Privacy Policy

This Privacy Policy explains how [legal entity, e.g. Inklet Inc.] (“Inklet,” “we,” “us”) collects, uses, and shares personal information when you use inklet.xyz and related services (the “Service”). It should be read alongside our Terms of Service.

1. Information we collect

• Account information. When you sign up with Google or by email, we receive your email address and, where provided, your name and profile photo.
• Profile information. Details you add — display name, handle, bio, styles, location, links, avatar, and portfolio images (for artists and shops). Profiles and portfolios are generally public.
• Booking and message content. Requests, appointment details, reference images, and messages exchanged between clients and artists.
• Payment information. Payments are processed by Stripe. We receive limited transaction data (such as amounts, status, and payout state) but do not store your full card details.
• Location data. Location text you provide is geocoded (via Mapbox) into coordinates to power nearby search and maps.
• Technical and usage data. Device, browser, and log information, and cookies or similar technologies used to keep you signed in and to operate the Service.
• Invitation details. If someone reserves a profile for an artist, we process the name, email, and factual details provided to send a one-time claim invitation.

2. How we use information

• to provide, maintain, and improve the Service;
• to enable discovery, bookings, deposits, payments, payouts, and messaging;
• to send transactional communications (booking updates, notifications, claim invitations) and, where permitted, service updates;
• to keep the Service safe, prevent fraud and abuse, and enforce our Terms;
• to comply with legal obligations.

3. Legal bases (where applicable)

Where required (for example, under the GDPR), we rely on: performance of a contract (to provide the Service you request), our legitimate interests (to operate, secure, and improve the Service), your consent (where we ask for it), and compliance with legal obligations.

4. How we share information

We do not sell your personal information. We share it with service providers that process data on our behalf, under contract:

• Stripe — payment processing and payouts;
• Supabase — database, authentication, and file storage;
• Vercel — application hosting;
• Resend — transactional email delivery;
• Mapbox — mapping and geocoding;
• Google — sign-in.

We may also share information to comply with law, to protect rights and safety, or in connection with a merger, acquisition, or sale of assets. Public parts of your profile (name, handle, portfolio) are visible to anyone.

5. Data retention

We keep personal information for as long as your account is active or as needed to provide the Service, then retain and delete it in line with our legal obligations and legitimate business needs. Reserved-profile invitation details are kept until the invite is claimed, revoked, deleted, or expires.

6. Security

We use technical and organizational measures to protect personal information, including row-level access controls, encryption in transit, and hashing of sensitive tokens. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Your rights and choices

Depending on your location, you may have rights to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to withdraw consent. You can edit much of your information in your account settings, or contact us to exercise these rights. Residents of the EEA/UK (GDPR) and California (CCPA/CPRA) may have additional rights, including the right not to receive discriminatory treatment for exercising them.

8. Cookies

We use cookies and similar technologies that are necessary to sign you in and keep the Service working, and may use others to understand usage. You can control cookies through your browser, though some features may not work without them.

9. Children

The Service is not directed to, and may not be used by, anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

10. International transfers

We and our service providers may process information in countries other than yours. Where required, we use appropriate safeguards for such transfers. [Confirm transfer mechanisms with counsel if you serve EEA/UK users.]

11. Changes to this policy

We may update this Privacy Policy from time to time. We will post changes here with a new “Last updated” date and, where appropriate, provide additional notice.

12. Contact

For privacy questions or requests, contact us at privacy@inklet.xyz. [Add a postal address and, if required, an EU/UK representative or Data Protection Officer.]