01 — Legal
Privacy policy
Last updated — [to be completed]
This text explains how InkFlow works and how data is processed. It is not legal advice.
Who is responsible for your data?
InkFlow is published by [to be completed], [to be completed]. The publisher is the controller of tattoo artists' account data and of the site's technical data.
For the data of their own clients entered in InkFlow (client records, requests, documents, messages), the tattoo artist decides the purposes and means: they are the controller. InkFlow then acts as a processor and processes this data only to provide the service.
Data protection contact: [to be completed].
Data we process
- Artist account: name, email address, password (stored in irreversibly hashed form), studio name, public page address, preferences (language, country, time zone, currency).
- Content entered by the artist: clients, appointments, tattoo projects, messages, consent documents, portfolio and reference photos, deposit payment methods (for example TWINT number, IBAN, PayPal link).
- Data of people who send a request from an artist's public page: name, contact details (email, phone, Instagram handle), project description, placement, size, budget, reference photos, language and consent given.
- Data from services connected by the artist (Google Calendar, Gmail): calendar events and emails exchanged with their clients, only to the extent authorised by the artist.
- Technical data: IP address, security logs (sign-ins, sensitive actions), cookies and local storage described below.
- Payment: InkFlow does not store any card number. When online payment is enabled, it will be handled by Stripe (see “Processors and recipients”).
Why, and on what legal basis
- Providing the service (account, calendar, requests, appointments, reminders, service emails): performance of the contract with the artist; for an artist's clients, a request they initiated themselves with the artist.
- Service security, abuse prevention and prevention of fraudulent sign-in attempts, logging: legitimate interest (GDPR, Art. 6(1)(f)) or overriding interest (Swiss nLPD).
- Connecting Google Calendar or Gmail: the artist's consent, which they can withdraw at any time in the settings.
- Health data that may be entered: explicit consent (see the next section).
- Compliance with legal obligations (for example accounting records, replies to authorities): legal obligation.
No data is sold, rented or used for advertising or profiling. No automated decision with legal effects is made.
Health data and consent
To tattoo safely, an artist may need to know certain health information about their clients (allergies, medication, pregnancy, skin conditions…). This information is sensitive data under the Swiss nLPD and falls under the special categories of data under the GDPR (Art. 9).
The artist is the controller of this data: they decide what information to ask for, must limit it to what is strictly necessary, inform their client and obtain their explicit, free and informed consent before recording it, and keep a record of it. InkFlow provides tools (form fields, consent documents) but does not check their content; the document templates provided are indicative and must be adapted to the artist's country and situation.
InkFlow uses this data only to provide the service. It is not intended to access it, except for technical or security reasons, or at the artist's request.
If you are an artist's client, contact them first to exercise your rights over this data. Artists: avoid entering health information in free-text fields when it is not necessary.
Processors and recipients
To run the service we use the following providers, who process data on our behalf:
- Vercel Inc.: hosting of the application and storage of files (photos, documents).
- Neon, Inc.: PostgreSQL database.
- Resend, Inc.: sending of service emails (notifications, confirmations, reminders, password reset) when the message is not sent from the artist's Gmail account.
- Google (Google LLC, Google Ireland Limited): only if the artist connects Google Calendar or Gmail (reading and writing the calendar, sending emails and, depending on the chosen mode, reading them).
- Stripe (Stripe Payments Europe, Ltd., Stripe, Inc.): processing of payments and subscriptions, once this feature is enabled (not yet active at the date of this text).
These providers may process data outside Switzerland and the European Economic Area, notably in the United States. The transfer is then based on an adequacy decision (for example the Swiss-US or EU-US Data Privacy Framework) or on standard contractual clauses.
We do not share your data with other third parties, except where required by law or with your consent.
Retention period
- Account and content: for as long as the account exists. After closure, data is deleted or anonymised within [to be completed], unless a legal retention obligation applies.
- Accepted consent documents: kept as evidence; they cannot be deleted individually once accepted.
- Security logs: kept for as long as needed for the security of the service.
- Backups: deleted data may briefly remain in our providers' technical backups.
The artist is responsible for how long the data of their own clients is kept and can delete it at any time.
Your rights
Depending on the applicable law (Swiss nLPD, GDPR in the European Union and the European Economic Area), you have the following rights:
- access to your data and a copy of it;
- rectification of inaccurate data;
- erasure of your data;
- restriction of processing and objection to certain processing;
- portability (receiving your data in a common format);
- withdrawal of your consent at any time, without affecting what happened before;
- a complaint to a data protection authority (in Switzerland, the Federal Data Protection and Information Commissioner; in the European Union, the authority of your country).
To exercise your rights, write to [to be completed]. We may ask you to prove your identity. If you are an artist's client, your request may be forwarded to the artist, who is responsible for your data. Artists can request the export or deletion of their account and data by writing to us.
Security
Traffic is encrypted (HTTPS), passwords are hashed, Google access tokens are encrypted and can be revoked at any time from the settings, each artist only accesses their own data, sign-in attempts are rate-limited and sensitive actions are logged. No measure guarantees zero risk; in the event of a data breach, we will inform the people and authorities concerned as required by the applicable law.
Changes and contact
We may change this policy; the date of the last update is shown at the top of the page. For any question: [to be completed].