Privacy Policy

We at InkDesk and our affiliates are committed to protecting your privacy. This Privacy Policy applies to the personal information and data collected by InkDesk when you interact with our websites, product and services, and any other sites or services that link to this Privacy Policy.

This includes when you:

• interact with us on our websites or through other channels (for example, by communicating with us or attending one of our events);
• use our product and services (including the InkDesk Subscription Service); and
• when you use any other sites or services that link to this Privacy Policy.

Who this policy is for

InkDesk is a booking and client-management platform used by tattoo artists and studios. There are two different reasons you might be reading this, and different parts of this policy apply to each:

If you are an artist or studio with an InkDesk account, or you are thinking about one — this policy explains what we collect about you and how we use it. Most of this document is addressed to you.

If you are a client of an artist or studio that uses InkDesk — you may have reached this page from a booking form, a waiver, an appointment email or an artist's booking page. The artist or studio you are dealing with chose to use InkDesk to run their business, and they decide what information to ask you for and what to do with it. We hold that information for them and act on their instructions — we do not decide what they collect, we do not use it to market to you, and we do not sell it. The parts of this policy written for you are marked "If you are a client" and are collected in Section 7. The short version: for anything about the information your artist holds about you, contact the artist or studio directly.

This Privacy Policy describes how we collect, receive, use, store, share, transfer, and process your Personal Data. It also describes your choices and rights with respect to your Personal Data, including your rights of access and correction of your Personal Data. For the purposes of this Privacy Policy "Personal Data" means any information relating to an identified or identifiable individual. This policy explains our practices; it is not a contract, and it does not replace any privacy notice given to you by an artist or studio that uses InkDesk. If you have an InkDesk account and you do not agree with how we handle your information, you can close your account at any time. If you are a client of an artist or studio, the information they hold about you is governed by their own privacy practices — please raise any concerns with them directly.

InkDesk customers may collect and manage Personal Data when using our product and services, or what we may refer to as the Subscription Service. "Subscription Service" is defined in the InkDesk Customer Terms of Service and means all of our web-based applications, tools and platforms that we make available to you, and are developed, operated, and maintained by us, accessible at portal.inkdesk.app (the application you log in to), at inkdesk.app (our website and the public profile and booking pages we host for our customers), and through our mobile applications. When you use the Subscription Service, InkDesk processes Personal Data as a processor under the direction of our customers. Our customers, as data controllers, are responsible for complying with any regulations or laws that require providing notice, disclosure, and/or obtaining consent prior to collecting their customers' Personal Data using the Subscription Service. Please see Section 1.b "Information We Process on Behalf of our Customers When They Use the Subscription Service" and Section 1.c "Information We Collect and Process When You Use the Subscription Service" as well as our Customer Data Processing Agreement for more information.

We will post any changes to this policy on this page and update the "last updated" date at the top. If the changes are material, we will also show a notice on this page for at least thirty (30) days, and we will notify account holders by email or by a notice in their InkDesk account. If you do not have an InkDesk account — for example because you are a client of an artist or studio that uses InkDesk — the notice on this page is how we tell you, so please check back before providing information if it has been a while. Where the law requires your consent to a change, we will ask for it rather than rely on notice. Terms not otherwise defined in this Privacy Policy will have the meaning as set forth in the InkDesk Customer Terms of Service.

If you have any questions about this Privacy Policy or to exercise the privacy rights and choices we offer please contact us as follows: [email protected]

1. What Information We Collect and Process

a. Information You Provide to InkDesk

When you interact with us via our websites or any sites or services that link to this Privacy Policy or use the Subscription Service, we may collect Personal Data and other information from you, as further described below.

When You Visit Our Websites

We collect Personal Data from you when you submit web forms or interact with our websites, for example by subscribing to an InkDesk blog, signing up for a webinar, subscribing to one of our services or requesting customer support. We may ask for your email address, first and last name, job title, and other similar business information. You are free to explore some of our websites without providing any Personal Data about yourself.

Account and User Information

We collect Personal Data when you sign up for an InkDesk account, create or modify user information, set preferences, or provide any other related information to access or utilize our Subscription Service. You can create an account or sign in using Google or Apple; where you do, we receive your name and email address from that provider.

Payment Information

We collect payment and billing information when you register for paid products or services. For example, we may ask you to provide a billing address, or a billing contact for your InkDesk account. If you give us payment information, we use it solely as authorized by you in accordance with this Privacy Policy.

You may also provide payment information, such as a credit card number or bank account numbers, when purchasing products or services. We use secure third-party payment service providers to manage payment processing, which is collected through a secure payment process.

Customer Testimonials

We post customer testimonials and comments on our websites, which may contain Personal Data. We obtain each customer's consent via email or through other agreements between customers and InkDesk prior to posting the customer's name and testimonial.

b. Information We Process on Behalf of Customers When they Use the Subscription Service

When customers use the Subscription Service, they may store and manage information about their own clients. Depending on what a particular artist or studio chooses to collect, this can include:

• name, email address, phone number, postal address and date of birth;
• booking, appointment, project and session records, including notes the artist writes;
• messages exchanged between the artist and the client;
• photographs and images uploaded by the artist or the client, including reference images, artwork, and photographs of the client or of areas of the client's body;
• responses to booking forms and digital waivers, which — depending on the form the artist creates — may include health-related information such as allergies, medical conditions, medications or pregnancy status;
• an electronic signature captured when a client signs a waiver;
• files uploaded as part of signing a waiver, which artists commonly use to collect an image of a government-issued identity document; and
• records of deposits and payments, including amount, date and status. We do not receive or store payment card numbers — those are handled by the payment processor.

Some of this information is sensitive. Health-related answers, identity documents, images of a person's body and electronic signatures can attract additional protection under privacy, health-privacy and biometric-privacy laws. The artist or studio decides what to ask for and is responsible for the lawful basis, notice and consent required to collect it. We process it only as their service provider, under their instructions, and we do not use it for our own purposes. See "If you are a client of an artist or studio that uses InkDesk" in Section 7 below.

We call the information that our customers submit or collect via the product 'Customer Data' under our Customer Terms of Service.

We do not control the types of Personal Data that our customers may choose to collect or manage using the Subscription Service. We store our customers' information on our service providers' servers but process it as a processor under our customers' instructions and in accordance with our Customer Terms of Service, which prohibit us from using the information except as necessary to provide and improve the Subscription Service and as required by law.

If you are a client: what happens when you submit a booking form

Artists and studios build their own booking forms in InkDesk and choose every question on them. When you submit one:

• Your answers go to the artist or studio, and become part of their records about you in their InkDesk account. We store them on their behalf.
• We check that the submission is genuine using a bot-protection service, and we screen it automatically for spam, fraud and abusive content (see Section 2(d)). A submission can be blocked or flagged by these checks, including occasionally in error. If you have submitted a form and had no reply, contact the artist another way.
• We use the information to operate the service for the artist — storing it, showing it to them, sending them a notification, and letting them reply to you. We do not use it to market InkDesk to you, we do not add you to our mailing lists, we do not sell it, and we do not use it to build a profile of you across different artists.
• Anything you type into a free-text box, and any file or photograph you upload, is stored as you submitted it. Only include what you are comfortable sharing with that artist. If you are unsure why a question is being asked, ask the artist before answering — they chose the questions, not us.
• Files and images you upload are stored securely and are visible to the artist or studio you sent them to and to anyone they have given access to in their account.

If you are a client: digital waivers

An artist or studio may send you a waiver or consent form to complete and sign electronically. They write the waiver and decide what it asks for — we provide the software that delivers, collects and stores it. We make no assessment of whether a waiver is appropriate, complete or legally valid; that is a matter for the artist and, if you are unsure, for your own advisor.

When you complete and sign one, we record: your answers, your electronic signature, any files you upload, the date and time you submitted it, the IP address you submitted it from, and the browser or device you used. Before a waiver can be submitted, you must confirm a one-time code sent to the email address on record for you, so the submission is tied to control of that address. This information is kept as part of the artist's records so that both of you have a reliable record of what was signed and when.

• Who can see it. The artist or studio, and anyone they have given access to in their account. Viewing a file you uploaded — an identity document, for example — requires them to re-enter their credentials, and every view is recorded in an activity log.
• Identity documents. Where a waiver asks you to upload one, the image is never included in the signed document that can be downloaded or forwarded — it stays behind a login. Only the artist and their authorised staff can view it.
• How long it is kept. The waiver stays in the artist's account. The artist decides how long to keep it, and may be required by law, their regulator or their insurer to keep it for a period. See Section 5.
• Getting a copy, correcting it, or asking for it to be deleted. Contact the artist or studio. If you cannot reach them, contact us at [email protected] and we will pass your request on and tell you we have done so.
• Health information. Some waivers ask about allergies, medical conditions, medications or similar matters. The artist decides whether to ask — we do not require it. If you think you are being asked for more than is necessary, raise it with the artist before you answer.

If you are a client: joining an artist's mailing list

Some artists offer a way to sign up for updates from their public InkDesk page. If you sign up, your email address is added to that artist's own mailing list — it is not added to any InkDesk list, and we do not use it to market InkDesk to you. The artist decides what they send you and how often, and is responsible for honouring your unsubscribe request. Every marketing message they send you must include a way to unsubscribe; you can also ask the artist directly to remove you.

Our customers control and are responsible for correcting, deleting or updating the information they process using the Subscription Service and for complying with any regulations or laws that require providing notice, disclosure, and/or obtaining consent prior to transferring the Personal Data to InkDesk for processing purposes.

c. Information We Collect and Process When You Use the Subscription Service

Usage Data

We collect usage data when you or your users in your InkDesk account interact with the Subscription Service. Usage data includes metrics and information regarding your use and interaction with the Subscription Service such as what product features you use the most, when a booking or project is opened and closed, and how often certain features are used in your account.

We use a third-party product analytics service to collect and analyse usage data — which features are used, when actions are taken, and how users move through the product — so that we can understand how InkDesk is used and improve it. It receives your user and account identifiers, device and browser information, IP address, and the events described above.

Session replay. We also use that service's session replay functionality, which records a reconstruction of your interactions with the InkDesk application — the screens you visit, and your clicks, taps, scrolling and navigation — so that we can diagnose problems and understand where the product is confusing. Every logged-in session is recorded. Text you type into form fields and text displayed on screen are both masked, so the recording shows how the interface was used rather than the content within it. We do not use recordings for advertising or for any purpose other than product improvement and support, and recordings are retained for thirty (30) days.

Your choice. If you do not want your use of InkDesk to be recorded by session replay, contact us at [email protected] and we will disable it for your account. That provider acts as our service provider (and, where applicable, our processor) and is bound by contract to use the information only to provide the service to us.

Where this applies. Our product analytics and session replay run in the InkDesk web application and mobile apps — the parts of InkDesk that artists and studios log in to. They do not run on artists' public booking pages or booking forms, so if you are a client filling in a booking form, your session is not recorded by these tools. Those pages use the separate, more limited technologies described in Section 6.

Mobile

When you access or use the Subscription Service through our mobile applications for iOS and Android, we collect:

• Device and app information — device model, operating system and version, app version, language and time-zone settings, and device identifiers.
• Diagnostics — crash reports, error logs, performance data and, on the web application, a recording of the session in which an error occurred, collected through a third-party error-monitoring service so that we can find and fix problems. Text and media in these recordings are masked.
• Usage and session replay — the product analytics and session replay described under "Usage Data" above operate in the mobile applications as well as on the web.
• Push notifications — if you allow notifications, we store a token identifying your device and deliver notifications through a third-party notification service and the Apple Push Notification service or Firebase Cloud Messaging. Notifications we send you can contain information about your clients — for example a client's name, a preview of a message they sent you, or the amount of a deposit they paid — so that the notification is useful without opening the app. That content passes through our notification provider and through Apple or Google in order to reach your device, and may be visible on your lock screen to anyone who can see it. You can turn notifications off at any time in your device settings, and you can hide notification previews in your device's own notification settings.
• Purchase information — if you subscribe through the App Store or Google Play, we receive confirmation of your purchase and subscription status through a third-party subscription-management service. We do not receive your payment card details from Apple or Google.
• Support conversations — if you use in-app support chat, your messages and the contact details you provide are processed by our support-chat provider on our behalf.

Permissions you control. The applications ask for permission before accessing your photo library or files (so that you can attach reference images, artwork and documents to client projects) and before sending you notifications. We only access what you select — we do not scan or upload your photo library. You can grant or withdraw these permissions at any time in your device settings; withdrawing a permission may stop the related feature from working.

We do not collect precise device location, and we do not use the mobile applications for advertising or cross-app tracking.

Importing your details

To save you setting things up by hand, InkDesk can import information you already have — for example from a public page or a document you upload. Where you choose to do this, we send what is needed to retrieve or read that source to a third-party service, which returns the content to us. These are one-off actions you start — we do not connect to, monitor or continue reading any source afterwards. A document you upload for import may contain client information if the form you are importing has been filled in; it is processed to read the text and is not retained by the provider for any other purpose.

Third-party integrations

You can connect accounts you hold with other services to InkDesk — for example, a calendar account, so that your InkDesk appointments and your existing calendar stay in sync. When you connect an account, you authorise the other service to give us access to specific information, and we access only what is needed to provide the connected feature.

Information we may receive through a connection includes account and profile identifiers, and — depending on the connection — calendar events and their details. We store that information as part of your Customer Data and handle it under this Privacy Policy and our Data Processing Agreement. Information you bring into InkDesk from a connected account may concern other people, such as your clients; you are responsible for having the right to bring it in.

Disconnecting. You can disconnect an integration at any time from your InkDesk settings and, where the other service offers it, from that service's own permissions page. Disconnecting stops further information from being exchanged but does not delete information already stored in your InkDesk account, which you can delete separately. Deleting information from InkDesk does not delete it from the other service.

We are not responsible for the other service. Once information leaves InkDesk for a connected service, or before it reaches us from one, it is governed by that provider's own terms and privacy notice. Review the permissions you grant carefully.

If we add new integrations — for example integrations that bring messages from other platforms into your InkDesk conversations — we will update this Privacy Policy to describe what information they involve before making them available to you.

d. Information We Collect From Other Sources

Third Parties

We may receive information from third party service providers and from related companies.

Log Files

Like most websites and technology services delivered over the Internet, we automatically collect and store information about your computer hardware and software when you visit our websites, use our product and services, or visit other sites or services that link to this Privacy Policy. This information can include your IP address, browser type, domain names, internet service provider (ISP), and the files viewed on our websites (e.g., HTML pages, graphics, etc.), your operating system, access times and referring website addresses.

When you use the Subscription Service, we collect and store the categories of information listed above in logs in the following instances:

• When an InkDesk user logs into their account and uses the InkDesk application; or
• When an individual visits a public booking page or profile that we host on behalf of a customer.

Buttons, tools, and content from other companies

Our websites may include features and widgets (such as the share and/or "like" button or interactive mini-programs) that run on our websites. These features may collect your IP address, which page you are visiting on our sites, and may set a cookie to enable the feature to function properly. These features and widgets are either hosted by a third party or hosted directly on our websites. This Privacy Policy does not apply to these features. Your interactions with these features are governed by the privacy policy and other policies of the companies providing them.

We use Cloudflare Turnstile (Cloudflare, Inc., United States) on our website, public booking pages and forms to distinguish human visitors from automated ones and to prevent abuse. Turnstile receives your IP address and limited information about your browser and its interaction with the page. We also use Cloudflare for content delivery, network security and protection against denial-of-service attacks, which involves Cloudflare processing your IP address and request information. Cloudflare acts as our service provider.

2. How We Use Personal Data

a. To Communicate with You About the Product and Services

We use the account information you provide to InkDesk when signing up for the Subscription Service to send you transactional emails or in-app notification about billing, account management, and other administrative matters. We may also send you updates regarding our Customer Terms of Service or other legal agreements, and may also communicate with you about security incidents via email or in-app notification.

We use your information to provide customer support, such as resolving technical issues you encounter and analyzing product outages or bugs.

If you use the InkDesk mobile applications and allow notifications, we send push notifications about activity in your account — a new booking request, a message from a client, a paid deposit, or a reminder you set. These notifications can include information about your clients, such as a client's name, a preview of a message they sent you, or the amount of a payment, so that the notification is useful at a glance. To reach your device, that content passes through our notification provider and through Apple's or Google's push notification service, and may be visible on your lock screen to anyone who can see your phone. You can turn notifications off in your device settings at any time, and your device settings also let you hide notification previews. We may occasionally send a notification about a new InkDesk feature; you can turn those off in the same place.

b. To Provide the Subscription Service

We use your account information and Customer Data to provide the product and services to you. For example, we use the email address you provide when signing up for the product to create your user account, and we use your payment information to process payments for paid use of the Subscription Service. We also use this information to authenticate you when you log in and to provide customer support.

c. To Improve and Develop Our Product and Services

We collect usage data about how you or your users interact with our product and services. We use this data to develop and improve our products and services. For example, we use usage data to assess trends and usage across the product to help us determine what new features or integrations our users may be interested in.

We may use Customer Data in aggregated and de-identified form to develop and improve features and functionality of the Subscription Service. We do not use Customer Data to train generally-available third-party foundation models, and we do not sell Customer Data. Where we use a third-party artificial-intelligence service to provide a feature, we engage it as a subprocessor under our Data Processing Agreement and, to the extent within our control, under terms that prohibit it from using Customer Data to train its own models.

You may opt out of the use of your Customer Data for these purposes by emailing [email protected]; we will action your request within thirty (30) days. Where you opt out, the opt-out applies to all Customer Data in your account, including information about your clients. If a client asks you to opt their information out, exercising this opt-out for your account is how you do it. You cannot opt out of the filtering and security processing described in Section 2(d), which is necessary to operate the Subscription Service.

We may publish data about how our product and services are being used across our customer base. When we share statistical information externally in this way, the data will be aggregated and we will not identify individual users or customers.

d. To Secure and Protect our Product and InkDesk Users

We use your account information to investigate and help prevent security incidents. We may also use this information to meet legal requirements. We use your information to verify user accounts, new product sign-ups, and to detect and prevent product abuse.

Automated screening of incoming messages. To protect artists and studios from spam, fraud and abusive content, we automatically screen messages and booking requests submitted through InkDesk, including through public booking forms. This screening uses third-party content-classification and spam-detection services, and involves transmitting the content of the message to them for analysis. We do not send them your email address or IP address. The providers we use are named in Annex 3 of our Data Processing Agreement. They return a classification which we use to allow, flag or block the message. These services act as our service providers and are contractually restricted from using the content for their own purposes, including to train their own models. They may retain what they receive for a short period for their own abuse monitoring — currently up to thirty (30) days — before deleting it.

A message may be blocked or flagged in error. Screening does not involve a decision that produces a legal or similarly significant effect on the sender; if a message of yours was blocked and you believe it should not have been, contact us at [email protected] or contact the artist directly.

We use log files to provide general statistics regarding use of the websites by you, including how you use our websites, what country you are logging in from (for analytics, export control and regulatory purposes) and to help improve the navigation experience. Your IP addresses are also collected and logged for security and debugging purposes, for example to track access patterns, investigate security events and incidents. For these purposes we do link this automatically-collected data to other personal data provided by you such as name, email address, address, and phone number.

e. To Market and Promote the Subscription Service

This section is about people who use InkDesk directly — artists, studios, and people who contact us or visit our websites. We do not market InkDesk to the clients of our customers. We do not use the information an artist or studio stores about their clients to advertise to those clients, to add them to our mailing lists, to combine with information from other sources, or to build profiles of them. Where we use information to improve our products, we use it in aggregated or de-identified form, and an artist or studio can opt their whole account out by contacting us at [email protected] — if you are a client and you want your information excluded, ask your artist or studio to opt out.

We use the information you provide to InkDesk to market and promote the products, services, and other offerings. For example, we use the information, like your email or physical address, to send information or InkDesk content to you which we think may be of interest to you by post, email, or other means and send you marketing communications relating to our business. You may opt out of receiving this promotional content by following the instructions contained in each communication that we send to you or by contacting us at [email protected]. If you unsubscribe from our marketing lists, we will continue to contact you regarding administrative matters, and to respond to your requests.

Where required by law, we will only send marketing communications with your consent. Otherwise, we will market and advertise our products and services on the basis of our legitimate business interests.

f. Other purposes if we obtain your consent

We share your data with third parties when you give us consent to do so.

3. How We Share Personal Data

a. Service Providers

We may share Personal Data with our third party service providers to support our websites, products, and services. For example, we use service providers for data hosting, application development, marketing and customer support. These service providers are prohibited from using your Personal Data except for these purposes, and they are required to maintain the confidentiality of your information.

We use service providers in the following categories:

• Cloud hosting, databases, file storage, backups and content delivery.
• Email delivery.
• Payment processing for deposits collected by artists, and subscription billing for InkDesk itself.
• Product analytics, session replay, and error and performance monitoring.
• Customer support chat.
• Automated content screening and spam detection.
• Push notification delivery and mobile app updates.
• Optional import features, where you choose to bring in information you already hold elsewhere.
• Address and location lookup, and calendar synchronisation where you connect it.
• Website analytics and advertising measurement, on our marketing website only.

Each of these providers is bound by contract to process information only as we instruct and to keep it confidential. The providers that handle information on behalf of our business customers are named individually in Annex 3 of our Data Processing Agreement, which is kept current.

b. Corporate Events

If we (or our assets) are acquired by another company, whether by merger, acquisition, bankruptcy or otherwise, that company would receive all information gathered by InkDesk on the websites and the Subscription Service. In this event, we will notify account holders by email and by a prominent notice on our website, and will explain any change in how Personal Data is used and the choices available. If you are a client of an artist or studio that uses InkDesk, we will not contact you directly — the information about you stays under the control of the artist or studio, and they remain the party responsible for it.

c. Compelled Disclosure

We reserve the right to use or disclose your Personal Data if required by law or if we reasonably believe that use or disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or comply with a law, court order, or legal process. If you use the Subscription Service as an account holder, Customer Data is treated as Confidential Information under our Customer Terms of Service. Where we receive a legal demand for information held in a customer's account, we will notify that customer so they have an opportunity to respond, unless we are legally prohibited from doing so or there is an emergency involving a risk of harm. We disclose only what we are required to disclose.

4. International Data Transfers

Where we store and process information. InkDesk is InkDesk Inc., a corporation incorporated in Canada under the Canada Business Corporations Act. We store and process Personal Data on infrastructure operated by our hosting providers located in the United States, and our service providers may process Personal Data in the United States, Canada and other countries. This means your Personal Data — and, if you are a customer, the Personal Data of the clients whose information you store in the Subscription Service — is transferred outside the country in which you are located, including outside Canada, the European Economic Area and the United Kingdom.

Foreign access. Personal Data stored in another country is subject to the laws of that country and may be accessible to the courts, law enforcement and national security authorities of that country. We disclose Personal Data to authorities only where we are legally required to and, where permitted, we notify the customer first.

How we protect transferred data. Where we transfer Personal Data from the European Economic Area, the United Kingdom or Switzerland to a country that has not been recognised as providing an adequate level of protection, we rely on the European Commission's Standard Contractual Clauses, supplemented by the UK International Data Transfer Addendum for transfers from the United Kingdom and by the applicable Swiss adaptations for transfers from Switzerland, together with additional technical and organisational measures where appropriate. Where we transfer Personal Data from Canada, we remain accountable for it under Canadian privacy law and use contractual and other means to provide a comparable level of protection. The transfer terms that apply between us and our business customers are set out in our Data Processing Agreement.

Copies. If you would like a copy of the transfer safeguards we rely on, contact us at [email protected].

5. How We Store and Secure Personal Data

a. Data Storage and Security

We use a variety of security technologies and procedures to help protect your Personal Data from unauthorized access, use or disclosure. We secure the Personal Data you provide on computer servers in a controlled, secure environment, protected from unauthorized access, use or disclosure. All Personal Data is protected using appropriate physical, technical and organizational measures.

Access by our staff. A small number of authorised InkDesk personnel can access customer accounts where it is necessary to provide support, investigate a problem, maintain the security of the service, or comply with a legal obligation. Where a support issue requires it, and with the account holder's request or agreement, a member of our support team may view an account as the account holder sees it, which can include information about that account holder's clients. Access is limited to personnel who need it, those personnel are subject to confidentiality obligations, and every such session is recorded in an audit log. We do not access customer accounts to browse content, for marketing, or for any purpose unrelated to those above.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential, for enabling the security features we make available, and for telling us promptly if you believe your account has been accessed without authorization.

If a security breach affects your Personal Data, we will investigate, take steps to contain and remediate it, and notify you and any regulator where we are required to do so by applicable law, without undue delay. Where InkDesk processes Personal Data on behalf of a business customer, we notify that customer rather than the individuals concerned, and the customer is responsible for notifying the individuals — see our Data Processing Agreement.

b. Retention of Personal Data

How long we keep information we collect about you depends on the type of information and how we collect and store it. After a reasonable period of time, we will either delete or anonymize your information or, if this is not possible, then we will securely store your information and isolate it from any further use until deletion is possible.

We retain Personal Data that you provide to us where we have an ongoing legitimate business need to do so (for example, as needed to comply with our legal obligations, resolve disputes and enforce our agreements).

In particular:

• Account and Customer Data. We keep the information in your InkDesk account for as long as your account is open. When you delete your account, we erase your data from our live systems immediately — there is no grace period, so export anything you need first. Copies remain in backups for the period below.
• Client records, booking submissions, messages and uploaded files. These are kept for as long as they remain in your account. You control whether they are deleted. Where the Subscription Service provides a way to delete a particular record, deletion is permanent and cannot be reversed; where it does not, the information is deleted when your account is deleted.
• Waiver submissions and uploaded files. Waiver responses, signatures, submission metadata and any files uploaded with them are kept for as long as they remain in your account, and are deleted when your account is deleted. If you are required to retain signed waivers for a minimum period, you must keep your own copy.
• Backups. Copies of Personal Data persist in our database backups for fourteen (14) days after deletion, and in versioned file storage for thirty (30) days, after which they age out. Backup copies are isolated from live processing and are not used for any other purpose.
• Billing and transaction records. We keep billing records, invoices and payment records for as long as required by tax and accounting law, typically seven (7) years.
• Support communications. Support conversations are retained for twenty-four (24) months.
• Marketing preferences. We keep a record of an unsubscribe request indefinitely so that we can honour it.
• Record of a deleted account. When an account is deleted we keep a minimal record — the email address and an abuse indicator — so that we can detect and prevent abuse of the deletion process, such as deleting and immediately re-registering to evade a restriction. We rely on our legitimate interest in preventing fraud and abuse. It is not used for any other purpose, and we keep it for three (3) years.
• Logs and security records. Server, access and security logs are kept for thirty (30) days. Transient copies held in our internal processing systems are retained for no more than two hours.
• Usage and product analytics. Analytics event data is kept for thirty-six (36) months. Session replay recordings are kept for thirty (30) days.

If you are a client: how long your information is kept

Information about you lives in the account of the artist or studio you dealt with, and they control how long it is kept. Different artists will keep records for different periods, and some are required by law, a regulator or an insurer to keep signed waivers and treatment records for a minimum period.

• To ask for your information to be deleted or corrected, contact the artist or studio. They decide, and they are the party your request is made against.
• We do not delete an artist's records on our own initiative, and we will not do so at a client's request without the artist's instruction, except where the law requires us to. If you contact us, we will pass your request to the artist and tell you we have done so.
• If the artist closes their InkDesk account, their data — including the records about you — is erased from our live systems immediately. Copies persist in backups for a short period before ageing out (see above).
• Some information is kept even after a deletion request, where we or the artist need it to comply with a legal obligation, to establish or defend a legal claim, to keep financial records, or to keep our service secure — for example records of a payment, or security logs.

If you have elected to receive marketing communications from us, we retain information about your marketing preferences for a reasonable period of time from the date you last expressed interest in our content, products, or services, such as when you last opened an email from us or ceased using your InkDesk account. We retain information derived from cookies and other tracking technologies for a reasonable period of time from the date such information was created.

6. Cookies and Similar Technologies

a. Cookies

When you visit our websites, sign up for an InkDesk account, or request more information about InkDesk we collect information automatically using tracking technologies, like cookies and tracking pixels.

InkDesk and our partners use cookies or similar technologies (such as web beacons and JavaScript) to analyze trends, administer the website, monitor how visitors navigate around the websites, and to gather demographic information about our user base as a whole. On our marketing website these include Google Analytics and Tag Manager, Google Ads, Meta, Reddit and Microsoft Clarity; none of them run inside the InkDesk product.

Artists' public booking pages and profiles. Pages hosted by us on behalf of an artist or studio — an artist's public profile, and the booking forms clients fill in — use a limited set of technologies. We use Cloudflare to serve the page securely and to tell genuine visitors from automated ones, and a Google Tag Manager container to understand how these pages are used. An artist can also connect their own analytics account to their page. Where they have, that analytics provider receives information about your visit under the artist's own arrangements, not ours — we do not control it and we do not receive that data. Ask the artist if you want to know what they use. We do not run session replay on these pages, we do not use them to serve advertising, and we do not build a profile of you across different artists' pages. Where the law requires consent before non-essential cookies are set, we do not set them unless you have accepted them. You can also control cookies through your browser settings; blocking essential cookies may stop a booking form from working.

We group the technologies we use into the following categories. You can control non-essential categories where we ask for your consent.

• Strictly necessary — keeps you signed in, keeps your session secure, protects forms against automated abuse, and remembers your cookie choices. Examples: session and authentication cookies; Cloudflare security and Turnstile; the region cookie that decides whether to show a consent banner. No consent needed — the service cannot work without these.
• Analytics — tells us how our websites and product are used so we can improve them. Examples: Google Analytics and Google Tag Manager on our websites and on artists' public booking pages; our product analytics service in the logged-in product (see Section 1(c)). Consent needed where the law requires it.
• Advertising — measures our advertising and shows our ads elsewhere. Used on our marketing website only — not on artists' booking pages and not in the product. Examples: Google Ads, Meta and Reddit advertising technologies. Consent needed.
• Session recording on our marketing website — Microsoft Clarity records how visitors move through our own website so we can improve it. It does not run on artists' booking pages or in the product. Consent needed.
• Payment — where you pay a deposit, Stripe sets cookies to detect fraud. These are necessary to take a payment safely.
• Support and diagnostics — if you open a support chat, Crisp stores a key so the conversation continues across visits; our error-monitoring tool stores short-lived session data to help us diagnose a fault. These run in the InkDesk product and on our website, not on artists' booking pages.
• Attribution — remembers how you first found us, for up to 90 days. Example: our first-touch attribution cookie. Consent needed where the law requires it.

How to control them. Use the "Cookie settings" link in the footer of our website to change your choices at any time. We honour Global Privacy Control (GPC) signals where required. Your browser also lets you block or delete cookies — blocking strictly necessary cookies may stop sign-in or a booking form from working.

b. Advertising

We partner with third party ad networks to manage our advertising on other sites. Our ad network partners use cookies and web beacons to collect information about your activities on this and other websites to provide you targeted advertising based upon your interests. We do this on our marketing website only — not on artists' booking pages and not inside the InkDesk product.

7. Your Privacy Rights and Choices

a. Personal Data Requests

These rights concern information we hold about you in our own right — for example your InkDesk account, your enquiries to us, and your use of our websites and apps. If you are a client of an artist or studio that uses InkDesk, your rights in the information they hold about you are exercised against them, not against us — see "If you are a client of an artist or studio that uses InkDesk" below.

You have the following data protection rights:

• Access, Correction or Deletion. You can request access, correction, updates or deletion of your Personal Data.
• Objection. You can object to our processing of your Personal Data, ask us to restrict processing of your Personal Data or request portability of your Personal Data.
• Withdraw Consent. If we have collected and processed your Personal Data with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your Personal Data conducted in reliance on lawful processing grounds other than consent.
• Complaint. You have the right to complain to a data protection authority about our collection and use of your Personal Data.

We do not sell your Personal Data for money. See Section 8 for information about "sale" and "sharing" as those terms are defined under U.S. state privacy laws, and how to opt out.

To exercise any of these rights, please contact [email protected]

Please note that to protect personal information, we may verify your identity by a method appropriate to the type of request you are making. Depending on where you reside, you may be entitled to empower an “authorized agent” to submit requests on your behalf. We will require authorized agents to confirm their identity and authority, in accordance with applicable laws. You are entitled to exercise the rights described above free from discrimination.

We will respond to your request to change, correct, or delete your data within a reasonable timeframe and notify you of the action we have taken. In some instances, your rights may be limited, such as where fulfilling your request would impair the rights of others, our ability to provide a service you have requested, or our ability to comply with our legal obligations and enforce our legal rights.

If you are a customer, prospect, or otherwise interact with an InkDesk customer that uses our Subscription Service and would like to access, correct, amend or delete your data controlled by the customer, please contact the relevant customer directly. InkDesk acts as a processor for our customers and will work with our customers to fulfill these requests when applicable.

If you are a client of an artist or studio that uses InkDesk

When you book with, message, or sign a waiver for an artist or studio that uses InkDesk, the artist or studio decides what information to collect about you and why. They are responsible for it; we process it on their behalf and under their instructions. To see, correct, or delete the information they hold about you, or to ask about how they use it, contact the artist or studio directly. If you contact us instead, we will pass your request to them and tell you we have done so.

What we collect ourselves. When you visit a public InkDesk booking page or artist profile, we collect limited information for our own purposes: your IP address, browser and device information, the pages you view, and information collected by the cookies and analytics technologies described in Section 6. We use it to operate and secure those pages, to prevent spam and abuse (see Section 2(d)), and to understand how they are used. We do not use it for advertising, and we do not build a profile of you across artists.

If you use a studio. Where your artist works in a studio account, other members of that studio — such as the owner or an administrator — may be able to see the records associated with you, depending on how the studio has configured its account. If your artist later leaves that studio, the records about you stay with the studio's account, because the studio is the business that holds them. If you want your records with your artist at their new business, or removed from the old one, ask each of them directly — we act on the instructions of whoever holds the account.

b. Anti-Spam Policy

Our Acceptable Use Policy applies to us and to our customers and, among other things, prohibits use of the Subscription Service to send unsolicited commercial email in violation of applicable laws, and requires the inclusion in every email sent using the Subscription Service of an "opt-out" mechanism and other required information. We require all of our customers to agree to adhere to the Acceptable Use Policy at all times, and any violations of the Acceptable Use Policy by a customer can result in immediate suspension or termination of the Subscription Service.

c. To Unsubscribe From Our Communications

You may unsubscribe from our marketing communications through one of the following methods:

• by clicking on the "unsubscribe" link located on the bottom of our e-mails;
• updating your communication preferences;
• contacting us at [email protected]

Customers cannot opt out of receiving transactional emails related to their account with us or the Subscription Service.

d. To Unsubscribe From Our Customers' Communications

Our customers are solely responsible for their own marketing emails and other communications; we cannot unsubscribe you from their communications. Individuals who interact with an InkDesk customer can unsubscribe from our customers' marketing communications by clicking on the "unsubscribe" link located on the bottom of their emails, or by contacting them directly.

If you are a client: messages and emails

When an artist or studio communicates with you through InkDesk — a booking confirmation, an appointment reminder, a waiver request, a payment receipt, or a message they write — the message is sent by our systems on their behalf, under their name. We use an email delivery provider (see Section 3) to deliver it, and we store the message and any attachment as part of their records about you so that they have a history of your conversation.

• The artist or studio can see the whole conversation, and so can anyone they have given access to in their account — in a studio, that may include the owner or an administrator.
• Some messages are transactional and cannot be turned off while you have an active booking — a confirmation, a reminder, a waiver request or a receipt is part of the service the artist is providing. Marketing messages are different: you can unsubscribe from those, and the artist must honour that.
• We do not use the content of your messages to market to you, and we do not read them except as needed to operate and secure the service, to screen for spam and abuse (see Section 2(d)), or where the law requires it.
• To stop receiving messages altogether, or to ask about anything in them, contact the artist or studio. We cannot unsubscribe you from their communications.

7A. Canadian Privacy Rights

a. Applicability

InkDesk is based in Canada. Our handling of personal information is governed by the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, by substantially similar provincial legislation in Alberta, British Columbia and Quebec, including Quebec's Act respecting the protection of personal information in the private sector as amended by Law 25.

b. Your rights

If you are in Canada you have the right to: access the personal information we hold about you and be told how it has been used and to whom it has been disclosed; ask us to correct it if it is inaccurate or incomplete; withdraw your consent to our use or disclosure of it, subject to legal or contractual restrictions and reasonable notice; and, in Quebec, receive the computerised personal information you provided to us in a structured, commonly used technological format and have it transmitted to another organisation where technically feasible. To exercise any of these rights, contact us at [email protected].

c. Consent

We collect, use and disclose personal information with your consent, except where the law permits or requires otherwise. Depending on the sensitivity of the information and the circumstances, consent may be express or implied. You may withdraw consent at any time, subject to legal or contractual restrictions; if you withdraw consent to processing that is necessary to provide the Subscription Service, we may be unable to continue providing it to you.

d. Storage outside Canada

We store and process personal information outside Canada, including in the United States. See Section 4, "International Data Transfers", for details, including that personal information stored in another country may be accessible to that country's authorities.

e. Automated processing

We use automated systems to screen inbound messages and booking submissions for spam and abuse, as described in Section 2(d). We do not use personal information to render a decision based exclusively on automated processing that produces legal effects concerning you or significantly affects you. If that changes, we will tell you at the time and you may submit observations for review by a member of our personnel.

f. Privacy Officer

Our Privacy Officer is responsible for our compliance with Canadian privacy legislation and can be reached at: Andrew Dillion-Walshe, Privacy Officer, InkDesk Inc., 2144 Glenhampton Road, Oakville, Ontario L6M 3X1, Canada, [email protected].

g. Complaints

If you are not satisfied with our response to a privacy concern, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, if you are in Quebec, Alberta or British Columbia, to your provincial privacy regulator.

8. California Privacy Rights

a. Applicability

This section applies only to California consumers. For purposes of this section "Personal Information" has the meaning given in the California Consumer Privacy Act (“CCPA”). It describes how we collect, use, and share California consumers' Personal Information in our role as a business, and the rights applicable to such residents. We may share Personal Information with authorized service providers or business partners who have agreed to our contractual limitations as to their retention, use, and disclosure of such Personal Information.

If you are unable to access this Privacy Policy due to a disability or any physical or mental impairment, please contact us and we will arrange to supply you with the information you need in an alternative format that you can access.

b. How We Collect, Use, and Share your Personal Information

This section describes Personal Information we collect as a business in our own right — from artists and studios who use InkDesk, and from visitors to our websites. It does not describe the information an artist or studio collects about their own clients using InkDesk; for that information the artist or studio is the business responsible, and we act as their service provider (see Section 1(b)). We have collected the following statutory categories of Personal Information in the past twelve (12) months:

• Identifiers, such as name, e-mail address, mailing address, and phone number. We collect this information directly from you or from third party sources.
• Commercial information, such as subscription records. We collect this information directly from you.
• Internet or network information, such as browsing and search history. We collect this information directly from your device.
• Geolocation data, such as IP address. We collect this information from your device.
• Financial information, such as Payment Information or financial account numbers in the process of providing you with a subscription. We collect this information from you.
• Other Personal Information, in instances when you interact with us online, by phone or mail in the context of receiving help through our help desks or other support channels; participation in customer surveys or contests; or in providing the Subscription Service.
• The business and commercial purposes for which we collect this information are described in Section 2 of this Privacy Policy. The categories of third parties to whom we "disclose" this information for a business purpose are described in Section 3 of this Privacy Policy. The period of time for which we retain this information is described in Section 5 of this Privacy Policy.

We also derive a limited set of inferences, used only for security and abuse prevention: an abuse rating and account suspicion score for account holders, and spam and abuse classifications of inbound messages. We do not build marketing, advertising or behavioural profiles of anyone — there is no segmentation, propensity or churn modelling of any kind.

c. Your California Rights

You have certain rights regarding the Personal Information we collect or maintain about you. Please note these rights are not absolute, and there may be cases when we decline your request as permitted by law.

The right of access means that you have the right to request that we disclose what Personal Information we have collected, used and disclosed about you in the past 12 months.

The right of deletion means that you have the right to request that we delete Personal Information collected or maintained by us, subject to certain exceptions.

The right of correction means that you have the right to request that we correct any inaccurate personal information that we maintain about you.

The right to non-discrimination means that you will not receive any discriminatory treatment when you exercise one of your privacy rights.

InkDesk does not sell your Personal Information for money. However, our marketing website uses advertising and analytics technologies — including the Meta Pixel and Google Ads conversion tracking — that may disclose identifiers and information about your visit to those advertising platforms for the purpose of measuring and targeting our advertising. Under the CCPA and similar U.S. state privacy laws, this may be considered a "sale" or "sharing" of Personal Information for cross-context behavioural advertising, and you have the right to opt out.

To opt out, use the "Cookie settings" link in the footer of our website to withdraw consent to advertising and statistics cookies, or contact us at [email protected]. We also honour opt-out preference signals such as Global Privacy Control (GPC) transmitted by your browser. We do not sell or share the Personal Information you or your clients store inside the InkDesk product, and we do not use advertising technologies in the logged-in product.

d. How to Exercise your California Rights

You can exercise your rights yourself or you can alternatively designate an authorized agent to exercise these rights on your behalf. Please note that to protect your Personal Information, we will verify your identity by a method appropriate to the type of request you are making. We may also request that your authorized agent have written permission from you to make requests on your behalf, and we may also need to verify your authorized agent's identity to protect your Personal Information.

Please use the contact details below, or see Section 7 "Your Privacy Rights and Choices" above, if you would like to:

• Access this policy in an alternative format;
• Exercise your rights;
• Learn more about your rights or our privacy practices; or
• Designate an authorized agent to make a request on your behalf.

e. Other U.S. State Privacy Rights

Several U.S. states have comprehensive consumer privacy laws, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon and Montana. Whether a particular law applies to us depends on thresholds in that law, such as the number of that state's residents whose information we process. Where one of these laws applies to our processing, and subject to the exceptions in that law, residents of that state may have the right to:

• confirm whether we process their personal data and access it;
• correct inaccuracies;
• delete personal data they provided or that we obtained;
• obtain a portable copy of personal data they provided;
• opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions producing legal or similarly significant effects; and
• appeal a refusal of a request.

We extend these rights to residents of any U.S. state on request, whether or not that state's law currently applies to us. To make a request, contact us at [email protected]; we will verify your identity by a method appropriate to the request and respond within the time required by applicable law. If we decline, you may appeal by replying to our response, and we will inform you of the outcome and of your right to contact your state Attorney General.

Sensitive personal data. Where a state law defines certain information as sensitive — which can include health information, precise geolocation and biometric data — and requires consent before processing it, we rely on our business customers to obtain that consent from their clients, since it is the artist or studio, not InkDesk, that decides what to collect. See Section 1(b).

Opt-out preference signals. We honour Global Privacy Control (GPC) signals transmitted by your browser where required by applicable law.

This section concerns information we hold as a business in our own right — your InkDesk account, your use of our websites and apps. If you are a client of an artist or studio that uses InkDesk, the artist or studio decides what is collected about you and is the party to contact; see "If you are a client of an artist or studio that uses InkDesk" in Section 7.

9. How to Contact Us

If you have any questions about this Privacy Policy or our privacy practices, would like to exercise a privacy right, or need this notice in an alternative format, contact us at:

InkDesk — Privacy
InkDesk Inc.
2144 Glenhampton Road, Oakville, Ontario L6M 3X1, Canada
[email protected]

Our Privacy Officer for the purposes of Canadian privacy legislation is identified in Section 7A.

If you are a client with a concern about an artist or studio

Start with the artist or studio — they control the information and are the party responsible for it. If your concern is that someone is misusing our platform — for example publishing your photograph or personal information without your permission, continuing to contact you after you asked them to stop, or collecting information they have no reason to need — you can report it to us at [email protected]. Our Acceptable Use Policy prohibits these things, and while we cannot resolve a dispute between you and an artist, we will review reports and may remove content or suspend an account. If you believe there is an immediate risk to someone's safety, contact your local emergency services.

10. Other Important Privacy Information

a. We Do Not Sell Personal Data for Money

We do not sell your Personal Data to any third party for money. Some U.S. state privacy laws define "sale" and "sharing" more broadly to include disclosures for advertising purposes; see Section 8 for how those definitions apply to our marketing website and how to opt out.

b. Information About Children

Our websites, product and services are not directed to children, and you must be at least 18 years old to create an InkDesk account. We do not knowingly collect personal information directly from children.

Information about minors collected by our customers. In some places a person under the age of majority may be tattooed or pierced with the consent of a parent or guardian. Where an artist or studio collects information about such a person through InkDesk — including through a booking form or waiver — the artist or studio is responsible for obtaining any consent required from a parent or guardian and for complying with any law protecting children's information. We process that information only on their behalf. If you believe a child's information has been provided to us other than by a customer, contact us at [email protected] and we will delete it.

11. Data from Google Services

InkDesk integrates with Google services to enhance your user experience. We take your privacy seriously and are committed to protecting the data we receive.

What we access. If you connect your Google Calendar to InkDesk, we request access to your Google Calendar (the https://www.googleapis.com/auth/calendar scope) so that we can read your existing events to determine your availability and create, update and remove events corresponding to your InkDesk appointments. We use this access only to provide the calendar synchronisation feature. We do not use Google Calendar data for advertising, we do not sell it, we do not use it to train generalised artificial-intelligence or machine-learning models, and we do not allow humans to read it except with your explicit permission, for security purposes, to comply with applicable law, or where the data is aggregated and de-identified. You can disconnect your Google account at any time from your InkDesk settings or from your Google account permissions page.

In compliance with the Google API Services User Data Policy, we strictly adhere to the Limited Use requirements. This means that any information we receive from Google APIs will be used in a manner that is consistent with Google's policies and only for the purpose for which it was shared with us. We do not share or transfer this data to any other app or service in ways that are not authorized by Google.

For more detailed information on how we handle user data, including data received from Google, and to understand your rights, please visit our full Privacy Policy and the Google API Services User Data Policy.