Privacy Policy
Last updated: 1 January 2025Inky ("we", "us", "our") operates the Inky platform - a management tool for freelance tattoo artists. This Privacy Policy explains how we collect, use, and protect personal data when you use our platform, website, and related services (collectively, the "Service").
We are committed to protecting your personal data in accordance with applicable data protection laws, including the EU General Data Protection Regulation ("EU GDPR"), the UK General Data Protection Regulation ("UK GDPR"), and where applicable, US state privacy laws (including the California Consumer Privacy Act, "CCPA") and Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA").
What this policy covers
This policy covers personal data we process when:
- An artist creates an account and uses the platform
- A client books an appointment or completes a consent form
- Anyone visits our website
It does not cover personal data that you collect from your clients and submit to the platform - that processing is governed by a separate Data Processing Addendum (available on request).
Data we collect
Artists
| Category | Detail |
|---|---|
| Account data | Name, email address |
| Account data | Your name, branding, configuration, and settings |
| Usage data | Features used, pages visited, actions taken |
| Technical data | IP address, browser type, device type, operating system |
| Communications | Messages sent to us via email or contact forms |
Clients
| Category | Detail |
|---|---|
| Profile data | Name, email address, phone number |
| Booking data | Appointment history, session notes, artwork references |
| Form responses | Answers to intake and consent form fields configured by you |
| Payment data | Deposit and invoice records (card details are handled by our payment processor, not stored by us) |
Client data is submitted either directly by the client (via a public booking or intake form) or added by you. Where you add or import client data, you are the controller of that data and we act as your processor.
Technical and analytics data
Standard session and usage data collected automatically when you use the Service. See the Cookies section below for more detail.
How we use your data
| Purpose | Legal basis |
|---|---|
| Providing and operating the Service | Contractual necessity |
| Account creation and authentication | Contractual necessity |
| Booking, scheduling and calendar management | Contractual necessity |
| Sending transactional emails (e.g. reminders, receipts) | Contractual necessity |
| Security, fraud prevention, and abuse detection | Legitimate interests |
| Improving and developing the Service | Legitimate interests |
| Responding to enquiries and support requests | Legitimate interests |
| Complying with legal obligations | Legal obligation |
| Marketing communications (opt-in only) | Consent |
We do not use personal data for automated decision-making that produces legal or similarly significant effects on individuals.
How we share your data
We do not sell personal data.
Service providers. We share personal data with third-party processors who help us operate the Service (such as hosting providers, authentication services, email delivery, and payment processing). These providers process data only on our instructions. See the Subprocessors section below.
Artists. Client data submitted through a booking or intake form is accessible to you. You are responsible for your own lawful basis for collecting and using that data.
Legal and regulatory. We may disclose personal data where required by law, court order, or to protect the rights, safety, or property of us, our users, or others.
Business transfers. In the event of a merger, acquisition, or transfer of all or part of our business, personal data may be transferred to the successor entity. We will notify you of any such change.
Subprocessors
| Provider | Purpose | Location |
|---|---|---|
| Google (Firebase / Google Cloud) | Authentication, database, platform hosting | USA / EEA |
| Stripe | Payment processing | USA / EEA |
| Brevo | Transactional emails (reminders, receipts) | EU (France) |
International transfers
Some of our subprocessors are based outside the UK and European Economic Area. Where we transfer personal data internationally we rely on one or more of the following:
- An adequacy decision by the UK Government or European Commission
- Standard Contractual Clauses (SCCs) approved by the European Commission
- UK International Data Transfer Agreements (IDTAs) issued by the ICO
You can request further information about the transfer mechanisms we use by contacting us at the address below.
Retention
We retain personal data for as long as necessary to provide the Service and meet our legal obligations.
| Data type | Retention period |
|---|---|
| Account data | Duration of account, plus 90 days after deletion |
| Client profile data | Duration of your account |
| Technical / analytics data | Up to 26 months |
| Communications and support records | Up to 3 years |
You can request deletion of your data at any time - see Your Rights below.
Your rights
Under UK/EU GDPR you have the right to:
- Access - request a copy of personal data we hold about you
- Correct - ask us to correct inaccurate or incomplete data
- Delete - request erasure where there is no lawful reason to retain it
- Restrict - ask us to pause processing in certain circumstances
- Object - object to processing carried out on the basis of legitimate interests
- Portability - receive a copy of your data in a machine-readable format
- Withdraw consent - where processing is based on your consent, withdraw it at any time without affecting prior processing
To exercise any of these rights, contact us at contact@getinky.io. We will respond within one month. We may ask you to verify your identity before acting on a request.
Additional rights - US and Canada
California (CCPA)
If you are a California resident, you have the right to know, delete, and correct personal data we hold about you, and to opt out of sale - we do not sell personal data. To make a request, contact contact@getinky.io.
Canada (PIPEDA)
If you are in Canada, you have the right to access personal data we hold about you and to request corrections where it is inaccurate. To make a request, contact contact@getinky.io.
Cookies
We use cookies and similar technologies on our website and platform:
- Necessary cookies - required for the Service to function (e.g. keeping you logged in)
- Analytics cookies - help us understand how the Service is used so we can improve it
You can manage your cookie preferences via the cookie banner on our website, or read our full Cookie Policy.
Children
The Service is not directed at anyone under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
Complaints
If you are unhappy with how we handle your personal data, please contact us first - we would like the opportunity to resolve your concern. If you remain unsatisfied, you have the right to lodge a complaint with a supervisory authority:
- UK users - Information Commissioner's Office (ICO)
- EU users - your local data protection authority
Contact
Updates
We may update this policy from time to time. We will notify active users of material changes by email. The "Last updated" date at the top of this page reflects the most recent revision.