Legal
Privacy Policy
1. Who we are and what this Policy covers
InkFlow is a cloud-based scheduling and studio management platform (the "Platform") developed and operated by CETEA Consulting Inc., an Ontario corporation ("Cetea", "we", "us", or "our"). This Privacy Policy explains how we collect, use, store, share, and protect personal information when you visit our website, create or use an account on the Platform, or interact with a studio through the Platform, for example by booking online or signing a waiver.
This Policy is written to comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws. Where we serve studios in other jurisdictions, we aim to handle personal information in a way consistent with the principles below. This Policy forms part of our Terms of Service.
2. Our two roles
We handle personal information in two different capacities, and your rights differ depending on which applies.
- As the organization responsible. For the personal information of studio owners and staff who hold accounts on the Platform, visitors to our website, and people who contact us, Cetea decides why and how the information is used. This Policy applies in full.
- As a service provider to studios. When a studio enters information about its customers and staff, or when a studio's customers submit information through the studio's public booking page, waiver forms, deposit payment pages, or appointment self-service links, that information belongs to the studio. The studio decides why it is collected and how it is used, and we process it only on the studio's instructions and to operate the Platform. The studio's own privacy practices and policies apply to that information in addition to Sections 7 through 10 of this Policy.
3. Information we collect
Account and studio information. When a studio signs up we collect the name, email address, and password (stored only as a hash) of each user, their role, and the studio's business name, address, phone number, business email, currency, business type, and billing address. We record the date, time, and version of the Terms of Service and Privacy Policy each user accepted.
Studio business data. Studios enter operational data into the Platform: staff schedules and availability, services and prices, locations and workstations, appointments, sales, deposits, refunds, tips, artist revenue-split rules and payout records, daily settlement counts, product and supply inventories, notification templates, and waiver templates.
Studio customer data. Studios and their customers enter information about the customers, which may include name, email address, phone number, date of birth, mailing address, appointment history, notes the studio records, deposit and payment records, and waiver responses. Waiver forms are written by each studio. Depending on what the studio asks, a completed waiver may include the customer's signature, identity details, emergency contact, and answers to questions the studio chooses to ask, which can include health-related questions. We do not require or design for health information; a studio that chooses to ask such questions is responsible for that decision and for the information it collects. Where a studio's waiver requires a parent or guardian, we collect the guardian's name and signature as well.
Payment information. Payments, whether a studio's subscription to InkFlow or a customer's deposit to a studio, are processed by Stripe. Card numbers are entered directly on Stripe-hosted pages and are never sent to or stored by us. We receive and store transaction records such as amounts, dates, currency, status, the last four digits or brand of a card, and Stripe's identifiers for customers, payments, and subscriptions.
Technical and usage data. When you use the website or Platform, our servers and service providers automatically record information such as your IP address, browser type and version, device type, operating system, pages and features accessed, timestamps, referring URLs, and error and diagnostic information. Our error-monitoring service captures technical details of application errors, including the page you were on and the sequence of actions leading to the error, but is configured not to collect your IP address or other identifying information by default.
Email delivery data. When the Platform sends an email on a studio's behalf, such as a booking confirmation, reminder, deposit request, or waiver link, our email provider records the recipient address and delivery events such as sent, delivered, bounced, or marked as spam.
Communications. If you contact us by email, book a demo, or send feedback, we keep the correspondence and any information you include in it.
4. How we use information
We use personal information to:
- create and administer accounts, authenticate users, and enforce role-based access;
- provide the Platform's features: scheduling, online booking, deposits and checkout, waivers, notifications, settlements, payouts, and reporting;
- send transactional emails on studios' behalf and account-related emails from us, such as sign-up confirmation, password reset, billing notices, and notices of changes to the Platform or these terms;
- bill studios for their subscription and manage payment failures;
- respond to support requests and communicate with you about the Platform;
- monitor, secure, troubleshoot, and improve the Platform, including detecting abuse, rate-limiting, and diagnosing errors;
- produce anonymized, aggregated statistics about how the Platform is used;
- comply with legal obligations and enforce our Terms of Service.
We do not sell personal information, do not use it for advertising, and do not use automated decision-making that has legal or similarly significant effects on individuals.
5. Consent
By creating an account or using the Platform, you consent to the collection, use, and disclosure of your personal information as described in this Policy. Where a studio collects information from its customers through the Platform, the studio is responsible for obtaining the consents required by law for that collection and for the email notifications the studio sends. You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice, by contacting us or the relevant studio; withdrawing consent may mean we or the studio can no longer provide the service to you.
6. Cookies and browser storage
The Platform uses browser storage (including cookies and local storage) only for what is strictly necessary to run the application: keeping you signed in, remembering interface preferences such as the calendar view and filters you last used, and protecting against misuse. Our content delivery and hosting providers may set technical cookies for security and performance. We do not use advertising cookies, third-party analytics trackers, or cross-site tracking on either the website or the Platform. Disabling cookies in your browser will prevent you from signing in to the Platform.
7. How we share information
We share personal information only in the following circumstances:
- With the studio you interact with. If you are a customer of a studio, the information you submit is shared with that studio and its authorized staff. If you are a member of a studio's staff, your name, role, and schedule are visible to other staff of that studio.
- With service providers. We use third-party companies to host and operate the Platform. They process information only to provide their services to us. The providers in use as of the effective date of this Policy are:
We may add, replace, or remove providers as the Platform evolves and will update this table when we do.
Provider Purpose Location of processing Supabase, Inc. Database, authentication, file storage, and server-side functions United States Google LLC (Google Cloud) Application hosting and infrastructure monitoring United States (application); Canada (build artifacts) Cloudflare, Inc. DNS, content delivery, traffic protection, and hosting of this website Global network; traffic is routed through the nearest edge location Stripe, Inc. Subscription billing for studios and payment processing for studios' customers United States Mailjet (Sinch) Transactional email delivery European Union Functional Software, Inc. (Sentry) Application error monitoring United States - For legal reasons. We may disclose information if we believe in good faith that it is required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Cetea, our users, or the public.
- Business transfers. If Cetea is involved in a merger, acquisition, financing, reorganization, or sale of assets, personal information may be transferred as part of that transaction, subject to this Policy.
- With your consent or at your direction.
8. Where data is stored and international transfers
Cetea is located in Toronto, Ontario, Canada. As shown in the table above, the Platform and the data in it are hosted by third-party providers primarily in the United States, with email delivered from the European Union and content delivery handled across a global network. This means personal information is transferred to, stored in, and processed outside Canada, and may be outside the country where you or your studio are located. While it is in another jurisdiction, it may be accessible to the courts, law enforcement, and national security authorities of that jurisdiction under its laws.
We choose providers that publish security and privacy commitments and that are contractually bound to protect the information they process for us. However, we cannot guarantee how any third party will act, and we make no representation that the protection afforded in another jurisdiction is equivalent to Canadian law. Storage locations may change without notice as we change providers or regions.
9. Retention
We keep personal information for as long as needed for the purposes described in this Policy, which generally means for as long as the relevant studio maintains its subscription. After a studio's subscription ends, we make reasonable efforts to keep its data available for export for 30 days and may delete it after that. We may retain some information for longer where required for legal, tax, accounting, or dispute-resolution purposes, such as billing records, and we may retain anonymized or aggregated data indefinitely. Logs and error reports held by our monitoring providers are retained on those providers' rolling retention schedules, typically 90 days or less.
Please note that we make no guarantee that any data will be retained for any period. Studios are required by our Terms of Service to keep their own exports of important data.
10. Security
We use safeguards that are reasonable for a business of our size and the nature of the information, including encrypted connections, hashed passwords, role-based access controls, tenant isolation in our database, and access limited to the people who need it. Our providers maintain their own physical and technical security programs.
No method of transmission or storage is completely secure. We cannot guarantee, and do not promise, that personal information will not be accessed, disclosed, altered, lost, or destroyed as a result of a breach of our safeguards or those of our providers. If we become aware of a breach of security safeguards involving personal information under our control that creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as required by law, and will notify the affected studio so that it can meet its own obligations.
11. Your rights and choices
Subject to applicable law, you may ask to access the personal information we hold about you, to have it corrected if it is inaccurate or incomplete, or to have it deleted. You may also ask how we have used or disclosed it. To make a request, contact us at the address in Section 15. We will respond within the time required by law, and may need to verify your identity first. In some cases we may be unable to fulfil a request, for example where the information must be retained for legal reasons or where doing so would reveal information about another person; we will explain why.
Studio staff can update their own name and email address inside the Platform. Studio owners and admins can manage the details of their staff and customers directly.
You may opt out of any non-essential email from Cetea by using the unsubscribe link in the message or by contacting us. We will still send emails that are necessary to operate your account, such as security and billing notices. Emails sent by a studio through the Platform are the studio's messages, and you should direct opt-out requests for them to the studio.
You may also complain to the Office of the Privacy Commissioner of Canada or your provincial privacy regulator about our handling of your personal information.
12. If you are a customer of a studio
If you booked an appointment, paid a deposit, or signed a waiver with a tattoo, piercing, or other studio that uses InkFlow, that studio collected your information and is the organization responsible for it under privacy law. We store and process it on the studio's behalf. Please direct questions, and requests to access, correct, or delete your information, to the studio first. If you contact us instead, we will normally refer your request to the studio and help it respond, because in most cases we are not permitted to act on the studio's data without its instructions.
13. Children
The Platform is a business tool and accounts may be held only by people who are at least 18 years old. Studios may, at their own discretion and in accordance with the law that applies to them, record information about minors as customers, for example where a parent or guardian signs a waiver on a minor's behalf. In those cases the studio is responsible for obtaining the appropriate consent. We do not knowingly collect personal information directly from children under 13. If you believe we have done so, contact us and we will delete it.
14. Changes to this Policy
We may update this Policy from time to time. When we do, we will post the revised version at this address and update the effective date and version number. For material changes we will make reasonable efforts to notify studio owners by email or a notice in the Platform before the change takes effect. Your continued use of the website or Platform after the effective date means you accept the revised Policy.
15. Contact
Questions, requests, or complaints about this Policy or our handling of personal information can be sent to our privacy contact:
CETEA Consulting Inc.
Attention: Privacy Officer
Toronto, Ontario, Canada
Email: [email protected]