Privacy Policy
Last updated: 2026-06-15
This Privacy Policy explains how InkConcierge ("we", "us") collects, uses, and protects your personal data when you visit our website or use our services. We operate from the European Union and comply with the General Data Protection Regulation (GDPR).
Data controller
The data controller is Scale Studio GmbH, Chamerstrasse 172, 6300 Zug, Switzerland, which operates InkConcierge. Its affiliate under common ownership, SUPERHUMANS UNBOUND, LLC (USA), trading as AI Scale Studio, administers the associated Meta developer application and business portfolio on its behalf. For questions about this policy or your data, contact us at dan@aiscalestudio.com.
What data we collect
Account data (email, name), usage data (pages visited, interactions with the concierge), chat content you choose to share, and payment metadata processed by Stripe. We do not collect special categories of personal data.
How we collect your data
We collect personal data in three ways: directly from you when you create an account, configure your studio, upload portfolio images, or exchange messages with the AI concierge; automatically as you use the service, through cookies and similar technologies that record usage data, device and browser information, and approximate location derived from your IP address; and from third parties you choose to connect, such as Stripe (payment status) and Meta (Instagram/Facebook business-account data, as described above).
Sensitive data
We do not intentionally collect special categories of personal data — such as health, biometric, religious, or similar information — and we do not require it to provide the service. Because clients describe tattoo ideas in free-form chat, please avoid sharing sensitive personal details in messages. If such information is volunteered, we process it only to respond to the conversation and delete it on request.
Instagram & Facebook (Meta) data
When a tattoo studio connects its Instagram or Facebook business account, Meta's APIs share with us: the connected account's id and username/name (to confirm the right account is linked and attribute messages to the studio); the messages prospective clients send to the studio by direct message, including any image attachments (so the AI Studio Concierge can read them and reply); and a long-lived access token (so we can send replies on the studio's behalf). We use this data solely to read inbound direct messages and reply in-thread with tattoo suggestions and a booking link, only in direct response to a message the client started. We never post to feeds, never send unsolicited messages, never use Meta data for advertising, and never sell it. Access tokens are encrypted at rest (AES-256). This processing follows Meta's Platform Terms and Developer Policies. The Instagram authorization screen may display a legacy internal label ('Tattoo App Prod-IG'); the public product is InkConcierge.
AI and automated processing
The AI Studio Concierge uses large language models to read client messages and any image attachments and to generate tattoo suggestions, answers, and booking prompts. This processing assists a human studio rather than replacing it: the concierge does not make decisions producing legal or similarly significant effects without human involvement, and a studio can disable automated replies at any time. We do not sell your data, and we do not use your chat content or uploaded images to train third-party foundation models. Conversations may be reviewed in aggregated or pseudonymized form to monitor quality and prevent abuse.
How we use your data
To operate the InkConcierge service, authenticate you, deliver chat responses, process payments through Stripe, prevent abuse, and comply with legal obligations.
Legal basis
We rely on: contractual necessity (Art. 6(1)(b) GDPR) to provide the service; legitimate interest (Art. 6(1)(f)) to secure and improve it; consent (Art. 6(1)(a)) where required for cookies and marketing.
Marketing communications
With your consent, or where permitted by law for existing customers, we may send you product updates and offers. Every marketing email includes an unsubscribe link, and you can opt out at any time. Opting out does not affect service-related messages — such as booking confirmations, security alerts, or billing notices — which we must send to operate your account.
Retention
Account data is retained while your account is active. Chat transcripts are retained for up to 24 months by default and can be deleted on request. Payment records are retained per tax-law retention periods (typically 10 years in the EU).
Data security
We protect your data with industry-standard safeguards, including encryption in transit (TLS) and encryption at rest for sensitive fields such as access tokens and provider keys (AES-256). Access is restricted by role-based controls and tenant isolation enforced at the database level, so one studio cannot access another studio's data. No method of transmission or storage is completely secure, but we continually review and improve our measures.
Deleting your data (including Meta)
You can request deletion of your data at any time by emailing dan@aiscalestudio.com. For data linked to your Instagram or Facebook login, you can also remove our app in your Meta account settings (Settings → Apps and Websites → remove the app), which automatically sends us a deletion request; you can check its status at /data-deletion. Disconnecting your Instagram/Facebook integration in Settings → Integrations immediately deletes the stored access token and connected-account data. Deleting your full account removes or anonymizes your personal data, except transaction records we must keep by law (see Retention). See the /data-deletion page for step-by-step instructions.
Your rights
You can request access, correction, deletion, portability, and restriction of processing. Email dan@aiscalestudio.com — we respond within 30 days. You may also lodge a complaint with your national supervisory authority.
Subprocessors
We use Supabase (EU region) for data storage, Stripe for payments, Resend for transactional email, and AI providers (Anthropic, OpenAI) for concierge responses. All subprocessors are bound by data-processing agreements compliant with Art. 28 GDPR.
International transfers
Primary data is stored in the EU. Where a subprocessor transfers data outside the EEA, we rely on Standard Contractual Clauses and supplementary safeguards.
Cookies and tracking
We use strictly necessary cookies to run the service and, with your consent, analytics and product-measurement cookies, for example to understand feature usage and diagnose errors. You can control cookies through your browser settings and through our consent banner. See our Cookie Policy for the full list of cookies and their purposes.
Age restrictions
The service is intended for tattoo professionals and adult clients. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, contact us and we will delete it.
Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the date shown above and, where appropriate, notify you by email or an in-app notice. Your continued use of the service after an update means you accept the revised policy.
Contact
Email: dan@aiscalestudio.com.