Privacy Policy

The controller for the data collected through this site (visitors, leads, studio accounts) is João Pedro Inocêncio, sole proprietorship operating INKYA, Quai de la Broye 1, 1530 Payerne, Switzerland, inkyatattoo@gmail.com (see also the Impressum).

When a client studio uses INKYA to communicate with its own clients over WhatsApp, the studio is responsible for that processing; INKYA acts as a technical processor (hosting, AI, message delivery) on behalf of the studio.

Site visitors: contact form (name, studio, e-mail, optional WhatsApp number, desired plan and, if you tick the box, marketing consent). Cookie-free audience measurement, recorded for each visit: a random session identifier and a technical fingerprint (a hash of the IP address and the browser), which also serves to limit abuse. These are therefore not aggregated or anonymous statistics.

Marketing consent (optional): if you tick the dedicated checkbox on the form, we record that choice, the date, and the version of the text you saw, solely to honour your consent. No automated commercial sending is active as of today.

Studio accounts: name, e-mail, password (hashed) or sign-in with Google, studio details (name, address, pricing, styles offered). With sign-in with Google, Google sends us the account's name, e-mail address and profile picture; for this the sign-in page loads Google Identity Services, provided by Google.

WhatsApp conversations managed via INKYA on behalf of a studio: phone number, message content, tattoo projects discussed, quotes.

Sensitive data in these conversations: a studio's client may mention health information (allergies, skin condition, healing) and send photos of the body part to be tattooed. This information is used only so the studio can reply and prepare the project. Voice messages are transcribed automatically, and the content of conversations is processed by the AI providers listed in point 4.

Deposits paid by a studio's clients (not active yet): once online payment is activated and the studio turns on online deposits, its client will pay by card or TWINT through Stripe. INKYA will then record the amount, the payment status and the project concerned, never the card number.

Billing data (once activated): processed by Stripe; INKYA does not store card numbers.

Providing the service (performing the contract with the client studio), responding to contact requests, improving the product, complying with legal and accounting obligations.

Processing WhatsApp conversations relies on the contract between INKYA and the studio, and on the studio's end client's consent to be contacted through this channel.

Supabase (database and authentication), OpenAI and Google (Gemini) (generating the assistant's responses and transcription), Google (Google Identity Services, for sign-in with Google), Meta / WhatsApp Business Platform (sending and receiving messages), Stripe (studio subscriptions and deposits paid by their clients, by card or TWINT, once online payment is activated), Vercel (application hosting), Resend (sending system e-mails).

These providers may process data in the European Union and in the United States. Transfers to the United States rely on the Swiss-U.S. Data Privacy Framework where the provider is certified, or otherwise on the standard contractual clauses recognised by the Federal Data Protection and Information Commissioner (FDPIC).

No data is sold to third parties.

A studio's data (account, WhatsApp conversations, photos, voice messages, projects, quotes, deposits) is kept for as long as the studio uses INKYA. There is no automatic deletion today: it is deleted at the request of the studio or of the person concerned, and at the end of the contract it is deleted or archived in accordance with legal retention obligations (accounting records: 10 years). The proof that the terms were accepted is kept for as long as the account exists.

A studio or a data subject may request access to, correction of, or deletion of their data; such requests are handled manually by a human, in line with INKYA's doctrine.

Only if you click "Accept" in the cookie banner of the public website does it load the Google Ads tag (gtag.js), which sets advertising cookies in your browser. It is used to measure whether our Google ads lead to a contact request or a free-trial sign-up (a "conversion"). These measurements contain neither your name, your e-mail, your phone number nor anything you type into a form.

Without your consent, or if you click "Decline", no Google Ads script is loaded and no advertising cookie is set. Your choice is stored in your browser for at most 6 months. You can change it or withdraw your consent at any time via the "Cookie settings" link at the bottom of the website's pages, or by clearing the website's data in your browser.

Legal basis: your consent. Google Ads is a service of Google LLC (United States): the measurement data (cookie identifiers, IP address, pages visited, ad click) may be transferred to the United States, with the safeguards described in section 4.

Under the nFADP, you have a right of access, rectification, deletion and objection regarding your personal data, and the right to receive your data or have it transferred to a third party (portability). To exercise these rights, write to inkyatattoo@gmail.com or to the address given in point 1. You may also contact the Federal Data Protection and Information Commissioner (FDPIC).