# Privacy Policy — InkConscious / Inkconscious Studio / Inkconscious Design

*Version 3.1 — June 2026*

*Product names: since 1 October 2026 “IC Studio” is called “Inkconscious Studio” and “IC Design” is called “Inkconscious Design”. They are the same apps; only the visible name changed.*

## 1. Data controller

**Valerio Zanzarelli** (sole proprietor / autónomo), trading as **InkConscious**.  
**Privacy contact:** support@inkconscius.eu  
**Location:** Spain (Canary Islands).

**Terms of Service:** https://inkconscius.eu/terms/en/  
**Data Processing Agreement (studios):** https://inkconscius.eu/legal/#dpa-studio-en

## 2. Scope

This policy covers **Inkconscious Studio**, **Inkconscious Design**, and APIs at `api.inkconscius.eu`.  
It does **not** apply to a separate marketing site cookie banner (see Website Cookie Policy).

## 3. Products

- **Inkconscious Studio** — tattoo studio management (messaging, calendar, team, AI).
- **Inkconscious Design** — design editor (standalone device or linked studio account).

## 4. Data we process

| Category | Examples |
|----------|----------|
| Professional account | Email, password hash, studio ID, role, sessions |
| Studio end-customers | Phone, WA/IG messages, audio, reference images |
| Inkconscious Design (device) | Device UUID, AI usage, optional encrypted BYOK OpenAI key |
| Payments | Subscription status (Apple, Google, Stripe, RevenueCat); no full card numbers |
| Legal | Accepted document versions, date, acceptor email |
| Platform security | IP address, user agent (browser/device), API endpoints, session timestamps, legal acceptance records, authentication events |
| Crash reports (Inkconscious Studio on Android and iOS) | If the app closes because of an error: device model, operating system and app version, the point in the code where the error happened, a random installation identifier. No content, no client data, no name. Sent to Google Firebase Crashlytics, which processes it on our behalf |

We do **not** use third-party advertising analytics SDKs in native apps (as of June 2026). We do **not** sell personal data or use it for third-party advertising.

## 5. Purposes and legal bases (GDPR)

- **Contract** (Art. 6(1)(b)): provide the subscribed software.  
- **Legitimate interests** (Art. 6(1)(f)): platform security, fraud prevention, **protection of software intellectual property** against unauthorized copying, technical improvement.  
- **Consent** (Art. 6(1)(a)): registration, legal checkboxes, studio-managed client forms.

## 6. Processor role (studios)

For **end-customer** data, the **tattoo studio** is the controller and **InkConscious** is the **processor** under the published DPA.

## 7. Sub-processors and transfers

See **Sub-processors** document. Includes EU hosting, Meta, OpenAI, Stripe, RevenueCat, Apple, Google.

Transfers outside the EEA (e.g. USA): Standard Contractual Clauses or equivalent provider mechanisms.

## 8. Retention

While the account or device is active and as required by law.

- **Security and platform audit logs:** typically **24 months** from the event, unless an ongoing security investigation or legal claim requires longer retention (limited to what is strictly necessary).
- **Other technical logs:** typically 12–24 months unless a security incident requires longer.

## 9. Your rights

Access, rectification, erasure, restriction, portability, objection, and complaint to a supervisory authority (EU: local DPA; Spain: AEPD).  
Requests: support@inkconscius.eu

## 10. Deletion

- **Studio customer data:** deleted by studio admin in Inkconscious Studio or documented API.  
- **Studio account:** Settings → Delete account (`DELETE` confirmation).  
- **Inkconscious Design device:** unlink/delete per in-app flow.

## 11. Security

HTTPS, encrypted channel credentials (AES-256-GCM), secure device storage where supported.

**Security monitoring:** InkConscious automatically logs authenticated API usage and sessions to detect abuse and protect the software against unauthorized copying. We do **not** capture screen content; only technical metadata (IP, device, API actions, timestamps). Legal basis: legitimate interest (Art. 6(1)(f) GDPR). You may object (Art. 21); if objection prevents us from securing the service, access may be limited or terminated.

## 12. Children

Service for **18+** professional B2B use only.

## 13. Changes

Version **3.1**. Material changes: in-app or email notice; new acceptance may be required.

## 14. Contact

**support@inkconscius.eu**

## 15. United States users (B2B)

Where GDPR does not apply, we apply comparable practices: no sale of personal information for money; privacy requests to support@inkconscius.eu. California B2B contracts may specify additional terms in writing if required.

## 16. Google user data (Limited Use)

A studio may connect its own Google account to Inkconscious Studio. Nothing is connected
by default: the connection starts only when a studio owner presses "Connect
Google" and grants the permissions on Google's own consent screen. It can be
revoked at any time from https://myaccount.google.com/permissions or from the
Channels section in Inkconscious Studio.

### What we ask for, and why

| Google permission | Why Inkconscious Studio needs it |
|---|---|
| Send email on your behalf (`gmail.send`) | Send appointment confirmations, reminders and aftercare instructions from the studio's own address, so the customer recognises the sender. We never read, list or search the mailbox: this permission does not allow it. |
| Calendar (`calendar`) | Create, move and cancel the studio's appointments, and read availability so a slot is not offered twice. |
| Email address of the account (`userinfo.email`) | Show which Google account is connected, so a studio with two accounts can tell them apart. |
| Basic profile (`openid`, `userinfo.profile`) | Sign in to Inkconscious Studio with Google. |
| Files created by the app in Drive (`drive.file`) | Store the studio's own encrypted backup. This permission only reaches files Inkconscious Studio itself created; the rest of the Drive stays invisible to us. |
| Business Profile (`business.manage`) and Google Ads (`adwords`) | Read locations, search statistics and campaign spend for the optional advertising assistant. Requested only by studios that use that section. |
| Google Analytics, read only (`analytics.readonly`) | Show the studio the statistics of its own website (visits, where visitors come from, and taps on Book, WhatsApp, Call and Directions), the weekly marketing summary, and the "Try it now" check. Requested only by studios that connect their website. |
| Google Analytics, edit (`analytics.edit`) | Only when the studio presses "Set it up for me": create the website property and data stream if the studio has none, and mark the four studio actions as key events. Nothing else in the property is changed. |
| Google Tag Manager (`tagmanager.edit.containers`, `tagmanager.publish`) | Only when the studio presses "Set it up for me": add the Inkconscious Studio tag, trigger and GA4 event tag (all named "ICstudio ·") to the container the studio chooses, and publish that version so the website starts counting. Other tags are removed only if the studio selects them. |

Each permission is requested because no narrower Google permission covers the
same feature.

### Limited Use

**InkConscious's use and transfer of information received from Google APIs to
any other app will adhere to the
[Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy),
including the Limited Use requirements.**

**Inkconscious Studio's use of data, raw or derived, received from Google Workspace APIs
— including Gmail and Google Calendar — will adhere to the
[Google User Data Policy](https://developers.google.com/terms/api-services-user-data-policy),
including the Limited Use requirements. This applies in full to the AI features
described below: no data received from those APIs is used to develop, improve
or train generalised AI or machine-learning models.**

In practice:

- We use Google user data **only** to provide and improve the features listed
  above, as requested by the studio.
- We do **not** sell Google user data, and we do **not** use it for
  advertising or profiling.
- We do **not** use Google user data to develop, improve or train generalised
  or non-personalised AI or machine-learning models.
- Calendar availability and appointment details may be sent to our AI provider
  **only** to operate the assistant during a single conversation, under
  contracts that prohibit the provider from using that data to train its
  models. See **Sub-processors**.
- When the studio asks the marketing assistant about its results, the
  aggregated figures it asks about (website statistics from Google Analytics,
  Business Profile and Google Ads figures) may be sent to our AI provider
  **only** to answer that request, under the same contracts. These are totals
  per page, source and action: no data about individual visitors.
- No InkConscious person reads Google user data, except with the studio's
  explicit written permission, where necessary for security (for example
  investigating abuse), or where the law requires it.

### Who we share Google user data with

Google user data is shared with only the two third parties below, only so
that the features above can run, and never for those parties' own purposes.

| Who receives it | What they receive, and why | Where |
|---|---|---|
| Hetzner Online GmbH | Hosting of the Inkconscious Studio servers and database: the studio's appointments and the encrypted Google credentials are stored there. | Germany (EU) |
| OpenAI, L.L.C. **or** Anthropic PBC — only the one configured for the studio, never both | Calendar availability and appointment details, and the aggregated website and advertising figures the studio asks the marketing assistant about, sent only while the assistant is handling a single conversation, under contracts that forbid using that data to train their models. | United States, under a data processing agreement with Standard Contractual Clauses |

We do **not** share, transfer or disclose Google user data to any other
third parties, and no other third party has access to it. In particular it
is never sent to Meta, to our payment providers (Stripe, RevenueCat, Apple,
Google Play), to advertisers, to data brokers, or to another studio using Inkconscious
Studio. We do not sell it, and we do not use it for advertising.

Two things are not a transfer by us: an email sent through `gmail.send` travels
from the studio's own Google account to the recipient the studio chose, and an
appointment written to the studio's calendar stays in the studio's own Google
account.

The full list of our sub-processors, for all data and not only Google user
data, is in the **Sub-processors** document.

### Storage and deletion

Google access credentials are stored encrypted (AES-256-GCM) and are never
returned to a browser or a device in a form that could reach other Google
services. Disconnecting Google in Inkconscious Studio, or revoking access from the Google
account, deletes those credentials. Appointments already written to the
studio's calendar and emails already sent stay in the studio's own Google
account and are under the studio's control, not ours.