Legal

Privacy Policy

Effective date: April 24, 2026 · Last updated: April 24, 2026

BookInk is an AI booking assistant for tattoo artists. We only access the Google Calendar data we explicitly need — nothing more. We never read your emails, contacts, or files.

1. Who We Are

BookInk ("we", "us", "our") is a product operated by Polsia. Our service provides tattoo artists with an AI-powered booking assistant that qualifies client requests, collects deposits, and manages calendar availability.

For questions about this policy, contact us at hello@bookink.ink.

2. Data We Collect

Artist accounts:

Name, email address, studio name, and profile information you provide during registration
Booking preferences, pricing, availability settings
Google Calendar access tokens (encrypted at rest) — only when you explicitly connect your calendar

Client (end-user) data:

Name, email address, and tattoo request details submitted through the booking chat
Reference photos you upload (stored securely in cloud storage)
Payment data processed by Stripe (we do not store card numbers)

Usage data:

Server logs (IP address, browser, page visits) for security and debugging
Analytics events (page views, CTA clicks) to improve the product

3. Google Calendar Integration

When an artist connects their Google Calendar, BookInk requests the following OAuth permissions only:

Scope	What we use it for	Accessed
`calendar.events`	Create, update, and delete booking events on your calendar when bookings are confirmed, rescheduled, or cancelled	✓ Yes
`calendar.readonly`	Read existing events to determine your availability (prevent double-booking)	✓ Yes
Gmail / Drive / Contacts / other scopes	Not applicable	✗ Never requested

We do not read the content of your existing calendar events beyond their time slots. We only check for busy/free periods when displaying your availability to clients.

Google OAuth tokens are encrypted using AES-256-GCM before storage. You can disconnect your Google Calendar at any time from your artist dashboard — this immediately revokes our access and deletes the stored tokens.

4. How We Use Your Data

To operate the booking service — matching clients with artists, sending confirmations, processing deposits
To sync confirmed sessions to your Google Calendar
To send transactional emails (booking confirmations, reminders, quotes)
To improve BookInk's AI responses and booking flow
To detect fraud and ensure platform security

We do not sell your data, share it with advertisers, or use it to train third-party AI models without consent.

5. Data Sharing

We share data only with service providers that are necessary to operate BookInk:

Stripe — payment processing and artist bank payouts
Google — calendar sync (only for connected artists)
Postmark — transactional email delivery
Cloudflare R2 — reference photo storage
Render / Neon — hosting and database infrastructure

All service providers are contractually bound to data protection standards consistent with this policy.

6. Data Retention

Booking records are retained for 36 months for accounting and dispute resolution
Artist account data is retained until account deletion is requested
Google Calendar tokens are deleted immediately upon calendar disconnection
Server logs are retained for 30 days

7. Your Rights (GDPR)

If you are in the European Union or European Economic Area, you have the following rights:

Access — request a copy of the personal data we hold about you
Rectification — correct inaccurate data
Erasure — request deletion of your data ("right to be forgotten")
Portability — receive your data in a machine-readable format
Objection — object to processing based on legitimate interests
Restriction — request we restrict processing of your data

To exercise any of these rights, email hello@bookink.ink. We will respond within 30 days.

8. Cookies

BookInk uses only functional cookies and localStorage to:

Keep you logged in (JWT session token)
Remember your language preference
Store a pseudonymous visitor ID for analytics (no personal data)

We do not use advertising cookies or third-party tracking cookies.

9. Security

We protect your data using industry-standard security measures:

All data in transit encrypted via HTTPS/TLS
OAuth tokens encrypted at rest with AES-256-GCM
All database queries use parameterized statements (no SQL injection risk)
Production database access restricted to application layer only

10. Children

BookInk is not directed at children under 16. We do not knowingly collect data from minors. If you believe a minor has submitted data to us, contact hello@bookink.ink and we will delete it promptly.

11. Changes to This Policy

We may update this policy to reflect product changes or legal requirements. We will notify users by email of material changes. The "Last updated" date at the top of this page always reflects the current version.

12. Contact

Questions about privacy? Write to us at hello@bookink.ink.