Privacy policy

Version v1 · In force since 7 September 2026

In four lines

We keep only what is needed for you to book an appointment and for your barbershop to run its business: your name, your phone number, your email if you give one, and your appointments.
We do not sell your data to anyone and we do not use it for advertising.
Each barbershop sees only its own. There is no shared history of you across barbershops, not even if you visit two that use Antcora.
You can ask us to show you, correct or delete your data whenever you want. We explain how below.

1. Who processes your data

Antcora is management software used by barbershops. That means there are two different controllers depending on which data we are talking about, and it is worth understanding because it changes who you should turn to.

Your barbershop, for your client record

When you book at a barbershop, it is that barbershop which decides what your data is used for: your record, your appointments, what you have paid. It is the data controller. We act as a processor: we provide the tool and handle that data following its instructions and our own security rules, without using it for any purpose of our own.

If you want to exercise your rights over your record at a particular barbershop, you can contact it directly. If you write to us, we will help you get there.

Us, for your Antcora account

For your account —the one you use to sign in, your identity within Antcora— the controller is us:

Controller: Gestions i analisis de sistemes economics SL · B62416219
Address: Calle Roque Nublo, 10, 38679 Adeje, Santa Cruz de Tenerife, España
Contact: miquel@antcora.com

This separation is not a technicality: it is built into the product. Your account and your record at each barbershop are separate things in the database, which is why one barbershop cannot see what you do at another.

2. What data we process and why

Only what the service needs to work. This is the full list:

What	What for	Legal basis
Name, phone number and email	Identifying you, giving you access to your account, and letting the barbershop know who is coming	Performance of a contract
Your appointments: day, time, service and which barber	Providing the service and running the shop's diary	Performance of a contract
Amounts, payment method and deposits	Taking payment, refunding a deposit and balancing the till	Contract and legal obligation (accounting and tax)
WhatsApp messages with you	Confirming your appointment, reminding you, telling you about a change and replying to you	Performance of a contract
Your phone's notification identifier and the device name	Sending you notifications about your appointments	Performance of a contract
Barber's photo	Showing it on their barbershop's booking page	Consent, which is asked for and recorded separately
The barbershop's tax details and address	Invoicing its subscription	Contract and legal obligation
A record of what was done in the app and by whom	Security, resolving incidents and being able to audit a change	Legitimate interest in keeping the system secure and traceable

We do not process special categories of data —health, beliefs, biometrics— and we never ask for your ID number. We do not build profiles or make automated decisions that affect you legally.

3. Artificial intelligence

Antcora uses an AI assistant to handle WhatsApp conversations and help the barbershop with day-to-day tasks. You should know exactly what that involves:

To reply to you, the content of the conversation and the minimum details of your appointment are sent to Anthropic, the model provider.
Anthropic does not train its models on this data. That is the commitment in its commercial terms for API use, which is how we use it.
The assistant cannot write to the database on its own or invent an appointment: it can only use specific, checked operations, and anything touching your diary or your money goes through human confirmation.
You can ask to be helped by a person at any time.

4. Who we share it with

We do not sell data or share it for advertising. We share it only with the providers the service needs in order to work, and only what is strictly necessary:

Provider	What for	Where
Supabase	Database, accounts and files	European Union (Ireland)
Vercel	Website hosting	USA / EU
Stripe	Card and Bizum payments	Ireland and USA
Meta Platforms	WhatsApp messages	Ireland and USA
Anthropic	The AI assistant	USA
Expo	Mobile notifications	USA
Resend	Service emails	USA
Google	Only if you choose to sign in with your Google account	USA

We may also have to disclose data to public authorities, courts or law enforcement where a law requires it.

Data that leaves the European Union

Your information is stored on servers in the European Union. Some of the providers above are in the United States, so certain data is processed there. Those transfers rely on the safeguards of Article 46 GDPR —standard contractual clauses— or on the EU-US Data Privacy Framework adequacy decision, depending on the provider.

5. How long we keep it

Your account and your records: for as long as the relationship is alive. If you ask us to delete it, we delete it.
Appointments, payments and invoicing: even if you request erasure, the law requires accounting and tax information to be kept for the statutory periods (up to six years under the Spanish Commercial Code and four for tax purposes). That material is blocked: it is kept solely to respond to the authorities and is not used for anything else.
Messages and conversations: for as long as they are needed to serve you and to evidence what was agreed.
Security logs: for as long as needed to investigate incidents.

6. Children and booking for someone else

Barbershops cut children's hair, so this happens often. Antcora lets an adult manage the appointments of someone in their care: the child's details are provided by that adult, under their responsibility, and are linked to their account.

Children under fourteen cannot create their own account on Antcora. If we find one, we delete it.

7. Your rights

Regarding your data you can, at any time and free of charge:

Access it and ask for a copy.
Rectify it if something is wrong.
Erase it (within the limits of what the law requires us to keep).
Object to a processing activity or ask that it be restricted.
Ask for portability: take your data with you in a readable format.
Withdraw your consent where the processing is based on it, without affecting what was done before.

How to ask us to delete your data

Write to us at miquel@antcora.com with the subject "Data deletion request", telling us the phone number or email you booked with. We may ask you to confirm it is you before we do it — that is the only way to stop anyone deleting someone else's data.

We will reply within one month at most from receiving the request. If it concerns your record at a specific barbershop, we pass it on to them, as they are the ones who decide about that data.

If you think we have not done it right

You can complain to the Spanish Data Protection Agency. We would appreciate it if you wrote to us first so we can try to put it right, but it is your right and you do not have to go through us.

8. Cookies

Antcora uses no advertising or analytics cookies. That is why you will not see a cookie banner: there is nothing to consent to.

The only cookies we set are technical and necessary for the service to work: keeping you signed in, remembering a barbershop's kiosk device, and supporting the payments sign-up process. Without them you could not sign in. The rules do not require consent for cookies of this kind.

We do not use Google Analytics or any equivalent tool, nor third-party tracking pixels.

9. How we protect your data

Everything travels encrypted between your device and our servers, and is stored encrypted.
Each barbershop is isolated from the others by rules in the database itself, not just by application code. It is the most important protection this product has and it is checked by automated tests on every change.
Within a barbershop, each person sees only what their role allows.
We do not store card details. Payments are processed by a certified provider; we never see the number.

10. Changes to this policy

If we change anything important, we will publish the new version here with its date and, if it really affects you, we will tell you. This is version v1, in force since 7 September 2026.