Privacy Policy

Last updated: September 2026

1. Information We Collect

Account Information. When you sign up, we collect your email address. Guides and clients sign in without a password — using a one-time code sent to your email.

Phone Number. If you verify a phone number, we store it (encrypted) to enable SMS and WhatsApp communications between you, your clients, and the Barb assistant. A guide's personal phone number is kept private and never shown to clients.

Business Information. Guide profile details including business name, description, location, timezone, outing templates, and pricing.

Client Information. Contact details for your clients (name, phone number, email) provided through conversations with Barb, stored on your behalf to facilitate bookings and communications.

Conversation Data. Messages exchanged between you, your clients, and Barb across SMS, WhatsApp, and email — including content, timestamps, delivery status, and provider metadata.

Trip & Booking Data. Outing templates, scheduled trips, booking records, guest information, and payment status/references.

Calendar Data. When you connect Google Calendar or Outlook, we access event times and titles to determine availability and manage bookings, and we create/update events on your behalf. Calendar data syncs bidirectionally.

Financial Information. When you take payments through Barb, client payments are processed through Stripe Connect on your own connected Stripe account; Barb adds a per-booking service fee (see our Terms) and does not hold your funds. We store Stripe identifiers and payment status but do not store card numbers or bank details — Stripe handles those.

Integration Credentials. Provider credentials for services you connect (such as Twilio) are encrypted at rest (Fernet).

Device & Usage Information. Standard web server logs (IP address, user agent, pages visited, timestamps) used for security monitoring, audit logging, and service improvement.

2. How We Use Your Information

  • Operate the Barb assistant — processing messages, checking availability, creating bookings, sending payment links, and communicating with your clients on your behalf
  • Maintain calendar sync — reading and writing calendar events to keep your availability current
  • Process payments — facilitating client charges through Stripe Connect and collecting Barb's service fee
  • Distribute referral earnings — calculating guild referral credits when applicable
  • Send operational notifications — booking confirmations, payment receipts, reminders, and actions needing your approval
  • Provide support and maintain security — tamper-proof audit logging, webhook signature validation, and abuse prevention
  • Comply with legal obligations

We do NOT sell, rent, or share your personal information with third parties for their own marketing purposes, and we do not use your data for targeted advertising.

Google Workspace data is more restricted. Data obtained from Google Workspace APIs (such as Google Calendar) is used only to provide the calendar features you connect. See the “Google API Services User Data Policy — Limited Use” section below.

3. How We Share Information

Service Providers (each receives only what it needs):

  • Stripe — payment processing (Stripe Connect)
  • Twilio — SMS, WhatsApp, and phone verification
  • Anthropic — conversation processing via the Claude API
  • SendGrid — transactional email delivery and inbound email parsing
  • Google / Microsoft — calendar sync (only when you connect them)
  • Amazon Web Services — media/file storage

Google Workspace data is shared with a provider only to the extent strictly necessary to deliver the calendar feature you connected, consistent with Google's Limited Use requirements — never for a provider's own purposes, advertising, or AI/ML training.

Between You and Your Clients. Information needed to facilitate bookings (trip details, meeting locations, payment links) is shared through Barb. Client contact information is not shared with other guides unless you initiate it.

Legal Requirements & Business Transfers. We may disclose information when required by law, or transfer it as part of a merger, acquisition, or sale of assets (with notice).

4. Automated Processing & Conversation Data

Barb uses automated processing (Anthropic's Claude API) to handle conversations and take actions on your behalf. Per Anthropic's commercial API terms, data sent through the API is not used to train their models. Data obtained from Google Workspace APIs is used only to determine availability and manage bookings, and is never used to train any AI/ML model.

Google API Services User Data Policy — Limited Use

Barbed's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, for data accessed from Google Workspace APIs (including Google Calendar):

  • No AI/ML model training. We do not use Google Workspace API data to develop, improve, or train generalized or non-personalized AI/ML models.
  • Limited purpose. We use Google user data solely to provide the features you requested — reading your calendar for availability and creating/updating events when trips are booked.
  • No transfer except as necessary to provide those features, to comply with law, or as part of a merger/acquisition with notice.
  • No advertising use of Google user data.
  • No human reading of Google user data except with your consent, for security, to comply with law, or on aggregated/anonymized data.

5. SMS & Text Messaging Privacy

Barbed.ai is operated by Barbed.ai LLC. Phone numbers collected through the platform are used exclusively for platform operations: verification codes, booking confirmations and payment requests, trip reminders and schedule alerts, client responses, and action-approval requests.

SMS Privacy Policy

Barbed.ai LLC values your privacy. We collect and use information through text messaging only to provide you with booking confirmations, trip updates, payment requests, and client communications.

No Share Policy: Mobile information, opt-in data, and consent details collected for our text messaging program will not be shared, sold, or rented to any third parties, affiliates, or partners for marketing or promotional purposes under any circumstances. Phone numbers are provided only to Twilio for message delivery.

Opt-In/Opt-Out: Your interaction with our web forms signifies your consent to receive text messages. You may opt out at any time by replying STOP to any message. Reply HELP for assistance. Standard carrier message and data rates may apply. Message frequency varies, up to 10 msgs/month. Consent is not a condition of purchase. All major US carriers are supported.

No marketing or promotional messages are sent. All messages are transactional or conversational in nature.

For complete SMS terms, see our SMS Terms & Conditions.

6. Cookies

Barb uses minimal cookies: HttpOnly session cookies for authentication (they are not readable by JavaScript and are cleared on sign-out), and cookies set by our CDN/hosting for security and performance. We do not use third-party advertising or cross-site tracking cookies, and we do not sell cookie data.

7. Data Retention

  • Account data: retained while active and for 30 days after deletion, then permanently deleted.
  • Financial records: retained as required by law (up to 7 years).
  • Calendar data & integration credentials: deleted when you disconnect the integration.
  • Audit logs: retained for security/compliance; tamper-evident (HMAC-SHA256 hash chain).
  • Usage logs: retained up to 12 months.

8. Your Rights

You may access, correct, export, or delete your personal data, opt out of SMS by replying STOP, and disconnect any integration at any time. To exercise these rights, contact privacy@barbed.ai; we respond within 30 days and may verify your identity first.

9. California Privacy Rights (CCPA)

California residents have the right to know what personal information we collect and how it is used and shared, to delete it, to opt out of its “sale” (we do not sell personal information), and to non-discrimination for exercising these rights.

10. Children's Privacy

Barb is not intended for individuals under 18, and we do not knowingly collect their information. Contact privacy@barbed.ai if you believe a child has provided us data.

11. Data Security

  • TLS encryption in transit
  • Sensitive credentials encrypted at rest (Fernet)
  • Passwordless authentication (one-time email codes); JWTs in HttpOnly cookies, rotated and revoked on sign-out
  • Tamper-evident audit logging (HMAC-SHA256 hash chain)
  • Cryptographic signature verification on inbound webhooks
  • Per-guide data isolation

Contact

Barbed.ai is operated by Barbed.ai LLC. Email privacy@barbed.ai.