking. The saved payment method may be charged only where an applicable no-show or late-cancellation fee is due under our Terms.
Stripe processes payment information under its own privacy policy: https://stripe.com/gb/privacy.
We may process:
The iOS App uses Sentry for crash and reliability reporting. Default personal-information collection is disabled, diagnostic content is scrubbed before transmission, and performance tracing and profiling are disabled.
We do not use third-party advertising SDKs or cross-app advertising trackers.
We use your personal data for the following purposes:
We send transactional emails (via our email provider, Resend) for:
These are service messages we need to send to operate your account and bookings — they are not marketing.
If you opt in to push notifications, we will use them to:
You can turn push notifications on or off at any time from within your device settings or the App settings.
We use information from bookings, services and loyalty stamp activity to understand and improve our business. Examples include:
Where reasonably possible, we look at this information at an aggregated level. We do not share this analysis with third parties for advertising or marketing purposes.
After older settled records are archived and removed from the live service, online analytics cover only records still held online and should not be understood as complete lifetime history. Older business reports are available through the encrypted archive.
Under UK GDPR, we must have a lawful basis for processing your personal data. The bases we rely on are:
We do not sell your personal data. We share it only with the following categories of recipients, and only to the extent necessary:
We use the following service providers where necessary to operate the App:
Supabase: Hosts authentication, the live database and backend services. The project is hosted in Ireland.
Stripe: Saves payment methods and processes applicable charges, refunds and payment disputes.
Resend: Sends transactional emails, including booking confirmations, receipts and customer-report responses.
Sentry: Receives scrubbed iOS crash, app-hang and diagnostic information used to maintain reliability.
Apple and Google: Provide sign-in, platform and notification services where applicable.
These providers may retain limited records under their own legal, security, fraud-prevention and backup obligations. Our archive process does not delete records independently retained by these providers.
Your personal data is primarily stored within the UK and European Economic Area (EEA):
Where personal data is transferred outside the UK/EEA, we rely on appropriate safeguards as required by UK GDPR, such as:
If you would like more information about a specific transfer, please contact us.
We keep personal information only for as long as it is needed for the purposes described in this Policy, including providing the service, resolving financial or customer-support matters, preventing abuse and meeting accounting or legal obligations.
While your account is active, we keep the information needed to operate your account, bookings, active loyalty card, customer support and unresolved financial matters.
A loyalty card expires 12 months after the first stamp on that card. All stamps on that card expire together.
Eligible settled earnings and supporting historical records may be exported to the owner’s paired Mac. Automatic archiving can run every 14 days after a successful archive, and a successful manual archive restarts that period.
The server removes an eligible archived record only after the Mac has durably saved, reopened and verified an encrypted copy and the server has rechecked the exact deletion batch. If the Mac is unavailable or verification fails, the data remains online.
Accounts, live loyalty stamps, future or open bookings and unresolved financial obligations are not removed by this archive process.
You can delete your account from within the App or contact us for assistance. Your active profile is deleted or anonymised, and unused loyalty stamps and rewards are lost.
We may retain the following limited records after deletion:
Accounting and transaction records: Records required for tax, accounting, dispute or legal purposes may be kept for the applicable legal period, including up to 6 years where required by HMRC.
Unpaid fees: If a no-show or late-cancellation fee remains unpaid, we keep your first name, normalised mobile number, amount, fee type, date incurred and booking reference. We do not keep your surname, email address or full card details in this debt record. The record is deleted automatically 12 months after it is created. That period is fixed and is not extended by settlement, waiver or a later fee. We rely on Article 17(3)(e) of the UK GDPR where retention is necessary for the establishment, exercise or defence of legal claims.
One-time-offer protection: We may retain only a normalised mobile number and promotion identifier to prevent the same one-time offer being claimed again after deletion and re-registration. This minimal key contains no name, email address, amount or redemption date. We rely on our legitimate interest in preventing repeated offer abuse. This key currently has no automatic expiry and is kept while needed to enforce the one-time nature of the relevant offer.
Encrypted historical archive: Historical information already exported from the live service may remain in the encrypted archive on the owner’s paired Mac for business, accounting, dispute-resolution or legal purposes.
When an account is deleted, we request removal or detachment of its reusable saved payment method from the active account where applicable. Stripe may still retain transaction, fraud-prevention or legal records under its own policies and obligations.
Information may remain temporarily in protected provider backups until those backups are overwritten under the provider’s retention schedule.
Stripe, Resend, Apple, Google, Sentry and other providers may independently retain limited records under their own legal, security and fraud-prevention requirements.
Archiving information to the owner’s Mac or deleting it from the live database does not erase those separate provider or backup copies.
Under UK GDPR you have the following rights in relation to your personal data:
To exercise any of these rights, email us at necktapers@gmail.com. We may need to verify your identity before responding. We will respond within one month.
You also have the right to lodge a complaint with the UK's data protection regulator, the Information Commissioner's Office (ICO):
We use technical and organisational safeguards including:
No system can be guaranteed to be completely secure. The Mac archive, provider backups and external-provider records have their own security and retention boundaries. If you believe your account or information has been compromised, contact us immediately at necktapers@gmail.com.
The App is not intended for use by children under 13. We do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at necktapers@gmail.com and we will take steps to delete the information.
Bookings for children's haircuts (for example, our "Kids" service for under 10s) should be made by a parent or guardian using their own account.
We do not currently send marketing emails. The emails we send are transactional only — booking confirmations, reschedules, cancellations and receipts.
If you have opted in to push notifications, we may occasionally send notifications about same-day promotions or offers, alongside booking reminders and operational messages. You can turn push notifications off at any time from your device settings or the App settings.
If we decide to start sending separate marketing communications in future, we will only do so where you have opted in, and you will always be able to opt out.
The App does not use cookies, third-party advertising identifiers or cross-app tracking. We do not track your activity across other companies' apps and websites for advertising purposes.
We may update this Privacy Policy from time to time. The "Last updated" date at the top of this document tells you when. If we make material changes, we will give you reasonable notice through the App or by email. Your continued use of the App after the changes take effect means you accept the updated Privacy Policy.
If you have any questions about this Privacy Policy, would like to exercise any of your rights, or have a complaint, please contact us:
If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO) at https://ico.org.uk.