Privacy Policy

Your privacy is essential to us. Yttrium Labs LLC operates the Ink-y app and is the controller of the personal data described in this Policy, except where we say otherwise (for example, data that artists enter about their own clients — see Section 2.2). We don't sell your data, we encrypt what matters, and we give you control over what we keep.

This Policy applies to all our Services, including the website at https://ink-y.app, the iOS and Android apps, intake forms that artists send to their clients, quote requests, the Instagram and Google Calendar integrations, direct messaging and our AI features.

The LGPD (Brazil) is the primary framework for this Policy. Where the CCPA/CPRA (California) or the GDPR (European Union) applies to our processing, you also have the rights described in Sections 6.4 and 6.6. Our integrations also follow the Meta Platform Terms and the Google API Services User Data Policy, including its Limited Use requirements.

2.1Provided by You

• Registration data: name (or studio name), email, password (stored only as a one-way hash), date of birth (for individual accounts) and the language of your device or browser; phone number and gender if you add them.
• Profile data: username, photo, bio and social links. For artists and studios: styles, studio information, availability, services, the map location you choose to show, and the sanitary permit details you declare (number, issuing city and expiry date), which are also shown on the intake forms you send.
• Posts and content: photos, videos, captions, styles, tags and comments you publish.
• Blocked accounts: the accounts you block and the date of each block. The same records also show who has blocked you, so that each block applies in both directions.
• Artists' client records: when an artist adds a client, we store the client's name, email, phone, tags and the artist's notes. If a client record has the same email as an active Ink-y account, the record is linked to that account; otherwise we may email the client an invitation to Ink-y on the artist's behalf.
• Quote requests: the contact details a requester provides (such as name, email and phone), any reference images, the IP address and consent record of the request, and the conversation with the artist or the artist's AI assistant.
• Trial survey answers, if you choose to answer them.

2.2Intake Forms (including Health Data)

Artists can send intake forms to their clients, who may not have an Ink-y account. A form collects the client's name, date of birth, contact details, address, emergency contact, answers to health questions (such as medical conditions, allergies and medications), answers to any extra questions the artist adds, an electronic signature, and the IP address and browser information (user agent) from which it was signed.

• Consent: before submitting, the client must give specific consent to the processing of health data (LGPD Art. 11, I) and consent to international transfer. Both consents are required and stored as evidence with the submission.
• Protection: identifying and contact details, address, emergency contact, guardian details, free-text health details, answers to the artist's extra questions and the signature are encrypted with AES-256-GCM; yes/no health answers are not field-encrypted and rely on the storage encryption of our database provider. Only the artist who sent the form can view it (and you, in your own data export, if you have an Ink-y account).
• Minors: forms for people under 18 are accepted only in states where our eligibility rules, based on state law, allow it (some states, such as São Paulo, do not accept minors), and require identification of the parent or legal guardian (name, relationship, CPF and phone) and the guardian's consent (LGPD Art. 14, §1). The form also asks you to confirm that a written authorization exists, which the artist checks in person.
• Roles: for intake data, the artist is the controller and Ink-y acts as operator (processor) on the artist's instructions.
• Retention: a submitted form is kept for 7 years from when it is submitted (a form that is never submitted, for 7 years from when the artist creates it), then marked for deletion and deleted by a daily job about 30 days after that period ends; the artist may also delete a form earlier. If you delete your Ink-y account, or ask us to delete your form or withdraw your consent (see Section 6.5), the identifying fields (name, contact details, date of birth, address, emergency contact, guardian details, signature, signer name, IP address and browser information, the link to a client record, and free-text answers) are cleared. If the artist deletes their account, the form is unlinked from the artist and the same identifying fields are cleared. In every case, the yes/no health answers and dates are kept, without identifying details, until the retention period ends.

2.3From Instagram (if connected)

We never request or store your Instagram password. You can revoke access at any time.

2.4Message Data

2.5AI Assistant Data

We do not send health or intake data to AI providers, and we do not use it to train AI models. AI-generated quotes are estimates only and not binding.

2.6Collected Automatically

• Device and app information (model, operating system, app version, language) and in-app usage events.
• IP address and sign-in records (see Section 5 for how long each is kept).
• Approximate location derived from your IP address (city and country) and a description of the device, used for new-login alerts.
• Precise device location, only if you grant permission.
• Push notification token, if you allow notifications.
• Error logs (sent to Mixpanel) to diagnose problems.
• Crash and error reports, diagnostic logs and performance measurements from the apps, the website and our servers, sent to Sentry to find and fix problems. They are identified only by your user ID (never your email, name or IP address) and include device, browser, operating system and app version information. When an error happens, a short replay of the screen leading up to it may be attached, with all text, typed input and images masked; on the website, these replays are recorded only if you accept cookies in the cookie banner.
• Guest mode: if you use the app without an account, we keep device information, a truncated IP address, the content you view and your push token.
• Website: essential cookies for sign-in and security (CSRF protection). PostHog analytics, Sentry error replays and the Meta Pixel on public pages run only after you accept cookies in the cookie banner; if you decline, they stay off. Sentry error replays keep a temporary replay identifier in your browser's session storage (not a cookie), which is erased when you close the tab or decline cookies; Sentry error reports and performance measurements store nothing in your browser. Our feature-flag service (PostHog) still loads to configure the site and, if you are signed in, receives your user ID, email, name and account type to decide which features you see, without recording analytics events. Regardless of the banner, the website, like the apps, sends page views, in-app usage events and error logs to our own servers, tagged with a random installation identifier stored in your browser (not a cookie), and we forward them to Mixpanel for product analytics, identified only by your user ID, account type and other non-identifying properties (never your email or name). You can change your cookie choice at any time with the "Cookie preferences" link in the website footer. The mobile apps do not collect the advertising identifier (IDFA on iOS or the Android advertising ID).

2.7AI Creative Tools Data

When you use the Stencil, Mockup or Idea tools, we process the reference images and text prompts you provide, the generated images, and — for the Mockup tool — the photo of a body part that you upload. A body photo may reveal sensitive personal data (such as skin tone, scars or other physical characteristics); you should only upload images you are entitled to upload and have consent to use. These inputs are sent to our AI image provider for processing as described in Section 11.

2.8Payment and Billing Data

When you subscribe to Ink-y Black, payment is handled by our payment provider, Pagar.me. Your card is tokenized directly in your browser, so Ink-y never receives your card number. Your CPF or CNPJ, billing name, address and phone pass through our servers only to be forwarded to Pagar.me and are not stored by us. On our side we keep only billing records: your plan and status, billing dates, invoice history (amounts, dates and, for PIX, the payment codes), a masked payment reference (card brand and last digits), the cancellation reason and comment if you give them, payment failure reasons, and the Pagar.me identifiers that link your account to your subscription. Your subscription page also shows your card's expiry date or, for PIX, the last two digits of your CPF or CNPJ, read from Pagar.me when you open it and not stored by us. See Section 4 for how this data is shared.

2.9From Google Calendar (if connected)

We request two permissions: calendar.events (to create, update and cancel the events Ink-y writes) and calendar.readonly (to read your calendars and busy times).

Events marked as free in Google are not imported. To keep your calendar in sync, we ask Google to notify our servers when your selected calendar changes; these notifications contain no event content, and when one arrives we fetch your upcoming events. We never request or store your Google password. You can revoke access at any time.

3.1Purposes and Legal Bases

3.2What We Don't Do

• Sell your personal data
• Share data with third parties for their own marketing
• Show ads in the app
• Use health data for advertising
• Profile you for discriminatory purposes
• Use AI to make binding commitments without artist approval
• Train AI models on your health information

We never sell your personal data.

4.1Service Providers

These providers process data on our behalf, under our instructions, only for the purposes below.

For new-login alerts we may estimate your city and country from your IP address using a geolocation database stored on our own servers; your IP address is not sent to a third party for this.

4.2Instagram/Meta Data Sharing

When you connect Instagram, we send the replies you write in Ink-y to Instagram. Instagram sends us your profile information, incoming messages, replies you send from the Instagram app and the posts you choose to import. We are bound by the Meta Platform Terms. We share Instagram data only with service providers that act on our behalf (hosting and storage, push notification services, and Anthropic when you use AI suggestions on imported posts), never with third parties for their own purposes.

4.3Google Calendar Data Sharing

When you connect Google Calendar, we send the appointments you create in Ink-y to your Google Calendar, including the client's name, phone (for walk-in clients), tattoo details and appointment notes. Google sends us the event data (times, and titles and descriptions of non-private events) needed to block busy times and keep your calendar in sync. Google Calendar data is never sent to AI providers and is shared only with the hosting providers that store it for us.

4.4AI Data Sharing

Our AI Assistant, quotes, smart search and post suggestions are powered by Anthropic (Claude); our AI creative tools are powered by Google's image model accessed through Replicate. We send only the content needed for your request — chat messages, reference images, the artist's training examples and images, search text, prompts, images of posts you create or import (once you turn on post suggestions) and (for mockups) the body photo you upload. We never send intake or health data, Google Calendar data, access tokens or passwords to any AI provider.

4.5International Transfer

Your data is processed and stored in the United States by MongoDB Atlas, Amazon Web Services, Railway, Vercel, Anthropic, Replicate and Google, Mixpanel, PostHog, Sentry, Resend, Meta, and Apple's and Google's push notification and map services. Pagar.me processes payment data in Brazil. The United States does not have an adequacy decision from Brazil's ANPD, so we rely on your specific consent to international transfer (LGPD Art. 33, VIII), which we show and record for every signup, together with contractual safeguards with our providers where applicable.

You can withdraw this consent in Settings > Account > Manage consents (Account & Security in the iOS and Android apps). Because our servers are in the United States, withdrawing it means we can no longer provide the service to you, and the app will warn you and suggest deleting your account.

6.1How to Exercise Your Rights

Exercising your rights is free of charge. We respond within 15 days (LGPD), one month (GDPR) or 45 days (CCPA).

6.2Deletion Process

• Deletion is immediate — there is no grace period and it cannot be reversed.
• Your name is replaced with "Deleted User" and your email and username with placeholders. We keep a de-identified record: account ID, account type and status, dates and usage counters, settings such as language, time zone, currency and earnings settings, verification and onboarding status, your consent records, reports you filed, and the links needed for the billing and consent records we must retain.
• Your posts, comments and AI data (training data, AI Assistant and quote sessions, generated images and uploaded tool images) are deleted from our database, except the items listed in Section 13.
• Instagram is disconnected and your Instagram tokens, conversations, messages and message images are deleted, along with our copies of message senders' profile photos. Google Calendar is disconnected, our access is revoked at Google, its tokens are deleted and the appointments Ink-y created in your Google Calendar are removed.
• Messages and images you sent in Ink-y conversations remain visible to the other participant, shown as from "Deleted User".
• Your list of blocked accounts, and any blocks other users placed on you, are deleted.
• A paid subscription will not renew. Deletion does not trigger an automatic refund; your 7-day right of withdrawal under Brazilian consumer law is not affected.
• We keep only the records listed in Section 5 that we are legally required or permitted to keep (such as billing, consent, access and deletion audit records), for the periods stated there.

6.3Brazil-Specific Rights (LGPD)

Under LGPD Art. 18, you have the right to:

• Confirmation that we process your data
• Access to your data
• Correction of incomplete, inaccurate or outdated data
• Anonymization, blocking or deletion of unnecessary or excessive data, or data processed in breach of the LGPD
• Portability of your data to another provider
• Deletion of data processed based on your consent
• Information about the public and private entities with which we share your data
• Information about the possibility of refusing consent and the consequences of refusing
• Withdrawal of consent at any time
• Opposition to processing carried out on another legal basis, if it does not comply with the LGPD
• Review of decisions made solely by automated processing (LGPD Art. 20). AI quotes are recommendations only, not automated decisions with legal effect.
• Petition to the national data protection authority (ANPD) at gov.br/anpd

6.4California-Specific Rights (CCPA/CPRA)

If the CCPA/CPRA applies to you, you have the right to know about, access, delete and correct your personal information, to opt out of its sale or sharing, to limit the use of sensitive personal information, and not to be discriminated against for exercising these rights. The categories of personal information we collect, their sources, purposes, recipients and retention periods are described in Sections 2 to 5. We do not sell personal information. The only activity that could count as sharing for cross-context behavioral advertising is the Meta Pixel on our public web pages, which runs only if you accept cookies; you can decline, or change your choice at any time with the "Cookie preferences" link in the website footer. You can exercise your rights with the in-app tools in Section 6.1 or by emailing privacy@ink-y.app. We verify requests by confirming that you control the email address of your account, and you may use an authorized agent, whose authority we will verify.

6.5If You Do Not Have an Ink-y Account

If an artist sent you an intake form, or you requested a quote as a guest, you can still exercise your rights. For intake forms, you can ask on our website for your identifying details to be removed from your forms: we email a confirmation link (valid for 24 hours) to the address on the form and clear the identifying fields only after you confirm it. You can also withdraw your consent through the link to your form, or email privacy@ink-y.app; for email requests we verify that you control the email address before acting. For intake data the artist is the controller, so we may also forward your request to the artist.

6.6If the GDPR Applies to You

If the GDPR applies to our processing of your data, you also have the rights of access, rectification, erasure, restriction of processing, data portability and objection (including to processing based on our legitimate interests), and the right to withdraw consent at any time without affecting processing already carried out. Our legal bases are those listed in Section 3.1 (contract, consent, legitimate interests and legal obligation). Your data is transferred to the United States under the data-processing terms of the providers listed in Section 4.1. You can exercise these rights as described in Section 6.1, and you can lodge a complaint with the data protection supervisory authority of the country where you live or work.

7.1Encryption

• In transit: all communication with our apps and website uses TLS (HTTPS).
• At rest: AES-256-GCM field encryption for message content and previews, free-text health details and other sensitive intake fields, and Instagram and Google Calendar tokens.
• Passwords: stored only as bcrypt hashes. New passwords are checked against known breached-password lists by sending only the first five characters of a one-way hash of the password to the Have I Been Pwned service; your password itself never leaves our servers.

7.2Access Control

• Sessions: access tokens valid for 30 days and refresh tokens valid for 90 days; a new pair is issued on every refresh.
• Tokens stored in the iOS Keychain on iPhone, in encrypted storage on Android and in HttpOnly cookies on the web.
• Account lockout after repeated failed sign-in attempts.
• Email alert when your account is accessed from a new device or country.
• Rate limiting on sign-in, signup, the API and messaging.
• Staff access to message content and to account and billing data through our internal tools requires a documented reason and is recorded.

7.3Attack Protection

• CSRF protection on requests that change data.
• Protection against XSS and NoSQL injection.
• Webhook authentication: HMAC-SHA256 signatures for Meta, authenticated credentials for Pagar.me.
• One-time state tokens on the Instagram and Google Calendar connection flows.
• Security headers on the website, such as Content Security Policy and Strict-Transport-Security.

8.1Meta Platform Compliance

Our Instagram integration complies with the Meta Platform Terms, Instagram Platform Policy, Instagram API Terms of Use and Meta's Data Policy.

8.2Messaging Windows

After the window expires, you cannot message until the customer messages again. We show how much time is left to reply in each conversation and mark it when the window has expired.

8.3Data Limitations

We cannot access your Instagram password, private accounts you don't own or your followers' private data. We import only the posts you select. We do not post, follow or unfollow, like or comment on your behalf.

8.4Token Handling

Instagram tokens are valid for 60 days, are encrypted at rest and are refreshed automatically before they expire. If a refresh fails and the connection expires, Settings > Integrations asks you to reconnect. No data is lost due to token expiration.

8.5Permitted Use & Data Deletion

Consistent with the Meta Platform Terms, we use Instagram data only to operate the inbox, profile and post-import features you enable. We do not sell it, share it with data brokers, or use it for advertising, profiling, surveillance or eligibility decisions. You can delete your Instagram data at any time by disconnecting the integration in Settings > Integrations (which deletes the stored tokens, conversations, messages, received message images and our copies of message senders' profile photos), by deleting your account, or by emailing privacy@ink-y.app. We also honor Meta's Data Deletion Request callback, which deletes the same data and returns a confirmation code and a status URL where you can track the request.

9.1Google API Compliance

Our Google Calendar integration complies with the Google API Services User Data Policy and the Google APIs Terms of Service.

9.2Data Limitations

We access only the Google Calendar data covered by the permissions in Section 2.9. We cannot access your Google password, Gmail, Drive, Contacts or any other Google data. For private or confidential events we read only the time. When you disconnect or delete your account, we remove from Google only the events Ink-y created.

9.3Token Handling

Google Calendar tokens are encrypted at rest and refreshed automatically. If a refresh fails, you'll be asked to re-authorize. No data is lost due to token expiration.

9.4Permitted Use & Data Deletion

We use Google Calendar data only to operate the calendar sync you enable. We do not sell it, share it with data brokers, or use it for advertising, profiling or surveillance. You can delete your Google Calendar data at any time by disconnecting the integration in Settings > Integrations (which deletes the stored tokens and revokes our access at Google; to also delete the events imported from Google, select "Delete imported busy-times from Ink-y" when disconnecting), by deleting your account, or by emailing privacy@ink-y.app.

10.1Message Encryption

Message content is encrypted with AES-256-GCM before it is stored on our servers, and travels over TLS (HTTPS and secure WebSocket connections). Messages are not end-to-end encrypted: our servers can decrypt them to deliver them, show previews and send push notifications.

10.2Real-Time Delivery

• Ink-y messages: delivered instantly over a secure WebSocket connection
• Instagram messages: via Instagram webhooks and API
• Push notifications for messages received while the app is in the background
• Supported: text and image attachments

10.3Archiving and Deletion

You can archive and unarchive conversations. Deleting a single message removes its text immediately, deletes any attached image from our storage and shows a "This message was deleted" placeholder. Deleting a conversation deletes its messages and their images for all participants. If you delete your account, messages and images you sent in Ink-y conversations remain for the other participant, shown as from "Deleted User" (see Section 6.2).

10.4Who Can Access Messages

We do not read messages for advertising, use their content to train AI, or share them with third parties, except the short preview shown in push notifications, which passes through Apple and Google push services, messages in Instagram conversations, which are sent and received through Meta, and where required by law. Staff can decrypt a message only through an internal tool that requires a documented reason and logs the access — for example, when you report abuse or ask for support, or when required by valid legal process.

11.1AI Data Processing

• AI Assistant and quotes (Anthropic): chat messages, tattoo parameters, reference images, the artist's configuration and training examples, and the artist's name or studio name, username, studio address and Instagram username. People who request a quote, including guests, are told that the artist's AI assistant may reply to them.
• Smart search (Anthropic): the text you type, to build search filters.
• Post suggestions (Anthropic): images of posts you create or import, to suggest tattoo styles and tags. You give explicit consent (the same consent as for the AI Creative Tools) before first use, and you can turn suggestions off in Settings > Preferences or withdraw the consent in Manage consents.
• AI Creative Tools (Google's image model via Replicate): your prompts, reference images and the body photo you upload for a mockup. You give explicit consent before first use.

No intake or health data, Google Calendar data, access tokens or passwords are sent to any AI provider.

11.2Provider Terms & Model Training

11.3AI Image Generation

The mockup tool uses a photo of a body part to generate a realistic preview. That image is sent to the United States (Google, via Replicate) for processing and may reveal sensitive personal data; by uploading it you confirm you have the right and the depicted person's consent to do so (see Terms Section 6). Generated images are stored in our AWS storage and carry an embedded SynthID watermark identifying them as AI-generated. AI images are synthetic simulations and may be inaccurate.

11.4AI Data Retention

AI Assistant chats are kept for up to 30 days of inactivity and quote sessions for up to 90 days of inactivity; artist training data is kept while the account is active; generated images and uploaded tool images are kept until you delete them; image-generation job logs are deleted after 30 days. When you delete your account, your AI data is deleted, except the items listed in Section 13.

11.5Your AI Data Rights

• Withdraw consent to AI tools, which also covers post suggestions: Settings > Account > Manage consents (you can also turn off AI suggestions in Settings > Preferences)
• Remove AI training data: remove training samples one by one in the AI Assistant's training settings. Removed samples stop being used immediately and are permanently deleted 30 days later, together with any image you uploaded for them (images taken from your posts stay with your posts). When you delete your account, all training data and uploaded images are deleted
• Delete generated images and uploaded tool images at any time in the app
• Get your AI conversation history in your data export

If a security incident may create relevant risk or harm to you, we will notify the ANPD and affected users within 3 business days of becoming aware of it (ANPD Resolution nº 15/2024), and the competent European supervisory authority within 72 hours where the GDPR applies. We notify you by email and, where appropriate, through other channels, such as a notice in the app.

12.1Notification Contents

• The nature of the personal data affected
• The affected users
• The risks related to the incident
• The technical and security measures used to protect the data
• The measures taken or to be taken to reverse or reduce the harm
• The reasons for any delay in notification
• How to contact us: privacy@ink-y.app

12.2Special Considerations

If Instagram or Google Calendar tokens are compromised, we revoke the affected tokens and ask you to reconnect the integration. If message content is compromised, we notify the affected participants. We coordinate with Meta, Google and our AI providers (Anthropic, Replicate) as required.

Account deletion is immediate: we delete your personal data right away. The table below summarizes what we keep afterward, and why.

14.1What We Track

14.2Audit Trail

We keep your consent history for the account lifetime plus 5 years after deletion, as proof of consent. Your data export (Settings > Account > Email my data) includes your current consent choices and your full consent history.

Ink-y accounts are only for people aged 18 or over, and people who request a quote as guests must confirm they are 18 or over. We do not knowingly allow anyone under 18 to create an account.

The only exception is intake forms: an artist may send an intake form for a client under 18 (never under 12) only where state law allows it, with identification and consent of the parent or legal guardian, as described in Section 2.2.

If we learn that an account holder is under 18, we suspend the account indefinitely (it can no longer sign in and its push notifications are turned off) and email the account holder the reason and how to appeal. If the account is not reinstated within 30 days, we erase it in the same way as when a user deletes their own account, except records we are legally required to keep. See our Minors Policy.

To report an underage user, contact privacy@ink-y.app.

We may update this Privacy Policy from time to time. When we publish a new version of this Policy or of our Terms, we email you at least 30 days before it takes effect, and until then the app shows a notice with the date the changes take effect. On that date, the app asks you to review and accept the new version before you continue using it.

Minor changes (clarifications, formatting) may be made without advance notice. If you disagree with a new version, you can delete your account at any time.

17.1Applicable Law

• Brazil: Brazilian law, especially the LGPD (Law 13.709/2018) and the Marco Civil da Internet (Law 12.965/2014)
• US: US federal and state laws, including the CCPA/CPRA

17.2Severability

If any provision is deemed invalid, the remaining provisions remain in full force.

17.3Language

Available in Portuguese and English. In case of conflict, Portuguese prevails for Brazilian users and English for US users.

By using Ink-y, you acknowledge that you have read and understood this Privacy Policy. Where we rely on your consent, we ask for it separately and you can withdraw it at any time.