Privacy Policy

This Privacy Policy explains how InkWell Group Limited processes personal data when you use the InkWell platform.

InkWell Group Limited is a company registered in England and Wales under company number 16998198 (“InkWell”, “we”, “us” or “our”).

For the purposes of UK data protection law, InkWell Group Limited is a data controller in respect of personal data collected through the Platform.

If you have any questions about this Privacy Policy, you can contact our legal team.

If you use a website contact form, we process your name, email address and message to respond to your enquiry. Messages are sent to the relevant InkWell inbox through our email provider. We use protected network and email identifiers to limit spam. Contact-form contents are not sent to marketing analytics. Please leave out client details, health information and private artwork.

1. Scope

This Privacy Policy applies to:

• Clients submitting booking requests through the Platform
• Artists and Studios using the Platform
• Website visitors

It does not apply to personal data processed independently by Artists or Studios outside the Platform.

2. Personal Data We Collect

2.1 Client Data

We may collect:

• Full name
• Email address
• Telephone number
• Booking request details
• Tattoo preferences, uploaded reference images and reference links
• Optional placement-plan data and its generated preview
• Client conversation messages and captured email replies
• Booking agreements and their recorded versions
• Studio procedure-consent documents, electronic signatures and separately consented health-questionnaire answers when the studio enables digital waivers
• Merchandise orders, delivery addresses and fulfilment details
• Transaction confirmation data
• IP address
• Device and browser information

We do not store full card details. Payments are processed by Stripe.

Keep tattoo briefs, uploaded images and reference links focused on the artwork. Do not include ID or medical records in those enquiries. Contact your studio about accessibility needs and its process for age, identity and suitability checks.

Studios can enable optional digital waivers with their own reviewed consent wording, health questions and privacy notice. Health answers are encrypted separately from the procedure-consent record. Staff access to answers is limited to the studio's owners, admins and assigned artist. Clients can download their own copy and withdraw consent to use their health information through the private form. Erasure removes the health answers while retaining the signed procedure-consent record. InkWell does not make automated medical decisions; studio staff review answers with the client.

2.2 Studio and Artist Data

We may collect:

• Studio or artist name
• Contact name
• Email address
• Telephone number
• Studio address
• Legal seller name, business type and company number where applicable
• Public business postal address and customer support contact details
• Stripe account identifier, verification status and available legal-entity evidence
• Seller verification and review dates, reasons and change history
• Transaction data
• Subscription billing data

Booking terms and merchandise seller notices show the legal seller’s name, company number where applicable, public business postal address and customer support email and phone. These details can differ from the public studio brand, studio location and private contact details supplied to Stripe.

For the seller check, InkWell retains the connected account identifier, verification status and minimal legal-entity evidence Stripe makes available, such as the entity type and legal name. Limited-company registration details also undergo an independent InkWell review. Identity documents, dates of birth and private bank details requested during Stripe verification are supplied through Stripe’s hosted flow; the seller check does not copy these into InkWell.

2.3 Technical Data

We collect technical data including:

• IP address
• Browser type
• Device type
• Operating system
• Usage analytics

This may be collected through cookies and analytics tools.

3. How We Use Personal Data

We use personal data to:

• Operate and maintain the Platform
• Process and facilitate Bookings
• Facilitate payment processing via Stripe
• Link legal seller details to the connected payment account and review verification changes
• Provide customer support
• Manage studio and artist accounts
• Support private client conversations and booking agreements
• Manage merchandise orders and fulfilment records
• Send transactional communications
• Send marketing communications where lawful
• Prevent fraud and abuse
• Improve platform functionality
• Comply with legal obligations

4. Legal Basis for Processing

We rely on the following lawful bases under UK GDPR:

• Performance of a contract
• Legitimate interests
• Legal obligations
• Consent, where required

Legitimate interests include improving the Platform, ensuring security and preventing fraud.

5. Payment Processing

Payments are processed by Stripe.

Stripe acts as an independent data controller in respect of payment information.

Your use of Stripe is subject to Stripe’s own privacy policy and terms.

InkWell does not store full card numbers.

6. Data Sharing

We may share personal data with:

• Artists and Studios for the purpose of fulfilling Bookings
• Stripe for payment processing
• Hosting providers
• Email service providers
• Google for optional marketing analytics
• Vercel for optional marketing-page performance measurements
• Professional advisers where required
• Law enforcement where legally required

We do not sell personal data.

7. International Transfers

Some service providers may process data outside the United Kingdom.

Where this occurs, we ensure appropriate safeguards are in place in accordance with UK GDPR.

8. Data Retention

We retain personal data only for as long as necessary to:

• Fulfil Bookings
• Maintain business records
• Comply with tax and accounting obligations
• Resolve disputes
• Meet legal requirements

Retention periods may vary depending on the type of data and regulatory requirements.

9. Marketing Communications

We may send marketing communications:

• Where you have opted in
• Where permitted under applicable electronic marketing regulations

You may unsubscribe at any time by following the unsubscribe link or contacting our legal team.

10. Cookies and Analytics

We use cookies and analytics tools to:

• Operate the Platform
• Measure usage
• Improve performance
• Understand user behaviour

On the marketing website, optional Google Analytics and Vercel Speed Insights stay off until you choose “Allow analytics”. Google Analytics measures marketing-page visits and clicks on signup, walkthrough and walkthrough contact buttons. Google receives a temporary browser identifier, the referring website's origin and approved broad campaign labels, alongside technical information such as IP addresses. We do not send names, email contents, private client pages, full referring URLs, query strings, booking-form contents or session recordings. We disable advertising personalisation and Google Signals. Use “Cookie settings” in the footer to withdraw or change your choice. Read our Cookie Policy for more information.

Vercel Speed Insights measures page loading speed, responsiveness and visual stability on approved public marketing pages. Its reports include the page path and broad browser, device and country information. We remove query strings and fragments and exclude authentication, Studio, private client links and studio-owned public pages. It does not use a persistent visitor identifier or session recordings. Earlier consent for Google alone does not enable these performance measurements; we ask for a new choice.

11. Data Security

We implement appropriate technical and organisational measures to protect personal data, including:

• Secure hosting
• Encrypted connections
• Access controls
• Payment security via Stripe

However, no online system can guarantee absolute security.

Uploaded tattoo references are sent only when the client submits the enquiry. They stay private with that request and are opened by studio staff with enquiry access. They are not published in the portfolio or attached to acknowledgement emails. Embedded camera and location metadata is removed from saved reference images.

Reference previews stay hidden until staff choose to load them. Loading an external image or opening its link contacts that website, which can receive the viewer's network address. Public portfolio images are viewable by visitors. Hiding an image or restricting its link does not remove copies already downloaded. InkWell does not automatically classify images for nudity or graphic content.

Private conversation links let the intended client read and reply to their enquiry without an account. Keep those links private. The enquiry owner can revoke customer links and sessions from Studio. Where email reply capture is enabled, eligible replies from the client’s original email address are saved in the conversation. Otherwise, use the private conversation link or contact the studio directly.

12. Your Rights

Under UK GDPR, you have the right to:

• Access your personal data
• Request correction of inaccurate data
• Request erasure in certain circumstances
• Restrict processing
• Object to processing
• Request data portability
• Withdraw consent where applicable

You may exercise these rights by contacting our legal team.

13. Complaints

You have the right to complain to the Information Commissioner’s Office in the United Kingdom.

14. Changes to This Policy

We may update this Privacy Policy from time to time.

Updated versions will be published on the Platform with a revised effective date.