Legal

Privacy Policy

Last updated: 18 July 2026 · Effective: 18 July 2026

Jai Austin Barfoot, sole trader, ABN 87 274 343 489, trading as Taper by Aiandi ("we", "us", "Taper") provides software that helps barbershops manage their walk-in queue, client cards, and AI haircut previews. This policy explains how we collect, use, and protect personal information when you use the Taper website (taper.style), the Taper application (app.taper.style), and any other service we provide (together, the "Service").

We operate the Service with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth), the Spam Act 2003 (Cth), and applicable Australian Consumer Law requirements in mind. Customers operating outside Australia must tell us before onboarding so any additional local requirements, including the GDPR or UK GDPR where applicable, can be assessed and documented. By using the Service you acknowledge this Policy and our Terms of Service.

Plain-English summary. Barbershops are the data controllers for their own clients; we are the data processor. Photos and AI previews are used only to provide the haircut preview and shop workflow, not to identify you or train AI models. You can ask for deletion at any time by emailing privacy@taper.style or directly at jai@aiandi.com.au.

1. Who controls your data

If you are a barbershop owner or staff member using Taper to run your shop, Taper is the controller of your account information (email, login, billing).

If you are a customer of a barbershop using a Taper iPad or queue link to choose a haircut, the barbershop is the data controller of all information you provide and Taper is only a data processor acting on the shop's documented instructions. The barbershop is solely responsible for: obtaining your consent, telling you why your information is collected, deciding how long to keep it, and responding to your access, correction or deletion requests. Taper provides the tooling; the shop owns the relationship with you. Requests to see, correct, or delete your data should be directed to the barbershop. If the barbershop does not respond, you may email privacy@taper.style and we will assist as a processor where we are legally able.

2. What we collect

From shop owners and staff

Name, email, phone, business name, ABN if you provide one
Hashed password (we never store the plain text)
Subscription and billing metadata from Stripe (we never see your card number)
Server logs: IP address, browser type, pages visited, basic activity timestamps

From customers using a barbershop's Taper iPad or queue link

Name, mobile, email (only if you provide them)
Selected haircut
Front-facing photo (if you choose to use the AI preview)
The AI preview image generated from that photo
Marketing/contact consent flags
Time you joined the queue, IP address (for abuse prevention only)

Photos of faces are personal information and may reveal sensitive information such as appearance, ethnicity, health, or religious dress. Taper does not use facial recognition, biometric verification, biometric identification, face matching, or biometric templates. We still handle face photos with a higher level of care because misuse could be harmful.

3. How we use it

To run the service: show you the queue, save cut cards, generate AI previews, send the shop your selected style.
To improve the product: aggregate, de-identified usage analytics. We do not train AI models on customer photos.
To bill and support: manage subscriptions, respond to support requests.
To comply with the law: respond to legal process, enforce our Terms.

We do not sell or rent personal information. We do not use your photo or any information you give a barbershop to advertise other products to you.

4. AI haircut previews

If you (or the shop on your behalf) request an AI preview, your front photo and the chosen haircut style are sent to OpenAI via OpenAI's API to generate a preview image. OpenAI processes the image under its API and business data terms and returns the generated image to Taper. OpenAI says API data is not used to train or improve models by default unless the API customer explicitly opts in. OpenAI may still process inputs for safety, abuse monitoring, legal compliance, and service operation. Taper does not opt in to OpenAI model training with customer photos.

Taper does not use the AI preview to make legal, financial, employment, credit, insurance, access, or other decisions that significantly affect a person's rights or interests. It is a visual aid for a haircut conversation only.

AI previews are illustrative only. They are not a guarantee of how a haircut will actually look on you. Variations in lighting, hair growth pattern, scalp visibility, and barber technique mean the real-world result will differ. The preview is a visualisation aid, not a contractual outcome.

The shop owner can delete a saved preview from their dashboard at any time. If you want yours deleted immediately, ask the shop, or email us at privacy@taper.style.

5. Marketing & SMS / email contact

A shop may only send you SMS or email marketing if you tick the separate marketing-consent box on the iPad or queue page. Taper currently prepares message drafts but does not automatically send shop SMS. When a shop sends a message through its own provider, it must identify itself, include a functional unsubscribe method, and honour unsubscribe requests within 5 business days. You can withdraw consent at any time by replying STOP where supported, clicking unsubscribe, or telling the shop. Taper itself only emails you about your Taper account, security alerts, support, and changes to this Policy or our Terms.

6. How long we keep things

Customer photos and AI previews: retained for 90 days by default, then automatically purged unless the shop has saved them as part of a cut card or client record with your consent.
Cut cards and client records: retained while the shop is an active Taper customer, plus 12 months. The shop can delete individual records at any time.
Account & billing records: kept for 7 years to comply with Australian tax law.
Server logs: 90 days.
Restricted backups: deleted production data may remain in encrypted or access-restricted backups for up to 30 days, after which those backups age out. Backups are used only for disaster recovery and are not restored to avoid a valid deletion request.

Shop owners can export their data, delete individual client photos or records, and schedule account closure from the app. Account closure has a 30-day cancellation window; active subscriptions must be cancelled first. Some billing, tax, fraud-prevention, and security records may be retained where the law requires it.

7. Where it's stored

Taper hosts the application on DigitalOcean infrastructure in Sydney, Australia. We use subprocessors only where needed to provide the Service, currently including DigitalOcean for hosting, Stripe for payments, Resend/SMTP providers for transactional email, and OpenAI for AI previews. Stripe, Resend, and OpenAI may process data outside Australia, including in the United States. Where data is sent overseas, we take reasonable steps to ensure it is handled consistently with the APPs, including contractual controls, provider security reviews, minimising the data sent, and using providers' business/API data protection settings where available.

8. Security

We use HTTPS for all connections, hash passwords with bcrypt, apply role-based access controls, keep API keys server-side only, run service monitoring and restricted backups, and require authenticated plan entitlements plus server-side quotas for every live AI preview. No system is perfectly secure; if we discover a breach likely to result in serious harm, we'll assess it promptly and, where required, notify affected individuals and the OAIC under the Notifiable Data Breaches scheme.

9. Your rights

You can ask us to:

See the personal information we hold about you
Correct anything that's wrong
Delete data where deletion is legally and technically available
Export a copy of your data
Stop marketing contact

Email privacy@taper.style from the address linked to your account, or contact your barbershop. If that address does not respond, email jai@aiandi.com.au. We aim to respond within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner.

10. Cookies

Taper uses only the minimum cookies needed to keep you logged in and to remember your shop. We don't run third-party advertising trackers. The marketing site at taper.style does not set tracking cookies for visitors who don't sign in.

11. Children

Taper isn't designed for independent use by children under 16. The photo flow requires the person to confirm they are 16+ or that a parent or guardian is present and has consented. Shops must not collect a minor's photo where that confirmation cannot truthfully be given.

12. Changes

We'll post material changes here and notify shop owners by email at least 14 days before they take effect.

13. Contact

Privacy questions: privacy@taper.style or jai@aiandi.com.au
General contact: hello@taper.style or jai@aiandi.com.au
Operator: Jai Austin Barfoot, sole trader, ABN 87 274 343 489, trading as Taper by Aiandi, Melbourne, Australia.

Note for barbershop owners. When you use Taper, you commit to obtaining proper consent from your customers before collecting their photo, mobile, or email, and to honouring requests they make about their data. Our Data Processing Addendum sets this out in full.