When studios use Inka Studio to manage their clients' data, Inka Studio acts as a data processor on the studio's behalf. This page summarises our Data Processing Agreement (DPA) and lists the sub-processors we rely on.
1. Roles
- Studio — data controller of its clients' personal data.
- Inka Studio — data processor, acting only on the studio's documented instructions (i.e. how the platform is configured and used).
2. Subject matter & duration
We process personal data to provide the Inka Studio Service for the duration of the studio's subscription, plus any retention period required by law or agreed in our Terms.
3. Categories of data
- Identification data (name, email, phone, date of birth).
- Booking and appointment history.
- Consent forms, signatures, medical disclosures provided by the client.
- Photos uploaded to client records (where used).
- Payment metadata (handled by Stripe; we don't store full card numbers).
4. Categories of data subjects
- The studio's end clients.
- The studio's owners, artists, and staff.
5. Security measures
- Encryption in transit (TLS) and at rest.
- Role-based access control and the principle of least privilege.
- Two-factor authentication available for owners and admins.
- Regular backups and restore testing.
- Vulnerability monitoring and timely patching.
6. Sub-processors
We use the following sub-processors. Each is contractually bound to data protection obligations equivalent to ours.
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, file storage | EU (Frankfurt) |
| Stripe | Payment processing & subscriptions | EU / US (SCCs) |
| Resend | Transactional email delivery | EU / US (SCCs) |
| Cloudflare | Application hosting, CDN, DDoS protection, edge runtime, object storage | Global |
| Anthropic (Claude) | AI assistance: drafting replies to comments, messages, reviews and tattoo enquiries; drafting post captions; reading uploaded receipts and invoices; screening photos a studio uploads for publishing; in-app help. Their terms prohibit training on our content. | US (SCCs) |
| Sentry | Crash and error reporting. Consent form, client and artist-review screens are excluded entirely, and no client data, health information or contact details are sent. | EU |
We will give at least 30 days' notice (by email or in-app) before adding or replacing a sub-processor.
7. International transfers
Where data leaves the EEA/UK, we rely on Standard Contractual Clauses or other valid transfer mechanisms under GDPR.
8. Data subject requests
If an end client contacts us directly, we will refer them to the studio (the controller). We will assist studios in responding to access, deletion, or portability requests as required by GDPR.
9. Personal data breaches
We will notify affected studios without undue delay after becoming aware of a personal data breach involving their data, with the information needed to meet their own notification obligations.
10. Audits
We will provide reasonable information necessary to demonstrate compliance with this DPA upon written request.
11. Deletion
On termination, studio and client data is deleted within 90 days, except where retention is required by law (e.g. tax/accounting records).
12. Signing the full DPA
Studios that need a counter-signed DPA can request one at legal@inkastudio.app.