This Privacy Policy explains what personal data getbarberpos collects, why we collect it, who we share it with and what choices you have. getbarberpos is a hosted point-of-sale and shop system for barbershops, operated by SOHOON Technologies (“we”, “us”, “our”). We sell to businesses in the United States, the United Arab Emirates and Pakistan.
This policy was last updated on October 18, 2026. It is written in plain language on purpose. If something is unclear, write to us at and we will explain it.
This page is general information about how we handle data. It is not legal advice for your shop. If you need to know what the law requires of your own business, talk to a lawyer in your market.
Who this policy covers
We deal with three groups of people, and we treat their data differently:
- Website visitors. Anyone who reads getbarberpos.com, fills in a form, books a demo or contacts us.
- Merchants. The barbershop owners, managers and staff who sign up for and use the hosted POS. We call the business account a “merchant account.”
- Merchants’ customers. The clients, walk-ins and booth renters whose details a shop stores in its own getbarberpos account, such as names, phone numbers, visit history and notes.
For the first two groups, we decide how and why data is used, so we act as the controller (or “business” under US state law). For the third group, the shop decides what to store and why. We only process that data on the shop’s behalf, under its instructions, so we act as a processor (or “service provider”). The shop is the controller for its own customers’ data.
Data we collect from website visitors
What you give us in forms. When you fill in a contact, demo, partner or data request form, we collect what you type: usually your name, email address, phone or WhatsApp number, shop name, country, number of chairs and your message. We also record which page and form you used.
Attribution data. If you arrived from an ad or a link with tracking tags (UTM parameters such as source, medium and campaign), our site keeps those tags in your browser and sends them along with your form so we know which campaign brought you in. Details are in our Cookie Policy.
Technical data. Like every website, our hosting provider receives your IP address, browser type, device type and the pages you request. This is used to deliver the site, keep it running and block abuse.
Bot protection. Our forms use Cloudflare Turnstile to check that a real person is submitting them. Turnstile looks at signals from your browser and may set a strictly necessary cookie. It does not show you puzzles in most cases.
Analytics. We do not run analytics on this site right now. If we turn it on, it will only load after you accept analytics in the cookie banner. If you say no, it never loads.
Where your form submission goes
When you submit a form on our site, it travels through a small server function on our hosting and then:
- Our CRM. Your details are added or updated as a contact in our customer relationship system, which runs on GoHighLevel. We tag the contact with the form you used and add a note with the page and campaign tags. This is how we reply to you and keep track of the conversation.
- An internal team notification. A short notice goes to a private Discord channel used only by our team, so someone sees your request quickly. This notice contains the details from your form. The channel is not public.
We do not sell form data, and we do not add you to third-party mailing lists.
Data we collect from merchants
When you open a getbarberpos account, we collect:
- Account details: business name, owner name, email, phone, country, time zone, currency and login credentials (passwords are stored hashed, never in plain text).
- Billing details: plan, billing cycle, invoices and payment status. Card payments for your subscription are handled by a payment provider. We do not store full card numbers on our servers.
- Usage data: logins, settings changes, device and browser information, and error logs. We use this to run the service, support you and keep accounts secure.
- Support conversations: messages, screenshots and call notes when you contact our support team.
Data merchants store about their customers
Inside the hosted POS, a shop can store client cards (name, phone, email, visit history, notes, reward points), appointments and online booking details, sales and receipts, booth renter ledgers, staff records, tips, commissions and HRM data like attendance and leave.
For this data:
- The shop is in charge. The shop decides what to collect, how long to keep it and who on its team can see it.
- We process it only to run the service for that shop: storing it, showing it back to the shop’s users, backing it up, securing it and fixing problems when the shop asks us to.
- We do not use it for our own marketing, we do not sell it and we do not combine it across shops.
- Card payments are not processed by us. getbarberpos works with your card processor. Card numbers should never be typed into notes or other free-text fields (see our Acceptable Use Policy).
If you are a client of a barbershop and want to see, change or delete what the shop holds about you, contact the shop first. If you cannot reach them, write to us and we will pass your request to the shop. See Data Requests.
How we use personal data
We use visitor and merchant data to:
- reply to your messages, demos and quotes;
- create and run your account, and provide the features you signed up for;
- bill you for your plan and keep financial records;
- provide support and fix problems;
- keep the service secure, detect abuse and prevent fraud;
- send service messages, such as billing notices, security alerts and changes to terms;
- send occasional product news, only where the law allows it, with an unsubscribe option in every message;
- meet legal, tax and accounting duties.
Who we share data with
We share data only with service providers who help us run the business, and only what they need:
- Hosting and security: Cloudflare (website hosting, content delivery, Turnstile bot protection) and the infrastructure that runs the hosted POS.
- CRM and messaging: GoHighLevel (contact records and follow-up) and Discord (internal team notifications).
- Payments for subscriptions: our subscription payment provider.
- Email delivery for account and support messages.
- Professional advisers such as accountants and lawyers, under confidentiality.
- Authorities, when the law requires it, such as a valid court order.
If our business is sold or merged, data may transfer to the new owner under this same policy, and we will tell merchants before that happens.
Your rights
What rights you have depends on where you live. We try to honor the core requests (see, correct, delete, export) for everyone, wherever the law allows.
United States. Several US states give residents privacy rights. Under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), California residents can ask to know what personal information we collect, use and disclose; to get a copy; to correct it; to delete it; and to opt out of the “sale” or “sharing” of personal information. We do not sell personal information and we do not share it for cross-context behavioral advertising. You also have the right not to be treated differently for using these rights. Other states, such as Virginia, Colorado, Connecticut, Texas and others, give similar rights, and we will respond to those requests too.
United Arab Emirates. The UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) gives individuals rights to get information about processing, to access and correct their data, to request deletion in certain cases, to restrict or object to processing, and to data portability. We process data based on your consent, to perform a contract with you, or to meet a legal duty. Some free zones, such as DIFC and ADGM, have their own data protection laws.
Pakistan. Pakistan does not yet have a single, enacted personal data protection law. The Prevention of Electronic Crimes Act, 2016 (PECA) covers unauthorized access to and misuse of data and information systems. A Personal Data Protection Bill has been drafted but, as of October 18, 2026, we treat it as a draft. We still give Pakistani users the same access, correction and deletion options as everyone else, and we will update this policy when a law is passed.
To use any of these rights, go to our Data Requests page or email . We will verify your identity before acting on a request.
How long we keep data
- Website form submissions: kept in our CRM while we are talking to you, and for up to 24 months after the last contact, then deleted or anonymized, unless you become a merchant.
- Internal notifications: kept in the team channel for operational reference and cleaned up periodically.
- Merchant account data: kept while your account is active. After you cancel, your data stays available for export for 30 days, then it is deleted from live systems. Backups roll off on their normal cycle after that.
- Billing and tax records: kept for as long as tax and accounting laws require, which can be several years.
- Merchants’ customer data: kept as long as the shop keeps it in its account, and deleted along with the account as described above.
How we protect data
We use reasonable technical and organizational measures, including encrypted connections (HTTPS) everywhere, hashed passwords, role-based access inside each shop’s account, separation between merchant accounts, limited staff access on a need-to-know basis, and regular backups. More detail is on our Security page.
No system is perfectly secure. If we learn of a breach that affects your personal data, we will notify affected merchants and, where the law requires, regulators and individuals, without undue delay.
International transfers
We serve the USA, the UAE and Pakistan, and our providers run servers in different countries. That means your data may be stored or processed outside the country where you live, including in the United States. When we move data across borders, we use providers with appropriate safeguards and contracts, and we only transfer what is needed to run the service.
Children
getbarberpos is a business tool. It is not meant for children, and we do not knowingly collect data from anyone under 16 through our website. If you think a child has sent us personal data, contact us and we will delete it.
Shops may serve young clients (a kid’s first haircut, for example). In that case the shop is responsible for getting any parental consent its local law requires before storing the child’s details.
Changes to this policy
When we change this policy, we update the date at the top. If a change is significant, we will tell merchants by email or in the app before it takes effect.
Contact us
For any privacy question or request, email or use the form on our contact page and choose “Data request.” The data controller for visitor and merchant data is SOHOON Technologies.