Privacy Policy

Leer esta Política de Privacidad en español latinoamericano.

Leia esta Política de Privacidade em português do Brasil.

This Privacy Policy explains how Inker Inc. (“Inker,” “we,” “us,” or “our”) collects, uses, discloses, retains, and protects personal information when you use the Inker mobile applications, website, and related services (the “Platform”). It also explains the choices and rights available to you.

Inker is the organization responsible for the personal information described in this Policy. Our contact information is provided at the end of this Policy. This Policy is a notice about our practices; it is not a request for blanket consent. Where consent is required, we request it in the relevant part of the Platform or through your device settings.

Information We Collect

Account and authentication information

We collect information used to create and secure your account, such as your email address, username, telephone number, account identifier, password credentials or passkey information, authentication method, and sign-in records. If you use a third-party sign-in service, we receive the information that service makes available to us, such as your name, email address, profile photo, and third-party account identifier.

Profile, professional, and public content

We collect information you add to a customer, artist, or studio profile, including your name, profile photo, biography, portfolio, links, tattoo styles, work locations, studio details, professional and business information, posts, comments, reactions, follows, event participation, jobs, guest spots, and other content you publish. Profile and post information is generally visible to other users and may be visible to the public on the web.

Messages, calls, and reports

We process messages, attachments, live-stream or call information, and related metadata to provide communication features and message history. Messages are not end-to-end encrypted. Inker does not routinely read private messages, but authorized personnel may access, review, preserve, or disclose messages and related account information when reasonably necessary for technical support, safety, abuse prevention, enforcement of our Terms, investigation of a report, or compliance with law.

When you report content, an account, a generated design, or other behavior, we collect the report, reason, supporting information, and actions taken in response. We may notify affected users about the outcome where appropriate or required.

Location and address information

With your device permission, we collect precise location to provide nearby artist, studio, event, and map features. We may also infer an approximate city, region, or country from your IP address for localization, security, analytics, fraud prevention, and compliance. You can disable precise location access in your device settings, although some features may then be unavailable.

We also collect addresses you provide for studios, work locations, bookings, merchandise or reward delivery, billing, and customer support.

Photos, video, audio, AI designs, and AR try-on

If you choose to create or upload media, we process photos, video, audio, camera input, photo-library selections, and associated metadata. For AI tattoo generation, we process your written prompt, selected style, generated design, account identifier, and generation status. Inker uses an AI service provider to generate the design.

For AR try-on, we process the body photo you choose to take or upload, the selected design, and derived depth and body-segmentation images needed to place the design on the photo. These derived images are used to create the visual preview; they are not used by Inker to identify you or authenticate your identity. The photo and derived files are uploaded to our systems and an AI processing provider to provide this feature.

Bookings, payments, commerce, and rewards

We collect booking requests, appointment and event information, transaction identifiers, amounts, currency, timestamps, payment and refund status, billing and shipping details, order information, customer-support records, and related artist or studio information. Payment-card details are handled by our payment provider, and Inker does not store full card numbers.

If you participate in a referral or rewards program, we collect referral attribution, invite dates, milestone progress, reward review and fulfillment records, and information reasonably necessary to deliver a reward or meet tax and accounting obligations. A referrer may see the invited artist's username, profile image, pending or activated status, and incomplete activation steps, but not the invited artist's private contact, payment, message, or precise-location information.

Device, network, usage, and diagnostics information

We collect information about how the Platform is accessed and used, such as IP address, device and app identifiers, operating system, app version, language, time zone, pages or screens viewed, taps and feature interactions, referring links, crash reports, performance data, push-notification tokens, security logs, and fraud or abuse signals.

Where permitted by your device settings and applicable law, advertising attribution may use mobile advertising identifiers such as Apple's IDFA or the Android Advertising ID. On iOS, the App Tracking Transparency choice controls access to IDFA. Device permission is not treated as consent for an unrelated purpose.

Information from other sources

We may receive information from authentication providers, social platforms you connect, payment and fulfillment providers, other users, service providers, fraud-prevention providers, and publicly available sources. For example, we display tattoo event information collected from public event pages, and you may choose to import permitted content from a connected social account.

How We Use Information

We use personal information for the following purposes:

• create, authenticate, secure, and manage accounts
• provide profiles, discovery, maps, social feeds, messaging, calls, events, jobs, and studio tools
• generate AI tattoo designs and provide AR previews
• facilitate bookings, payments, orders, shipping, refunds, and rewards
• personalize content, search results, and recommendations
• send service communications and, where permitted, marketing communications
• measure advertising and referral performance
• analyze and improve usability, performance, reliability, and new features
• provide support and respond to privacy, safety, and legal requests
• detect, prevent, investigate, and address fraud, abuse, harmful content, and security incidents
• enforce our Terms and protect Inker, our users, and the public
• comply with legal, tax, accounting, reporting, and recordkeeping obligations

Depending on the law that applies, these activities are carried out with your consent, to provide a service you request or perform a contract with you, to meet a legal obligation, or for a reasonable and appropriate business purpose that is not overridden by your rights. You may withdraw consent where our processing relies on consent, subject to legal or contractual restrictions and reasonable notice.

Analytics, Attribution, and Session Replay

We use analytics, crash-reporting, logging, performance-monitoring, attribution, and session-replay providers. These tools may process device information, IP address, account or pseudonymous identifiers, app activity, installations, attribution data, interactions, diagnostics, and crash or performance records.

Our providers include Google Firebase, AppsFlyer, Microsoft Clarity, Vercel Analytics, and Bugfender. Clarity may record interactions with the Platform to help us diagnose usability and performance issues. We configure private-message content to be masked from web session recordings and do not intend for payment-card details or message contents to be captured. Please do not enter sensitive information in free-text fields unless it is needed for the feature you are using.

How We Disclose Information

We may disclose personal information to:

• other users and the public when you publish profile information, posts, comments, event participation, jobs, studio information, or other public content
• people you communicate or transact with, such as an artist, studio, customer, or referrer
• service providers that support hosting, storage, authentication, messaging, video, AI generation and processing, content safety, analytics, attribution, logging, maps, payments, email, fulfillment, shipping, customer support, and security
• Apple, Google, connected social platforms, and other third parties at your direction
• professional advisers, auditors, insurers, and transaction counterparties
• law enforcement, regulators, courts, or other parties when we reasonably believe disclosure is required by law or necessary to protect rights, safety, and Platform integrity
• an acquirer, investor, lender, or successor in connection with a financing, merger, reorganization, sale, or similar corporate transaction, subject to appropriate confidentiality protections

Relevant providers include Microsoft Azure, Google Firebase and Maps, GetStream, Stripe, AppsFlyer, Microsoft Clarity, Vercel, Bugfender, ConfigCat, fal.ai, SendGrid, Printify, Apple, Google, Facebook, and Instagram. A provider is used only when relevant to the feature. We do not sell personal information for money.

Automated Processing and AI

We use automated systems to analyze public posts for categories such as sexual, violent, hateful, or self-harm content. A result above configured thresholds may automatically blur or remove a post and notify the account holder. We may also use automated systems to rank or recommend content, detect fraud or program abuse, and help review reward eligibility. To request review of an automated moderation or account decision, contact us using the details below and include enough information to identify the decision.

Generative AI processes the prompt or image you submit to produce the feature you requested. We do not use AR body photos to make identity, employment, credit, insurance, or medical decisions.

International Data Transfers

Inker is based in the United States. Personal information may be stored or processed in the United States and in other countries where our service providers operate, including countries in the European Economic Area. Privacy and government-access laws in those countries may differ from those where you live.

Before an overseas disclosure for which applicable law requires an assessment or comparable protection, we will complete the required assessment and put contractual, organizational, and technical safeguards in place. Some providers act only on our instructions; others independently process information under their own terms. You may contact our Privacy Officer for more information about relevant locations and safeguards.

Retention and Account Deletion

We keep personal information only for as long as reasonably necessary for the purposes described in this Policy, including providing the Platform, maintaining security, resolving disputes, enforcing agreements, and meeting legal, tax, accounting, and reporting obligations. The period varies by data type, account status, legal requirements, the limitation period for claims, and whether information is needed for safety or fraud prevention.

You may delete your account in the Platform's account settings. Deletion disables the account, removes the active login identity, removes the public profile, and starts deletion from active Inker product systems. Some information may remain for a limited period in backups, provider systems, audit and security logs, transaction or tax records, safety records, or records we must retain by law. A message sent to another user may remain in that user's conversation history without an active public profile. Aggregated or de-identified information that can no longer reasonably identify you may be retained.

Account deletion is an asynchronous process across multiple systems. If you cannot access your account, or if information remains after a reasonable processing period, contact us so we can verify and address the request.

Your Rights and Choices

Depending on where you live, you may have rights to:

• know whether and how we process your personal information
• request access to or a copy of your personal information
• request correction of inaccurate or incomplete information
• request deletion, de-indexing, or limits on certain uses or disclosures
• withdraw consent where processing relies on consent
• object to or request review of certain automated processing
• request data portability where applicable
• complain to us or an applicable privacy regulator

You can manage profile information and delete your account in the Platform. You can manage precise location, camera, photo-library, microphone, notification, and advertising permissions in your device settings. Marketing messages include an unsubscribe method where required; you may still receive non-promotional service or safety messages.

To exercise a privacy right, email our Privacy Officer at the address below. Describe your request and the country or province where you live. We may need to verify your identity, and authorized agents may be required to provide proof of authority. We aim to respond within 30 days or the period required by applicable law. We will explain any lawful exception or extension.

Children and Age Requirement

The Platform is intended only for adults aged 18 and over. A person under 18 may not create an account or use the Platform, even if local tattoo law would allow a tattoo with parental consent. We do not knowingly collect personal information from people under 18. If you believe a minor has an account, please report it to us so we can investigate and take appropriate action.

Security and Data Breaches

We use administrative, technical, and organizational safeguards designed to protect personal information against loss, misuse, and unauthorized access, disclosure, alteration, or destruction. No system is completely secure. If a breach occurs, we assess it and notify affected people and regulators when required by applicable law.

Regional Privacy Disclosures

Australia

To the extent the Australian Privacy Act 1988 and Australian Privacy Principles apply, you may request access to or correction of personal information and may complain about how we handle it. Contact our Privacy Officer first. We will investigate and respond within a reasonable period. If you are not satisfied, you may contact the Australian Office of the Information Commissioner at oaic.gov.au. Information may be disclosed to overseas recipients as described under International Data Transfers.

New Zealand

If the New Zealand Privacy Act 2020 applies, our Privacy Officer performs the privacy-officer function for New Zealand. You may request access to or correction of personal information and may include a statement of correction if a requested correction is not made. We generally respond to an access or correction request within 20 working days unless the law permits an extension.

We may collect information about you from public event pages, connected services, service providers, or other users as described above. We take reasonable steps to provide any notice required for indirect collection. For an overseas disclosure, we use a permitted basis under Information Privacy Principle 12, such as comparable legal or contractual safeguards or express authorization after the required notice. You may contact the Office of the Privacy Commissioner at privacy.org.nz.

Canada

Canadian privacy law may include the federal Personal Information Protection and Electronic Documents Act and substantially similar provincial laws. You may request access to or correction of personal information and may withdraw consent, subject to legal or contractual restrictions and reasonable notice. We will explain significant consequences of withdrawal. You may challenge our compliance with our Privacy Officer and, where applicable, complain to the Office of the Privacy Commissioner of Canada or your provincial regulator.

For Quebec residents, the person with the highest authority at Inker is responsible for protecting personal information unless the function is delegated in writing. The public title and contact details for this role are listed below. You may also have rights to data portability, to request cessation of dissemination or de-indexing in circumstances provided by law, and to receive information and human review when a decision is based exclusively on automated processing. Personal information may be communicated outside Quebec only after the assessment and written protections required by applicable law.

Singapore

Our Privacy Officer also serves as the contact for our Data Protection Officer under Singapore's Personal Data Protection Act 2012. You may request access to personal data we hold and information about its use or disclosure during the preceding year, request correction, or withdraw consent with reasonable notice, subject to applicable exceptions. We will inform you of likely consequences of withdrawal. Before transferring personal data outside Singapore, we will use measures required to provide protection comparable to the PDPA. If a concern is not resolved with us, you may contact Singapore's Personal Data Protection Commission at pdpc.gov.sg.

Switzerland

Where the Swiss Federal Act on Data Protection applies, Inker Inc. is responsible for the personal information described in this Policy. You may ask whether we process your personal information, request access to it or correction of inaccurate information, and seek deletion or an end to unlawful processing where Swiss law provides. In applicable circumstances, you may request that certain data you provided to us be delivered to you or transferred to another provider in a commonly used electronic format. Contact our Privacy Officer using the details below. You may also contact the Swiss Federal Data Protection and Information Commissioner at edoeb.admin.ch.

The information above about precise location, user content, messages, AI and AR images, analytics, attribution, and automated moderation also applies to Swiss users. Personal information may be processed outside Switzerland as described under International Data Transfers. Where Swiss law applies to a disclosure abroad, we assess the destination and use an applicable adequacy finding, recognized safeguards, or another permitted basis. Contact our Privacy Officer for information about the relevant destination countries and safeguards for a particular feature.

The Bahamas

To the extent the Data Protection (Privacy of Personal Information) Act 2003 applies, we process personal information fairly and lawfully, identify the purposes for which it is collected, limit collection and retention to what is relevant and necessary, take reasonable steps to keep it accurate and secure, and use or disclose it only for compatible purposes or as otherwise permitted by law. You may request access to personal information we hold about you or correction of inaccurate information by contacting our Privacy Officer.

Please send a privacy complaint to us first so we can investigate it. If it is not resolved, you may be entitled to complain to the Office of the Data Protection Commissioner of The Bahamas. Overseas processing and the safeguards we use are described under International Data Transfers.

Fiji

We apply the access, correction, deletion, consent, security, and complaint practices in this Policy to users in Fiji, subject to lawful exceptions. You may report an electronic communication, Account, or other Content that causes or is intended to cause harm through the Platform's reporting tools or by contacting us. We assess reports under our safety rules and applicable Fiji law, including the Online Safety Act 2018, and may preserve information when reasonably necessary for an investigation, appeal, safety response, or legal obligation.

Maldives

We apply the access, correction, deletion, consent, security, and complaint practices in this Policy to users in the Maldives, subject to lawful exceptions. Personal information may be processed outside the Maldives as described under International Data Transfers. Any additional non-waivable privacy right or remedy available under Maldivian law remains available to you.

Seychelles

Where the Seychelles Data Protection Act 2023 applies, you may have rights to be informed, access, correction, deletion, restriction or objection, data portability, withdrawal of consent, and complaint. Where required, we maintain records of relevant processing, assess higher-risk processing and personal-data breaches, and designate a Data Protection Officer. Where special-category information requires explicit consent, we request it through the relevant feature.

We transfer personal information outside Seychelles only where the recipient provides the protection required by applicable law or another permitted transfer basis applies. If a concern is not resolved with us, you may contact the Seychelles Information Commission at infocom.sc.

Trinidad and Tobago

To the extent Trinidad and Tobago's Data Protection Act 2011 applies, we follow the General Privacy Principles that are in force, including accountability, identified purposes, appropriate consent, collection limitation, accuracy, safeguards, openness, access and correction, complaint handling, and comparable safeguards for disclosures outside Trinidad and Tobago. Because the Act is only partially proclaimed, a provision is referenced here only to the extent it is in force or otherwise applies.

Turks and Caicos Islands

We apply the access, correction, deletion, consent, security, and complaint practices in this Policy to users in the Turks and Caicos Islands, subject to lawful exceptions. Personal information may be processed outside the Islands as described under International Data Transfers. Any additional non-waivable privacy right or remedy available under applicable Turks and Caicos Islands law remains available to you.

Mexico

Where Mexico's Federal Law on the Protection of Personal Data Held by Private Parties applies, this Policy is Inker's comprehensive privacy notice. You may exercise rights of access, rectification, cancellation, or opposition (ARCO), revoke consent, or ask us to limit use or disclosure by contacting our Privacy Officer. Your request should identify the right you wish to exercise and include the information reasonably needed to verify your identity and locate the relevant data. We will process sensitive personal data only with the consent or other basis required by law.

The purposes necessary to provide and secure the Platform are described under How We Use Information. Marketing is a secondary purpose, and you may opt out without losing the core Platform. International transfers and the categories of recipients are described above; where Mexican law requires consent for a transfer, we will request it. You may also contact Mexico's competent data-protection authority.

Panama

Where Panama's Law 81 of 2019 applies, you may request access, rectification, cancellation, opposition, or portability and may revoke consent where processing is based on consent. We process personal data for the disclosed purposes, apply security and confidentiality safeguards, and retain it only as described in this Policy. Transfers outside Panama use the consent, contractual protections, or other basis required by applicable law. You may complain to Panama's National Authority for Transparency and Access to Information after contacting us.

Dominican Republic

Where Dominican Republic Law 172-13 applies, you may ask whether we hold personal data about you and request access, rectification, updating, or deletion where the law permits. We use personal data for specified purposes, take reasonable security measures, and handle international processing as described above. Contact our Privacy Officer to exercise a right or make a complaint.

Bolivia, Guatemala, and Honduras

We apply the notice, consent, access, correction, deletion, objection, security, complaint, and international-transfer practices in this Policy to users in Bolivia, Guatemala, and Honduras, subject to lawful exceptions. These practices do not replace or restrict any constitutional habeas-data right or other non-waivable protection available under local law. Contact our Privacy Officer to exercise a right or raise a concern.

Colombia

Where Colombia's Law 1581 of 2012 applies, you may know, update, and rectify your personal data; request evidence of authorization where authorization is required; obtain information about our use; submit complaints; and request revocation or deletion where legally available. Inker Inc. is the controller responsible for the processing described in this Policy. Contact our Privacy Officer first; you may then complain to the Superintendence of Industry and Commerce where its procedures allow.

We obtain authorization when Colombian law requires it, apply enhanced protection to sensitive data, and do not require you to answer questions about sensitive data unless needed for a feature you choose. International transmissions or transfers use the agreement, authorization, adequacy finding, or other legal mechanism required for the relevant recipient and processing relationship.

Paraguay

We apply the rights, consent, security, transparency, automated-processing review, and transfer practices in this Policy to users in Paraguay under currently applicable law. We are also preparing for Law 7593/2025 before it takes effect, including its requirements for lawful processing, data-subject rights, privacy by design, higher-risk processing, and international transfers. A right created by that law becomes available when and to the extent the law applies.

Brazil

Where Brazil's General Personal Data Protection Law (Lei Geral de Proteção de Dados Pessoais, or LGPD) applies, Inker Inc. is the controller responsible for the processing described in this Policy. We process personal data under the legal bases applicable to each purpose, including consent, performance of a contract or steps requested before a contract, compliance with legal or regulatory obligations, the regular exercise of rights, and legitimate interests supported by safeguards and a balancing assessment. Sensitive personal data is processed only under an applicable basis in Article 11 of the LGPD.

Brazilian data subjects may request confirmation of processing, access, correction, anonymization, blocking or deletion where applicable, portability subject to regulation, information about sharing, deletion of data processed with consent, information about the consequences of withholding consent, withdrawal of consent, opposition to unlawful processing, and review of decisions made solely through automated processing. Contact our Privacy Officer / Data Protection Officer first. You may petition the Brazilian National Data Protection Agency (ANPD) after attempting to resolve the request with us.

Personal data may be collected by Inker in the United States and transferred or made available to service providers in other countries. When Brazilian law treats an operation as an international transfer, Inker will document the applicable LGPD legal basis and transfer mechanism and provide the transparency required by ANPD Resolution CD/ANPD No. 19/2024. The Brazilian Portuguese version of this Policy provides additional details and identifies the Encarregado.

Changes to This Policy

We may update this Policy as our practices or legal obligations change. We will update the date above and provide additional notice, or request consent, when required for a material change.

Contact the Privacy Officer / Data Protection Officer

Privacy Officer / Data Protection Officer
Inker Inc.
500 W Cummings Park, Suite 6550
Woburn, MA 01801, United States
Email: contact@inker.com

Please use the subject line “Privacy Request” or “Privacy Complaint” so your message can be routed appropriately.