Privacy Policy — Inka Studio

This Privacy Policy explains how Inka Studio ("we", "us") collects, uses, and protects personal data when you use our platform. We aim to comply with the EU General Data Protection Regulation (GDPR) and equivalent laws.

1. Who is the data controller?

For data about studio owners, artists, and admins using Inka Studio, we are the data controller. For data about end clients (people booking tattoos through a studio), the studio is the data controller and we act as a data processor on their behalf. See our DPA for details.

Contact: privacy@inkastudio.app.

2. What data we collect

Account data (you)

Name, email, password (hashed), phone (optional).
Studio details, role, profile photo (optional).
Billing details, processed by Stripe (we do not store full card numbers).

Client & booking data (uploaded by studios)

Client name, contact details, date of birth, ID details (where required for consent).
Appointment history, consent forms and signatures, medical notes provided by the client, photos.

Technical data

IP address, device/browser info, log data, basic usage analytics.
Messages you send to the in-app help assistant — used to answer your question and to improve our help documentation. Please don't include sensitive personal data in these messages.

3. How we use it (purposes & legal bases)

Provide the Service — performance of contract.
Billing & fraud prevention — performance of contract / legal obligation.
Security & abuse prevention — legitimate interests.
Product improvement (aggregated/anonymous) — legitimate interests.
Service emails (e.g. booking confirmations, password reset) — performance of contract.
Marketing emails — only with your consent; you can unsubscribe at any time.

4. Sharing & sub-processors

We do not sell your data. We share it only with vetted sub-processors needed to run the Service. The current list is on our DPA & Sub-processors page.

Requests from public authorities. If a government or law-enforcement body asks us for personal data, we first review whether the request is legally valid and binding on us; we disclose only the minimum information the request lawfully requires; and we keep a record of each request, what was provided and the legal basis relied on. Where the law allows, we will inform the affected studio.

5. International transfers

Some of our sub-processors are based outside the EEA/UK. Where this happens, we rely on Standard Contractual Clauses or other safeguards permitted under GDPR.

6. Retention

Account data: kept while your account is active, deleted within 90 days of closure.
Client/consent records: kept according to the studio's instructions and applicable law (often 5–7 years for consent forms).
Billing records: retained as required by tax law (typically up to 10 years).
Logs: 30–90 days.
Help-assistant messages: kept up to 90 days, then deleted.

7. Your rights

Under the GDPR you have the right to:

Access the data we hold about you.
Correct inaccurate data.
Request deletion ("right to be forgotten").
Restrict or object to processing.
Data portability.
Withdraw consent at any time (where processing is based on consent).
Lodge a complaint with your local data protection authority.

To exercise these rights, email privacy@inkastudio.app.

8. Security

We use encryption in transit (HTTPS), encrypted storage, role-based access control, and offer two-factor authentication (2FA) for studio owners and admins. No system is 100% secure; you also play a role by keeping your credentials safe.

9. AI-assisted features

Parts of the Service use a third-party AI provider (Anthropic, “Claude”) to prepare suggestions that a person then reviews. Nothing produced this way is sent, posted or saved without someone approving it.

What is sent, and when

Replies to comments, messages and reviews. When a studio asks for a draft, we send the message or review being replied to, the studio’s own description of its tone, and a sample of replies it has sent before. We do not send the commenter’s profile handle as a separate field, though a name written inside the message itself is included.
Replies to tattoo enquiries. For an enquiry sent through a studio’s request form, we send the enquirer’s name and what they wrote, together with the style, placement, size and — where they chose to give it — their skin tone on the Fitzpatrick scale, which helps the reply address what they asked. Reference images they attached are not sent; only how many there are.
Post captions. The tattoo’s style, placement and description, and the artist’s name where the studio chooses to credit them. The client’s name is not sent.
Receipts and invoices. Studios using the Finance add-on can email a receipt to their expense inbox. The document is sent to the provider as supplied, so that the amount, date, supplier and VAT can be read from it.
Photos a studio uploads to post. Where a studio uploads one of its own photographs to publish to its social media, the image is sent to the provider to check it for content that should not be published — hate symbols and sexual content. The result is shown to the studio owner as a warning; it never blocks or deletes anything, and a person decides. This applies only to photographs a studio uploads itself, never to client photographs from consent records.
In-app help. The question typed into the help assistant.

What is never sent

We do not send identity documents, consent-form signatures, health or allergy answers, dates of birth, or card and payment details to the AI provider. Client photographs from consent records are not sent either — the only images sent are the ones a studio uploads itself in order to publish them, as described above.

Training, retention and transfers

The provider’s commercial terms prohibit training its models on our content. It deletes the content within 30 days of our agreement ending, except where it must keep something longer by law or to deal with harmful use of its service. The provider is a sub-processor under our DPA, is located in the United States, and transfers rely on Standard Contractual Clauses. See our DPA & Sub-processors page.

10. Google Business Profile Integration

Studio owners who subscribe to the optional Social Media add-on can connect their Google Business Profile to Inka Studio via Google's OAuth 2.0 flow. The following applies when this integration is enabled:

What data we access

Google Business Profile reviews associated with the connected location, including reviewer display names, star ratings, and review text.
Google Business account and location identifiers required to interact with the Business Profile API.
OAuth access tokens and refresh tokens issued by Google, scoped to https://www.googleapis.com/auth/business.manage.

Why we access it

To display incoming Google reviews inside the Inka Studio dashboard so studio owners can draft and publish replies.
To post review replies to Google Business Profile on behalf of the studio, after explicit owner approval. No automated posting occurs without human review.

How we store and protect it

OAuth tokens are stored encrypted in our database and are never shared with third parties.
We store only the minimum data required: access tokens, refresh tokens, account/location IDs, and token expiry dates. Review content is stored only while it is awaiting action in the dashboard queue.
We do not use Google user data for any purpose beyond what is described above. We do not share, sell, or use this data for advertising or AI training.
Our use of Google API Services complies with the Google API Services User Data Policy, including the Limited Use requirements.

How to revoke access

Disconnect your Google account at any time from Dashboard → Social Media → Connected accounts → Disconnect. This deletes our stored tokens immediately.
You can also revoke access from your Google Account at myaccount.google.com/permissions.

11. Meta (Facebook & Instagram) Integration

Studio owners who subscribe to the optional Social Media add-on can connect their Facebook Page and/or Instagram Business account to Inka Studio via Meta's official OAuth login flow. The following applies when this integration is enabled:

What data we access

Facebook Page details (name, ID, profile picture) and the Page's posts, comments, and messages.
Instagram Business account details (username, profile picture) and the account's media, comments, and direct messages.
OAuth access tokens issued by Meta, which allow us to act on behalf of the connected account.

Why we access it

To display incoming comments and direct messages inside the Inka Studio dashboard so studio owners can draft and send replies.
To publish posts (images, captions, hashtags) to the connected accounts on behalf of the studio, after explicit owner approval.

How we store and protect it

OAuth tokens are stored encrypted in our database and are never exposed to third parties outside of Meta's own API calls.
We store only the minimum data required: access tokens, account IDs, account display names, and token expiry dates.
Content fetched from Meta (comments, DMs) is stored temporarily in our queue only until it has been actioned (replied to or dismissed) by the studio owner.

How to revoke access

You can disconnect your Facebook or Instagram account at any time from your Inka Studio dashboard under Social Media settings. This immediately invalidates our stored token.
You can also revoke access directly from your Facebook account settings at facebook.com/settings → Apps and Websites.

We do not use Meta data for any purpose beyond what is described above. We do not sell, share, or use Meta data to serve advertisements.

12. Children & Minors

Inka Studio is not intended for use by anyone under 18. We do not knowingly collect data from minors. Studios are responsible for verifying the age of their clients.

13. Changes to this Policy

We may update this policy. Material changes will be communicated by email or in-app notice. The "Last updated" date above reflects the latest version.

14. Contact

Questions or requests: privacy@inkastudio.app.