Privacy Policy

Effective date: 13 June 2026 · Last updated: 13 June 2026

1. Who We Are

Aro Cutz is a mobile barbering service operated by Robin Adjeku, based in Ayeduase, Kumasi, Ghana (“we”, “our”, or “us”). We come to you — no salon, no walk-ins.

This Privacy Policy explains how we collect, use, store and protect your personal information when you use our website at arocutz.com, book our services, purchase products from our shop, or subscribe to a membership plan.

This policy complies with the Ghana Data Protection Act, 2012 (Act 843) and is aligned with international best practices including the EU General Data Protection Regulation (GDPR) and the OECD Privacy Guidelines.

For privacy enquiries or to exercise your rights, contact us at:
Email: privacy@arocutz.com
WhatsApp: +233 54 514 6226

2. What Personal Data We Collect

Full name	Booking, contact form, membership, shop order	Identify you and address communications to you
Phone number	Booking, contact form, membership, shop order, waitlist	Identify your booking and contact you by phone or SMS if needed
Email address	Booking (optional), membership, shop order (optional)	Send confirmation emails and receipts
Physical address / location	Booking, shop delivery orders	Dispatch your barber or deliver your order
Service preferences & booking history	Booking system	Provide and improve our service
Payment reference number	Shop orders and membership payments via Paystack	Verify payments and resolve disputes — we do not store card numbers
Messages / enquiries	Contact form	Respond to your questions
Review / rating	Post-service review link	Display approved testimonials on the website
IP address (anonymised)	Automatic — website visit	Count unique visitors; deleted or anonymised after 91 days
Session cookie	Automatic — admin login only	Authenticate the site administrator; not set for regular visitors

We do not collect biometric data, government ID numbers, health data, or children's data (our services are for adults 18+).

3. Legal Basis for Processing

Booking fulfilment	Performance of a contract — we need your name, phone and address to arrange and deliver your haircut
Payment verification	Performance of a contract — verifying your Paystack payment against the order value
Booking confirmation & reminder messages	Performance of a contract / legitimate interest — you expect to hear from us about your appointment
Order confirmation email	Performance of a contract
Membership confirmation & code delivery	Performance of a contract
Contact form response	Legitimate interest — responding to a question you initiated
Marketing communications	Consent — only where you have opted in; you may withdraw at any time
Website analytics (anonymous)	Legitimate interest — understanding site traffic to improve the service
Audit logging (admin actions)	Legal obligation / legitimate interest — maintaining an audit trail of administrative changes

4. How We Use Your Data

Confirming, rescheduling and reminding you of your booking appointment
Dispatching your barber to your location
Processing and delivering shop orders
Activating and managing your membership plan
Responding to your contact form enquiry
Sending post-service review requests (via the unique review link in your confirmation)
Building an internal client record to improve our service to you over time
Anonymised analytics to understand how visitors use the site
Where you have consented: occasional marketing messages about promotions or new services

We do not sell, rent, or trade your personal data to third parties for their own marketing purposes.

5. Data Sharing & Third-Party Processors

We share your data only with the following service providers who process it on our behalf and are contractually bound to protect it:

Supabase (PostgreSQL)	Ireland / USA	Primary database — stores all booking, membership, order and client records
Resend	USA	Transactional email delivery — receives your name and email to send confirmations
Meta WhatsApp Cloud API	USA	Not currently active — pending WhatsApp Business template approval from Meta. Will send booking confirmations and reminders once live
Twilio	USA	Backup SMS delivery for booking notifications
Paystack	Nigeria / USA	Payment processing — handles card and mobile money transactions; we receive only the payment reference
Cloudinary	USA	Hosts gallery images uploaded by the barber — no customer PII stored
Upstash Redis	USA / EU	Short-term caching of availability data and anonymous site analytics
Vercel	USA / Edge	Website hosting and content delivery

For transfers to processors outside Ghana, we rely on standard contractual clauses and the processors' published data processing agreements. Paystack is regulated by the Central Bank of Nigeria.

6. Data Retention

Booking records	3 years from booking date, then anonymised
Client profile (name, phone, email)	3 years from last booking, then anonymised or deleted on request
Contact messages	12 months, then deleted
Shop orders	7 years (statutory accounting requirement)
Membership records	3 years from semester end
Reviews	Indefinite while published; deleted on request
Waitlist entries	Deleted once notified or when the booked slot passes
Anonymised analytics (Redis)	91 days, then automatically expired
Admin audit logs	2 years, then deleted
Payment reference numbers	7 years (statutory accounting requirement)

You may request earlier deletion at any time (see Section 8).

7. Cookies & Tracking

This website uses one functional cookie only:

next-auth.session-token

Session / 8 hours

Keeps the site administrator securely logged in to the admin dashboard. Set only when an administrator logs in — not set for regular visitors.

We use no third-party tracking cookies, advertising cookies, or cross-site analytics. We do not use Google Analytics, Facebook Pixel, or similar trackers.

We collect anonymised page-view counts server-side (your IP address is masked before storage). You cannot be individually identified from this data.

8. Your Rights

Under Ghana's Data Protection Act 2012 and international best practices, you have the right to:

Access — request a copy of the personal data we hold about you
Rectification — ask us to correct inaccurate data
Erasure (“right to be forgotten”) — ask us to delete your data (subject to legal retention obligations)
Restriction — ask us to stop processing your data in certain ways
Portability — receive a copy of your data in a machine-readable format
Objection — object to processing based on legitimate interest, including marketing
Withdraw consent — withdraw marketing consent at any time without affecting prior processing

To exercise any of these rights, contact us at privacy@arocutz.com or WhatsApp +233 54 514 6226. We will respond within 30 days.

You may also lodge a complaint with the Data Protection Commission of Ghana (dataprotection.org.gh).

9. Marketing Communications

We will only send you marketing messages (promotions, new services, special offers) if you have given us explicit consent. You may opt out at any time by:

Clicking the unsubscribe link in any marketing email
Contacting us directly at privacy@arocutz.com

Opting out of marketing does not stop transactional messages related to your active bookings or orders (e.g., booking confirmations, reminders, order status updates). These are necessary to deliver the service you requested.

10. Data Security

We implement the following security measures to protect your data:

All data transmitted between your browser and our servers is encrypted with TLS 1.2+ (HTTPS enforced with HSTS)
The database is hosted on Supabase with encryption at rest
Admin access is protected by bcrypt-hashed passwords and rate-limited login (5 attempts per 15 minutes)
Admin sessions expire after 8 hours
All admin actions are recorded in a tamper-evident audit log
Payment processing is handled by Paystack — we never see or store your card details
API endpoints are protected by rate limiting and input validation
Content Security Policy (CSP), HSTS, X-Frame-Options and other security headers are enforced

In the event of a data breach that may affect your rights, we will notify affected individuals and the Data Protection Commission within 72 hours of becoming aware.

11. Children's Data

Our services are intended for individuals aged 18 and over. We do not knowingly collect personal data from children under 18. If you believe we have inadvertently collected data about a child, please contact us immediately at privacy@arocutz.com and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page. For significant changes, we will display a notice on the website. Continued use of our services after the update constitutes acceptance of the revised policy.

13. Contact

For all privacy-related enquiries, data access requests, or complaints:

Aro Cutz — Data Controller
Robin Adjeku
Ayeduase, Kumasi, Ghana
Email: privacy@arocutz.com
WhatsApp: +233 54 514 6226