InkEthos

Privacy Policy

Last updated: October 25, 2026

This policy explains, in plain English, what InkEthos stores, who can see it, how it is protected, how long it is kept, and how to delete it. InkEthos is run by an independent operator in California, USA. Questions: connect@inkethos.studio.

1. Who this covers

  • Artists — tattoo artists and studios who create an InkEthos account.
  • Clients — people who book an appointment, make a payment, use their appointment and receipt portal, or complete an artist's check-in or consent form.

For client records, the artist decides what to collect and why. InkEthos stores it on the artist's behalf. Clients with questions about their own records should contact their artist first; you can also contact us directly.

2. What InkEthos stores

Account details: artist email, display name, password (stored as a secure hash, never in plain text) and subscription status.

Business and financial data: estimates, quotes, deposits, prices, payments received, expenses, income totals, tax set-aside figures and your chosen state. Stripe handles subscription payments and client deposits and final payments. InkEthos stores payment references, amounts, statuses and receipt links; we do not store full card numbers.

Client directory data: names, phone numbers, email addresses, dates of birth, ID details (such as ID number and expiry date) and any demographic details the artist or client enters, which may include sensitive details such as gender.

Health information: answers clients give on intake and consent forms, including medical conditions, medications, allergies, pregnancy or nursing status, and alcohol or drug use.

Photos: photos of clients and their tattoos — which can include intimate or graphic body areas such as the chest, breast or genital area — portfolio images, and photos of government ID taken during intake.

Signatures and notes: typed signatures on consent forms and the artist's private notes.

Basic technical data: browser type, app version and error logs, used to keep the app working.

Optional calendar connections: when an artist connects Google Calendar or Microsoft Outlook, InkEthos uses calendar names and identifiers to let the artist choose a calendar, and reads busy periods to prevent overlapping bookings. It creates and updates appointment events containing the service, client name, booking reference and appointment times, and removes those events when a booking is cancelled. Medical answers, ID images and private artist notes are not included in these calendar events.

Optional Facebook and Instagram connections: an artist can authorize read access to their managed Facebook Pages and a linked professional Instagram account. InkEthos uses account and Page identifiers, names, media links and captions to let the artist select images for their portfolio. This connection does not authorize posting, messaging or advertising.

3. Who can see this data

  • Private client records, health answers and artist notes are restricted to the artist's account. Clients can use their secure portal to see their own appointments, payment status and receipts.
  • Clients using the check-in tablet see only their own form. They never see the artist's other clients.
  • An artist may publish their chosen portfolio, completed work and flash images on their public booking page. Public booking pages also show the artist or studio name, services and available times. Private client files are not published in these galleries.
  • The InkEthos operator does not browse your records. We access them only if you ask for support, or if required by law.
  • We do not sell your data and do not use it for advertising.

Service providers that help run InkEthos process data only to provide the service:

  • Supabase — database, file storage and sign-in.
  • Stripe — subscription billing, client deposits, final payments and payment receipts.
  • Resend — transactional booking, payment and appointment portal emails.
  • Google or Microsoft — calendar data and appointment events, only when the artist connects that provider.
  • Meta — Facebook Page and linked Instagram profile and media access, only when the artist connects it.
  • An AI vision service — reads text from ID photos during intake. The ID image is sent only to extract the name, birth date and expiry date.
  • Our web hosting provider — serves the app.

InkEthos complies with the Google API Services User Data Policy, including its Limited Use requirements. Google calendar data is used to provide the calendar connection and booking features. It is not sold, used for advertising, or used to train general-purpose AI models.

4. How data is stored and secured

  • Data is stored in a cloud database (Supabase) hosted in Canada (AWS region ca-central-1), not only on your device. Some service providers listed above may process data in other countries.
  • All traffic between your device and InkEthos is encrypted (HTTPS/TLS). Stored data is encrypted at rest by our database provider.
  • Each artist's records are locked to their account by database access rules (row-level security), so one account cannot read another's data.
  • Private artist records require sign-in. A client's appointment and receipt portal uses a private access link; anyone with that link may be able to view that client's portal, so keep it private.
  • Calendar and Meta access tokens are encrypted on the server. Artists can disconnect integrations in booking settings and revoke access through the provider's account settings.

No system is perfectly secure. If we learn of a breach affecting your data, we will notify affected users as required by law.

5. HIPAA

InkEthos is not a HIPAA-covered entity and does not claim HIPAA compliance. Tattoo studios are generally not healthcare providers under HIPAA. We still treat health details as sensitive and protect them as described above.

6. Artist responsibilities

If you are an artist, you are responsible for:

  • Getting each client's consent before uploading their photos — especially photos of intimate or graphic body areas — or recording their health information.
  • Only collecting what you actually need.
  • Not posting a client's photos publicly (portfolio, social media) without their permission.
  • Following the recordkeeping and privacy rules of your state, county and health department.
  • Handling client requests to see or delete their records.

7. How long data is kept

  • Records stay in your account until you delete them or delete your account.
  • When you delete a record or your account, it is removed from the live database right away. Our database provider may keep encrypted backup copies for a limited period under its own retention schedule; we do not restore deleted data from them except to recover from a system failure.
  • Your local health department may require you to keep consent records for a set number of years. Export them before deleting if you need to keep them.
  • If a subscription ends, your data is not automatically deleted. You can sign in to export it or delete it from Profile → Danger Zone.

8. How to delete data

You can also request deletion without signing in through our public account and data deletion page.

Artists: open the app → Profile → Danger Zone. You can delete all your studio data, or delete your whole account. Type DELETE to confirm. You can export everything first from Export & Backups.

Clients: ask your artist to delete your record — they can do it from your client file. If your artist doesn't respond, email connect@inkethos.studio with your name and the studio's name, and we will work with the artist to handle it, usually within 30 days.

9. Your privacy rights (including California)

Depending on where you live, including under California law (CCPA/CPRA), you may have the right to know what data is held about you, get a copy, correct it, delete it, and limit use of sensitive information. We do not sell or share personal information for advertising. To use these rights, email us. We will not treat you differently for doing so.

10. Children

InkEthos is for adults. Artists must follow their local laws on tattooing minors, including parent or guardian consent.

11. Changes

If we make important changes, we'll update the date above and tell artists in the app or by email.