Legal
Privacy Policy
Contents
01
What information we collect
We collect different types of personal information depending on how you use Inkframe.
| Who you are | Information collected |
|---|---|
| Artist applicants | Full name, Instagram handle, city, primary tattoo style, email address |
| Approved artists | Above, plus: profile bio, portfolio images, availability, deposit settings, Stripe account details (handled by Stripe), bank details for payouts (handled by Stripe) |
| Clients | Email address, booking request details (style, placement, size, description, reference images), age verification status (handled by Stripe Identity), payment information (handled by Stripe) |
| All users | IP address, device type, browser type, pages visited, time and date of access (collected automatically) |
We do not collect sensitive information (as defined under the Privacy Act) such as health information, racial or ethnic origin, or biometric data, except where strictly necessary for age verification through Stripe Identity, which is governed by Stripe's own privacy policy.
We do not collect health or medical information directly. Any health declarations made prior to a tattooing session are exchanged directly between artist and client and are not stored on Inkframe infrastructure.
02
How we collect it
We collect personal information in the following ways:
Directly from you: when you complete the founding artist application form, create a profile, submit a booking request, or contact us via email.
Automatically: when you visit inkframe.ink, our hosting provider (Vercel) and any analytics tools we operate collect standard server log data including IP address, browser type, and pages visited.
Via third parties: when you connect a Stripe account or complete identity verification through Stripe Identity, Stripe collects and processes that information under their own privacy policy. We receive only confirmation of verification status or account connection (not the underlying financial or identity documents).
We will never collect your personal information through deceptive means.
03
Why we collect it
We collect personal information only for purposes that are directly related to providing and improving the Inkframe platform. These purposes include:
| Purpose | Information used |
|---|---|
| Processing artist applications | Name, Instagram handle, city, style, email |
| Operating the booking platform | Profile data, booking request details, availability |
| Processing payments and deposits | Stripe-managed payment and identity data |
| Sending transactional communications | Email address (booking confirmations, reminders, receipts) |
| Platform security and fraud prevention | IP address, device data, usage patterns |
| Improving the platform | Anonymised usage data and aggregated analytics |
| Complying with legal obligations | Any information required by law |
We will not use your personal information for direct marketing without your explicit consent. If you consent to receiving updates from us, you can withdraw that consent at any time by emailing hello@inkframe.ink or using the unsubscribe link in any email we send.
04
How we store and protect it
Your personal information is stored on secure infrastructure provided by Supabase (PostgreSQL database and file storage) and Vercel (hosting), both of which operate data centres in the United States. We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, including:
Encryption in transit: all data transmitted between your device and our platform uses TLS encryption (HTTPS). No unencrypted personal information is transmitted.
Access controls: personal information is accessible only to authorised personnel and systems that require it to deliver the platform's functionality.
Third-party security: payment and identity information is handled exclusively by Stripe, which is PCI DSS Level 1 certified. We do not store card numbers, bank account details, or identity documents on Inkframe infrastructure.
No system is perfectly secure. While we take reasonable precautions, we cannot guarantee the absolute security of information transmitted over the internet. If you become aware of any security concern related to your Inkframe account or data, please contact us immediately at hello@inkframe.ink.
05
Who we share it with
We do not sell your personal information. We do not share it with third parties for their own marketing purposes. We share it only in the following limited circumstances:
| Third party | Purpose | Their privacy policy |
|---|---|---|
| Stripe | Payment processing, payouts, identity verification | stripe.com/privacy |
| Supabase | Database and file storage infrastructure | supabase.com/privacy |
| Vercel | Website hosting and deployment | vercel.com/legal/privacy-policy |
| Resend | Transactional email delivery | resend.com/legal/privacy-policy |
| Between artists and clients | Booking-related information is shared with the other party to a confirmed booking (e.g. an artist sees a client's booking request details) | N/A |
We may also disclose personal information where required by law (for example, in response to a valid court order, subpoena, or request from a law enforcement authority) or where we have a good faith belief that disclosure is necessary to protect the safety of any person.
06
Overseas disclosure
Some of our service providers store and process data outside of Australia, primarily in the United States. These providers include Stripe, Supabase, Vercel, and Resend. Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure that the recipient does not breach the Australian Privacy Principles.
By using Inkframe, you consent to your personal information being processed by these overseas third-party providers as described in this policy. Where we rely on their services, we require them to handle personal information in a manner that is consistent with Australian privacy law obligations.
07
Cookies and analytics
The Inkframe website may use cookies and similar technologies to operate correctly and to understand how visitors use the platform. These include:
Essential cookies: required for the platform to function, including authentication session tokens. These cannot be disabled without breaking core functionality.
Analytics: where we use analytics tools to understand page visits and usage patterns, this data is collected in aggregate and anonymised where possible. We do not use advertising trackers or third-party behavioural profiling.
You can configure your browser to refuse cookies, though this may affect how parts of the platform function. We do not currently display a cookie consent banner because we do not use non-essential cookies that require opt-in consent under Australian law at this stage. If this changes, we will update this policy and implement appropriate consent mechanisms.
08
Your rights
Under the Australian Privacy Principles, you have the right to:
Access your personal information: you can request a copy of the personal information we hold about you at any time.
Correct your personal information: if information we hold about you is inaccurate, out of date, incomplete, or misleading, you can ask us to correct it.
Request deletion: you can ask us to delete your personal information. We will do so unless we are required by law to retain it, or retention is necessary for the establishment, exercise, or defence of a legal claim.
Withdraw consent: where we rely on your consent to process your information (for example, for marketing communications), you can withdraw that consent at any time.
Make a complaint: if you believe we have handled your personal information in a way that breaches the Privacy Act, you can make a complaint to us first (see Section 12). If you are unsatisfied with our response, you can escalate your complaint to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
To exercise any of these rights, contact us at hello@inkframe.ink. We will respond within 30 days.
09
Data retention
We retain personal information only for as long as it is needed for the purposes described in this policy, or as required by law.
| Data type | Retention period |
|---|---|
| Artist application data (not accepted) | 12 months from application date, then deleted |
| Active artist profile data | Duration of account, plus 12 months after account closure |
| Booking records and transaction data | 7 years (required for Australian tax and financial record-keeping obligations) |
| Client booking request data | Duration of booking relationship, plus 12 months |
| Server and access logs | 90 days, then automatically purged |
When personal information is no longer required, we will take reasonable steps to destroy or de-identify it securely.
10
Children
Inkframe is a platform for tattooing services. Tattooing is restricted to individuals aged 18 years and over under Australian law. Accordingly, our platform is not directed at, and we do not knowingly collect personal information from, anyone under the age of 18.
If you believe we have inadvertently collected information from a person under 18, please contact us immediately at hello@inkframe.ink and we will delete that information promptly.
11
Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices, the platform, or applicable law. When we make material changes, we will notify registered users by email and update the effective date at the top of this page. We encourage you to review this policy periodically.
Your continued use of the platform after any changes constitutes acceptance of the updated policy. If you do not agree with a material change, you may close your account and request deletion of your data.
12
Contact us
Privacy enquiries & complaints
If you have a question about this policy, wish to exercise your rights, or want to make a privacy complaint, please contact us:
Email
hello@inkframe.ink
Response time
We will acknowledge your request within 5 business days and respond fully within 30 days.
Escalation
If you are unsatisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.