Legal

Privacy Policy

This policy describes what personal information InkBook collects, why we collect it, how we protect it, and what choices you have.

Last updated: June 2026

What data we collect

Personal identifiers: Full legal name, email address, and phone number provided during booking.
Identity verification: Government-issued ID photo uploaded to complete a client profile.
Consent signatures: Electronic signature and IP address captured when signing a consent form.
Payment data: Stripe processes all card information. InkBook stores only the last four digits, card brand, and a tokenized reference — never raw card numbers.
Usage data: IP address, browser type, device identifiers, and pages visited, collected automatically when you use the platform.

Booking management: Name, email, and phone are used to create and communicate about your appointment.
Consent verification: Signature and ID photo provide legally defensible proof that a client consented to a tattoo procedure and confirmed their age.
Chargeback protection: IP address, timestamp, and signed form are retained so studios can dispute fraudulent chargebacks with payment processors.
Platform communications: Email and phone are used to send booking confirmations and SMS reminders via Twilio.
Fraud prevention: Usage data helps us detect and block abusive booking patterns.

All data is stored in Supabase-managed PostgreSQL databases hosted on servers located in the United States.
Data in transit is encrypted with TLS 1.2 or higher. Data at rest is encrypted using AES-256.
Access to the database is restricted by row-level security policies. Studio owners can only access data belonging to their own studio.
ID photos are stored in a private Supabase Storage bucket. Signed URLs expire after a short window and are never publicly indexed.
InkBook employees do not access individual client records except when required to resolve a reported support issue.

Stripe — processes all payment transactions. Card data never passes through InkBook servers. Stripe is PCI DSS Level 1 certified. See stripe.com/privacy.
Twilio — delivers SMS appointment reminders. Your phone number is transmitted to Twilio solely to send messages you opted into at booking. See twilio.com/legal/privacy.
Resend — delivers transactional email (booking confirmations, receipts). Your email address is transmitted to Resend for this purpose only. See resend.com/legal/privacy-policy.
No data is sold, rented, or shared with advertisers. These integrations exist solely to operate the service.

Booking records and consent forms are retained for a minimum of three years to satisfy studio liability and chargeback requirements.
Upon a verified deletion request, all personal identifiers (name, email, phone, ID photo) are permanently removed from our systems within 30 days.
Anonymized, non-identifiable booking statistics (date, duration, service type) may be retained indefinitely for aggregate analytics.
Stripe retains payment records independently per their own retention policies.

You may request a copy of all personal data we hold about you.
You may request correction of inaccurate data.
You may request deletion of your personal data at any time, subject to legal retention obligations.
You may opt out of SMS reminders by replying STOP to any message. Note: opting out of SMS does not cancel your booking.
To exercise any of these rights, email support@inkbook.tech with the subject line "Data Request" and the email address or phone number associated with your booking.