Draft — pending legal review. This policy is written in plain English to describe how InkSpred handles your data. It is not legal advice and will be refined by a solicitor before public launch.

Privacy Policy

Last updated: 7 July 2026

This policy explains what personal data InkSpred Ltd (“InkSpred”, “we”, “us”) collects when you use our website and mobile app, why we collect it, who we share it with, and the rights you have under UK data protection law (the UK GDPR and the Data Protection Act 2018). InkSpred connects customers with independent tattoo artists and studios and facilitates bookings and payments between them.

1. Who we are

InkSpred Ltd is a company registered in England & Wales. For most of the data described below — your account, our marketing, and how the platform runs — InkSpred is the data controller. For booking and client-management data that an artist or studio records about you through our tools (including consent forms), the artist or studio is generally the controller and InkSpred acts as their data processor under a data processing agreement. Where roles are shared, this policy tells you which of us is responsible.

2. What we collect

We only collect what we need to run bookings, payments and your account. Depending on how you use InkSpred, this can include:

Account details — the email address and, where you provide it, the phone number you sign up with, plus your password (stored only in hashed form by our authentication provider).
Profile and portfolio content — your name or handle, profile photo, and, for artists, portfolio images, bio, pricing and studio details you choose to publish.
Booking details — the piece you are enquiring about, quotes, appointment dates, deposit and payment-plan status, and your booking history.
Messages and reference photos — the messages you exchange with an artist through InkSpred and any reference or design images you upload, which may include photographs of your body or existing tattoos.
Approximate location — an approximate location (for example, derived from your device or a place you search) so the Find map can show artists near you. You can search by area instead of sharing device location, and you control location permission in your device settings.
Payment information — payments are handled by Stripe. We receive confirmation of a payment, the amount, and a limited reference (such as the last four digits and card type); we do not store your full card number.
Technical and usage data — device type, app version, approximate IP-based region, crash logs and basic usage events needed to keep the service secure and working.

Special-category (health) data in consent forms

Sensitive data — treated with extra care. Tattoo consent forms routinely capture health data — allergies, skin conditions, medication, and pregnancy status. Under UK GDPR this is special-category data and needs stronger protection than ordinary information.

Our lawful basis for handling it is your explicit consent (UK GDPR Article 9(2)(a)), captured separately from the ordinary booking flow at the point the artist asks the health questions. You are never required to give this data to browse InkSpred; it exists so an artist can tattoo you safely. It is encrypted at rest, access is scoped to the artist or studio you booked with, and it is kept only for as long as consent-record norms and the artist’s insurance and legal duties require (see Retention). You can withdraw consent at any time by contacting the artist or us, though the artist may decline to tattoo you without it.

3. How we use your data and our lawful bases

We rely on the following lawful bases under UK GDPR for the different things we do with your data:

To provide the service — creating your account, taking bookings, showing the Find map, and passing messages between you and an artist (performance of a contract).
To take deposits and run payment plans — processing payments through Stripe and settling funds to the artist (performance of a contract).
Health data on consent forms — explicit consent (Article 9), as described above.
To keep the platform safe and lawful — fraud and dispute prevention, age (18+) checks, and evidence records for chargeback defence (legitimate interests and legal obligation).
To send service messages — booking confirmations, payment reminders and account notices (contract).
To send marketing — only where you have opted in; you can unsubscribe at any time (consent).

4. Payments, plans and credit — the honest position

InkSpred is not a lender and does not offer or decide credit. Card and payment processing is handled by Stripe. Where an instalment-credit option (such as Klarna) is offered at checkout, the credit provider is a separate, regulated third party that makes all lending decisions and owns that relationship with you — InkSpred simply presents it as a payment method. If you use such an option, that provider’s own privacy notice applies to the data they collect to assess and manage your credit.

InkSpred Plans are a way to prepay toward a booked tattoo (a form of layaway): they are not credit, carry no interest and no late fees, and you receive the work only once it is paid for. The data we hold for a Plan is your payment schedule and pot balance — not a credit file.

5. Who processes your data

We use a small number of trusted providers to run InkSpred. Each only receives the data they need, under a contract that requires them to protect it:

Supabase — our database, account authentication and file storage (profiles, bookings, messages and uploaded images).
Stripe — payment processing for deposits, plan instalments and balances; Stripe is the payments controller for that data.
Vercel — hosting and delivery of our website and app back end.
Our map-tiles provider — serves the map imagery used by the Find feature; your approximate search area may be sent to render the map.
The artist or studio you book with — receives the booking details, messages, reference images and any consent-form data you provide to them, as the controller for that record.

Some of these providers may process data outside the UK. Where they do, the transfer is protected by appropriate safeguards (such as the UK International Data Transfer Agreement or adequacy regulations). We prefer UK or EU data residency where a provider offers it.

6. How long we keep it

Account data — for as long as your account is open, then deleted or anonymised within a reasonable period after closure.
Booking, payment and dispute records — kept for up to six years after the booking to meet accounting, tax and dispute/chargeback obligations.
Health data on consent forms — kept only as long as consent-record norms and the artist’s insurance and legal duties require (typically at least a few years), then securely deleted.
Messages and reference images — retained while relevant to a booking or dispute, then removed on the same basis as booking records.

7. Your rights under UK GDPR

You have the right to:

Access a copy of the personal data we hold about you.
Correct data that is wrong or incomplete.
Delete your data (“right to erasure”). You can delete your account and associated data from within the app in Settings → Delete account, or ask us to do it for you.
Restrict or object to certain processing, and withdraw consent (for example, to marketing or to health-data processing) at any time.
Data portability — receive your data in a portable format.

To exercise any of these rights, email us at hello@inkspred.co.uk. We will respond within one month. Some booking and consent records are controlled by the artist or studio; where that is the case we will help route your request to the right party.

8. Cookies and similar technologies

Our website uses a small number of cookies and similar technologies that are strictly necessary to keep you signed in, remember your preferences and keep the service secure. We do not use advertising cookies and we do not track you across other apps or websites. Our mobile app does not use third-party advertising trackers. You can control cookies through your browser settings.

9. Age and children

InkSpred is strictly for adults aged 18 or over. Tattooing anyone under 18 is a criminal offence in the UK (Tattooing of Minors Act 1969), and there is no parental-consent exception. We do not knowingly collect data from anyone under 18. If we learn that a user is under 18, we will close the account and delete their data.

10. How we protect your data

We use encryption in transit and at rest, access controls that scope booking and health data to the relevant artist or studio, and reputable infrastructure providers. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data and will notify you and the regulator where the law requires.

11. Contact and complaints

For any privacy question or to exercise your rights, contact us at hello@inkspred.co.uk.

If you are unhappy with how we have handled your data, you have the right to complain to the UK’s data protection regulator, the Information Commissioner’s Office (ICO), at ico.org.uk or on 0303 123 1113. We would appreciate the chance to resolve your concern first.