Privacy Policy

Last updated: June 2026

1. Introduction

INKY.Studio ("we", "our", "us") is the data controller responsible for the personal data described in this policy and is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard information when tattoo studios use our services and when customers message a studio that uses INKY.Studio on Instagram. The INKY.Studio platform is built, hosted, and operated on our behalf by our technology provider, Tux Software, acting solely as a data sub-processor under our instructions and a data processing agreement.

2. Who This Policy Covers

  • Studio owners and artists — our direct customers, who create an account and connect their own Instagram, Google, and Stripe accounts.
  • End customers — people who send a Direct Message to a studio's Instagram account, which our assistant answers on the studio's behalf.

3. Information We Collect

  • Account Data: name, email address, studio name, and details provided during sign-up and onboarding.
  • Instagram / Meta Platform Data: when a studio connects its Instagram professional account, we receive the account's Instagram-scoped user ID, username, and basic profile information. When an end customer messages the studio, we receive the content of the Instagram Direct Messages, the sender's Instagram-scoped ID and username, and any images attached to those messages.
  • Booking Data: tattoo descriptions, appointment dates, quotes, and deposit/payment status.
  • Usage Data: browser type, operating system, pages visited, and diagnostic logs.
  • Payment Data: deposits and subscriptions are processed securely through Stripe; full card details are never stored on our servers.

4. Google User Data / Limited Use

When you connect your Google account to INKY.Studio, we access a limited set of Google user data solely to provide booking-automation features. We request only the scopes required for these features:

  • Send email on your behalf (gmail.send): We send transactional booking emails — confirmation, reschedule, and cancellation notices — from your own Gmail address so that customer replies reach you directly. We never read, modify, list, or delete any message in your mailbox, and we never send promotional or bulk email.
  • Manage Calendar events (calendar.events): We create, update, and delete booking appointments on your primary Google Calendar, and read your events to calculate availability and prevent double-booking. We do not access your calendar sharing settings, access controls, or any other calendars.
  • Account identity (openid, email): We read your Google email address to identify the connected account and to record which address your booking emails are sent from.

Storage and security. OAuth access and refresh tokens are encrypted at rest, with encryption keys held in Microsoft Azure Key Vault, and all data is transmitted over HTTPS. We also store your connected Google email address and calendar identifier.

Retention and revocation. We retain this data only while your Google connection is active. When you disconnect Google from the Integrations page, or delete your account, we revoke the refresh token with Google and delete the stored tokens and connection metadata.

Sharing. We do not sell Google user data and do not use it for advertising or to train generalised AI models. Google data is processed only by the sub-processors that host the service — Microsoft Azure (application hosting, database, and Key Vault) and our self-hosted n8n automation (also on Microsoft Azure), which performs booking sends on your behalf. Calendar and Gmail content is transmitted only to Google.

Limited Use. INKY.Studio's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

  • We use Google user data only to provide and improve the booking-automation features described above, which are visible to you in the INKY.Studio dashboard.
  • We transfer Google user data only as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition — and never for any other purpose.
  • We do not use Google user data for serving advertising of any kind, including personalised, retargeted, or interest-based advertising.
  • We do not allow humans to read your Google user data, except where you have given us specific consent, where it is necessary for security purposes such as investigating abuse, where the law requires it, or where the data has been aggregated and anonymised for internal operations.
  • We do not use Google user data to develop, improve, or train generalised artificial-intelligence or machine-learning models.

5. How We Use Your Information

We use Instagram Platform Data solely to provide the messaging service the studio has asked us to run on its behalf:

  • Route an incoming Direct Message to the correct studio and reply within that conversation.
  • Answer questions, build a quote, and share a booking deposit link — only in response to a message the customer started.
  • Display the studio's own conversations and bookings to the studio owner in their dashboard.

We do not use Instagram Platform Data for advertising, we do not sell it, and we never send unsolicited or bulk messages.

6. How Message Content Is Processed (AI)

To understand a customer's enquiry and draft a reply, the text of Instagram Direct Messages is processed by our AI sub-processor, OpenAI, acting on our instructions. OpenAI does not use this content to train its models. Message content is processed only to generate the studio's reply within the active conversation. Google user data is never sent to this or any other AI sub-processor — see section 4.

7. Data Sharing & Sub-Processors

We do not sell your personal data. We share it only with the sub-processors needed to operate INKY.Studio, listed below, and only for the purpose shown against each. We require every one of them to process the data solely on our instructions, to keep it confidential, and not to use it for their own purposes.

  • Tux Software — our technology provider, which builds, hosts, and operates the INKY.Studio platform on our behalf as a sub-processor.
  • Microsoft Azure (UK) — secure hosting, database, and storage.
  • OpenAI — AI processing of message content to generate replies.
  • Stripe — deposit collection and subscription billing.
  • Google — calendar scheduling and transactional email, where the studio enables it.
  • Meta Platforms — the Instagram Platform itself, which delivers and receives the messages.

8. Data Retention

We retain conversation and booking data for as long as the studio's account is active, so the studio can see its history. When a studio closes its account, or when an end customer asks us to delete their data, we erase the associated personal data within 30 days. De-identified booking and payment records may be retained where required for financial and legal record-keeping. Access tokens are deleted when an integration is disconnected.

9. Your Rights & Deleting Your Data

Depending on your location, you may have the right to access, correct, delete, or restrict the processing of your personal data. To request deletion of the data we hold about you — including data received from Instagram — see our Data Deletion instructions or email us at hello@inkystudio.ai. If you remove INKY.Studio from your Instagram account, Instagram revokes our access to it and we stop receiving and processing messages for it; that does not by itself erase the data we already hold, so use the deletion routes above to ask for that.

10. Security

Data is encrypted in transit (TLS 1.2+) and at rest. Access tokens are encrypted with a dedicated key and are never written to logs. Access to production data is restricted and audited.

11. Cookies

We use essential cookies to operate our site. We do not use tracking cookies without your consent.

12. Contact Us

If you have questions about this Privacy Policy, contact us at hello@inkystudio.ai.