# Privacy Policy — InkConscious / IC Studio / IC Design

*Version 3.1 — June 2026*

## 1. Data controller

**Valerio Zanzarelli** (sole proprietor / autónomo), trading as **InkConscious**.  
**Privacy contact:** valerio.zanzarelli@gmail.com  
**Location:** Spain (Canary Islands).

**Terms of Service:** https://inkconscius.eu/terms/en/  
**Data Processing Agreement (studios):** https://inkconscius.eu/legal/#dpa-studio-en

## 2. Scope

This policy covers **IC Studio**, **IC Design**, and APIs at `api.inkconscius.eu`.  
It does **not** apply to a separate marketing site cookie banner (see Website Cookie Policy).

## 3. Products

- **IC Studio** — tattoo studio management (messaging, calendar, team, AI).
- **IC Design** — design editor (standalone device or linked studio account).

## 4. Data we process

| Category | Examples |
|----------|----------|
| Professional account | Email, password hash, studio ID, role, sessions |
| Studio end-customers | Phone, WA/IG messages, audio, reference images |
| IC Design (device) | Device UUID, AI usage, optional encrypted BYOK OpenAI key |
| Payments | Subscription status (Apple, Google, Stripe, RevenueCat); no full card numbers |
| Legal | Accepted document versions, date, acceptor email |
| Platform security | IP address, user agent (browser/device), API endpoints, session timestamps, legal acceptance records, authentication events |

We do **not** use third-party advertising analytics SDKs in native apps (as of June 2026). We do **not** sell personal data or use it for third-party advertising.

## 5. Purposes and legal bases (GDPR)

- **Contract** (Art. 6(1)(b)): provide the subscribed software.  
- **Legitimate interests** (Art. 6(1)(f)): platform security, fraud prevention, **protection of software intellectual property** against unauthorized copying, technical improvement.  
- **Consent** (Art. 6(1)(a)): registration, legal checkboxes, studio-managed client forms.

## 6. Processor role (studios)

For **end-customer** data, the **tattoo studio** is the controller and **InkConscious** is the **processor** under the published DPA.

## 7. Sub-processors and transfers

See **Sub-processors** document. Includes EU hosting, Meta, OpenAI, Stripe, RevenueCat, Apple, Google.

Transfers outside the EEA (e.g. USA): Standard Contractual Clauses or equivalent provider mechanisms.

## 8. Retention

While the account or device is active and as required by law.

- **Security and platform audit logs:** typically **24 months** from the event, unless an ongoing security investigation or legal claim requires longer retention (limited to what is strictly necessary).
- **Other technical logs:** typically 12–24 months unless a security incident requires longer.

## 9. Your rights

Access, rectification, erasure, restriction, portability, objection, and complaint to a supervisory authority (EU: local DPA; Spain: AEPD).  
Requests: valerio.zanzarelli@gmail.com

## 10. Deletion

- **Studio customer data:** deleted by studio admin in IC Studio or documented API.  
- **Studio account:** Settings → Delete account (`DELETE` confirmation).  
- **IC Design device:** unlink/delete per in-app flow.

## 11. Security

HTTPS, encrypted channel credentials (AES-256-GCM), secure device storage where supported.

**Security monitoring:** InkConscious automatically logs authenticated API usage and sessions to detect abuse and protect the software against unauthorized copying. We do **not** capture screen content; only technical metadata (IP, device, API actions, timestamps). Legal basis: legitimate interest (Art. 6(1)(f) GDPR). You may object (Art. 21); if objection prevents us from securing the service, access may be limited or terminated.

## 12. Children

Service for **18+** professional B2B use only.

## 13. Changes

Version **3.1**. Material changes: in-app or email notice; new acceptance may be required.

## 14. Contact

**valerio.zanzarelli@gmail.com**

## 15. United States users (B2B)

Where GDPR does not apply, we apply comparable practices: no sale of personal information for money; privacy requests to valerio.zanzarelli@gmail.com. California B2B contracts may specify additional terms in writing if required.