C.H.É Privacy Policy

How we handle your data.

Effective: 8 May 2026 · Last updated: 10 May 2026

This policy explains what personal data C.H.É collects, why we collect it, how we use it, who we share it with, and the rights you have over it. We aim to write it plainly. If anything is unclear, email hello@che-collective.com.

1. Who we are

C.H.É (Collective Hairdressing Étiquette) is operated by KOOP Studio LTD, a company registered in England and Wales (company number 13486153), registered office 2 Queenstown Road, London SW8 3RX. We are the data controller for the personal data described in this policy.

For privacy questions or to exercise your rights, contact us at hello@che-collective.com.

2. The data we collect

We collect data in three ways: data you give us directly, data we collect automatically when you use the site, and data we receive from third parties.

Data you give us

• Account details: email address, password (stored hashed), display name, account type (such as stylist/barber or salon/barbershop).
• Profile content: bio, city, profile photo, portfolio links, specialty tags, availability, inclusivity and access tags (optional), work imagery you upload.
• Messages you send to other members through the platform.
• Any messages you exchange with the C.H.É AI assistant on the home page.
• Correspondence with us by email.

The optional Inclusivity & access tags (LGBTQ+ friendly, pet-friendly, quiet / sensory-conscious) are public profile signals about the kind of environment a member offers or is looking for. They are not personal identity declarations. Members choose them themselves, they appear on the public profile, and members can remove them at any time from their dashboard.

Data we collect automatically

• Technical data: IP address, browser type, operating system, device identifiers.
• Usage data: pages visited, features used, approximate session timing.
• Cookies and similar technologies — see our Cookie Policy.

Data from third parties

• If you sign in via a third-party identity provider (where supported), we receive your email and basic profile information from that provider.

3. Why we use your data and our lawful basis

Under UK and EU GDPR we must have a lawful basis to process your data. Ours are as follows.

• To provide the service (account, profile, messaging, matching). Lawful basis: performance of a contract.
• To send transactional emails (welcome, message notifications, security alerts). Lawful basis: performance of a contract.
• To keep the service secure (authentication, rate-limiting, fraud prevention). Lawful basis: legitimate interest.
• To improve the service (anonymous analytics, debugging logs). Lawful basis: legitimate interest.
• To send marketing emails about C.H.É updates and features. Lawful basis: consent (you can withdraw at any time using the unsubscribe link).
• To comply with legal obligations (responding to lawful requests, tax, accounting). Lawful basis: legal obligation.

4. Who we share your data with

We do not sell your data. We share it only with the following processors and parties, who handle it on our instructions:

• Supabase (database, authentication, storage). Hosted in the EU. Privacy.
• Vercel (web hosting, serverless functions). Privacy.
• Resend (transactional email delivery). Privacy.
• Anthropic (the AI behind the assistant chat). Messages you send to the assistant are processed by Anthropic to generate replies. Privacy.
• Where required by law: regulators, law enforcement, courts, in response to lawful requests.

Some of these processors (notably Anthropic) are based in the United States. Where personal data is transferred outside the UK or EEA, we rely on appropriate safeguards including the UK International Data Transfer Agreement, EU Standard Contractual Clauses, or adequacy decisions.

5. How long we keep your data

• Account and profile data: while your account is active, plus 30 days after closure.
• Messages between members: while either party's account is active, plus 30 days.
• AI assistant chat logs: 90 days, then deleted.
• Email logs and security logs: 12 months.
• Records we are required by law to keep (financial, tax): 6 years after the relevant transaction.

6. Your rights

Under UK and EU GDPR you have the right to:

• Access the personal data we hold about you.
• Have inaccurate data corrected.
• Have your data erased ("right to be forgotten") in certain circumstances.
• Restrict how we process your data.
• Receive a portable copy of your data in a structured, machine-readable format.
• Object to processing based on legitimate interest, including for direct marketing.
• Withdraw consent at any time, where we rely on consent.

To exercise any of these, email hello@che-collective.com. We aim to respond within one calendar month.

If you are unhappy with how we handle your data you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint. EU residents may also complain to their local data protection authority.

7. Cookies

See our Cookie Policy for full details of what cookies we set and how to control them.

8. Children

C.H.É is not intended for anyone under 18. We do not knowingly collect personal data from children under 18. If you believe we have, contact us and we will delete it.

9. Security

We protect your data with industry-standard technical and organisational measures: encryption in transit (HTTPS), passwords stored hashed and salted, row-level security on the database, restricted access for staff. No system is perfectly secure; if you suspect a breach affecting your account, contact us immediately.

10. Changes to this policy

We may update this policy. The "Last updated" date at the top reflects the most recent version. Material changes will be notified by email or by a banner on the site at least 14 days before they take effect.

11. Contact

Email: hello@che-collective.com
Postal: 2 Queenstown Road, London SW8 3RX

← Back to C.H.É