Privacy Policy

Ink Deposit (operated by InkDeposit SA (Pty) Ltd, South Africa) takes your privacy seriously. This policy explains what information we collect, how we use it, who we share it with, and your rights under the Protection of Personal Information Act 4 of 2013 (POPIA).

1. Information We Collect

We collect the following categories of personal information:

• —Identity: Full name, email address, WhatsApp number, date of birth (age verification)
• —Booking information: Tattoo description, placement, size estimate, session notes, booking reference numbers
• —Artist profiles: Bio, portfolio images, studio name, physical address, working hours, commission tier
• —Location data: If an artist provides their studio address via address autocomplete, we store its geographic coordinates (latitude/longitude) to show the studio on a map and enable "nearby artists" search. If you grant location permission as a client to find nearby artists, your device's coordinates are used only to center the search map and are not stored on our servers.
• —Financial: Deposit amounts, payout records, transaction references. Card and banking details are processed by PayFast — we never see or store them.
• —Device & usage: IP address, browser type, device identifier, pages visited, features used, referring URL
• —Communications: Messages sent through the platform, WhatsApp contact details shared between artist and client

2. How We Use Your Information

• —Processing bookings and facilitating deposits between artists and clients
• —Sending booking confirmations, reminders, and status update notifications
• —Verifying artist identities and maintaining platform integrity
• —Calculating and processing artist payouts and commission deductions
• —Improving the platform based on aggregated usage patterns
• —Complying with legal obligations under South African law, including tax and financial record-keeping requirements
• —Sending service-related communications (you cannot opt out of transactional messages)
• —Sending marketing communications (only if you have opted in — you can unsubscribe at any time)
• —Detecting and preventing fraud, spam, and platform abuse

3. How We Share Your Information

We do not sell your personal information. We share data only in these circumstances:

• —Artist ↔ Client: When a booking is confirmed, limited contact information is shared (name, WhatsApp number) to facilitate the session. This is necessary for the service to function.
• —PayFast (Pty) Ltd: Payment processing only. See payfast.io for their privacy policy and terms.
• —Resend: Transactional email delivery (booking confirmations, password resets, platform notifications).
• —Supabase: Our database and authentication infrastructure provider. Data is hosted on Supabase servers with encryption at rest and in transit.
• —OpenStreetMap: Our maps are drawn with OpenStreetMap tiles rather than a commercial mapping service. Opening a map requests tiles from openstreetmap.org, which receives the map area being viewed. Artist address lookup uses the same project’s Nominatim search service. We do not request your device location.
• —api.qrserver.com: Generates the QR code shown on a booking confirmation. It receives the booking reference and nothing else.
• —Google (only if you tap through): An artist may publish a link to their studio’s Google Maps listing so you can see its photos, hours and reviews. This is an ordinary link — we send Google nothing, and the link is marked so Google is not told which profile you came from. If you follow it you are on Google’s site under Google’s privacy policy.
• —Sentry (EU region): Error and performance monitoring. When something breaks, a diagnostic report is sent — which can include your IP address, the page you were on and the technical error — so we can fix it. Hosted in the EU.
• —Vercel: Hosting and content delivery. Requests to the site pass through Vercel infrastructure, which processes connection data such as IP address in order to serve the page.
• —Legal obligations: If required by South African law, court order, or regulatory authority (including the Information Regulator, SARS, or law enforcement).

4. Data Retention

We retain your data for as long as necessary to provide our services and comply with legal obligations:

• —Account data: retained while your account is active and for 2 years after account deletion
• —Booking records: retained for 5 years for financial compliance and dispute resolution purposes
• —Payment and payout records: retained for 7 years as required by South African Tax Administration Act
• —Marketing opt-out records: retained indefinitely to honour your preferences
• —Audit logs: retained for 3 years

Upon account deletion, we will anonymise or delete your personal information as described above, except where retention is required by law.

5. Your Rights Under POPIA

As a South African resident, you have the following rights:

• —Right of access: request a copy of the personal information we hold about you
• —Right to correction: request correction of inaccurate or incomplete information
• —Right to deletion: request deletion of your personal information (subject to legal retention requirements)
• —Right to object: object to the processing of your personal information
• —Right to data portability: receive your data in a structured, commonly used format
• —Right to complain: lodge a complaint with the Information Regulator of South Africa at inforeg@justice.gov.za or 012 406 4818

To exercise any of these rights, contact our Information Officer at dpo@inkdeposit.com. We will respond within 30 days as required by POPIA. For step-by-step instructions on deleting your account and data specifically, see our Data Deletion page.

6. Information Officer

Our designated Information Officer under POPIA is responsible for overseeing data protection compliance. Contact: dpo@inkdeposit.com

7. Security

We implement the following security measures:

• —TLS 1.2+ encryption for all data in transit
• —AES-256 encryption for data at rest in our database
• —Role-based access controls for staff access to user data
• —Regular security reviews and penetration testing
• —Supabase Auth for secure credential management
• —Rate limiting on authentication endpoints to prevent brute-force attacks

8. Cookies & Tracking

We use a small number of essential and functional cookies — no advertising cookies or third-party tracking pixels. See our full Cookie Policy for the complete list of cookies, their purpose, and how to control them in your browser.

9. Third-Party Links

Our platform may link to artist social media profiles (Instagram, WhatsApp), external portfolio sites, and third-party payment pages. We are not responsible for the privacy practices or content of these external sites.

10. Children's Privacy

Ink Deposit is strictly for users aged 18 and over. We do not knowingly collect information from minors. Age verification occurs at registration. If you believe a minor has registered using false information, contact us immediately at dpo@inkdeposit.com.

11. International Data Transfers

Some of our service providers (Resend) may process data outside South Africa. We ensure that any international data transfer is conducted in accordance with POPIA Chapter 8 and any applicable data protection laws.

12. Changes to This Policy

We will notify you of material changes to this policy via email at least 14 days before they take effect. The "Effective" date at the top of this page reflects the current version.

13. Complaints

If you are unhappy with how we have handled your personal information, you have the right to complain directly to us at dpo@inkdeposit.com, or to the Information Regulator:

• —Email: inforeg@justice.gov.za
• —Phone: 012 406 4818
• —Post: Information Regulator, P.O. Box 31533, Braamfontein, Johannesburg 2017