Privacy Policy

INK.D (operated by InkDeposit SA (Pty) Ltd, South Africa) takes your privacy seriously. This policy explains what information we collect, how we use it, who we share it with, and your rights under the Protection of Personal Information Act 4 of 2013 (POPIA).

1. Information We Collect

We collect the following categories of personal information:

• —Identity: Full name, email address, WhatsApp number, date of birth (age verification)
• —Booking information: Tattoo description, placement, size estimate, session notes, booking reference numbers
• —Artist profiles: Bio, portfolio images, studio name, physical address, working hours, commission tier
• —Location data: If an artist provides their studio address via address autocomplete, we store its geographic coordinates (latitude/longitude) to show the studio on a map and enable "nearby artists" search. If you grant location permission as a client to find nearby artists, your device's coordinates are used only to center the search map and are not stored on our servers.
• —Financial: Deposit amounts, payout records, transaction references. Card and banking details are processed by PayFast — we never see or store them.
• —Device & usage: IP address, browser type, device identifier, pages visited, features used, referring URL
• —Communications: Messages sent through the platform, WhatsApp contact details shared between artist and client
• —Design uploads (InkScan): Images uploaded for AI design analysis. See Section 8 for details.

2. How We Use Your Information

• —Processing bookings and facilitating deposits between artists and clients
• —Sending booking confirmations, reminders, and status update notifications
• —Verifying artist identities and maintaining platform integrity
• —Calculating and processing artist payouts and commission deductions
• —Operating InkScan AI design analysis feature
• —Improving the platform based on aggregated usage patterns
• —Complying with legal obligations under South African law, including tax and financial record-keeping requirements
• —Sending service-related communications (you cannot opt out of transactional messages)
• —Sending marketing communications (only if you have opted in — you can unsubscribe at any time)
• —Detecting and preventing fraud, spam, and platform abuse

3. How We Share Your Information

We do not sell your personal information. We share data only in these circumstances:

• —Artist ↔ Client: When a booking is confirmed, limited contact information is shared (name, WhatsApp number) to facilitate the session. This is necessary for the service to function.
• —PayFast (Pty) Ltd: Payment processing only. See payfast.io for their privacy policy and terms.
• —OpenAI: When you use InkScan, your uploaded design image is transmitted to OpenAI's API for processing. OpenAI processes this data in accordance with their privacy policy and data usage policies. Images are not used to train OpenAI models.
• —Resend: Transactional email delivery (booking confirmations, password resets, platform notifications).
• —Supabase: Our database and authentication infrastructure provider. Data is hosted on Supabase servers with encryption at rest and in transit.
• —Google Maps Platform: Used to display studio locations and the artist discovery map. If you use these features, Google Maps Platform receives the map coordinates and, if you grant permission, your approximate device location, subject to Google's own privacy policy.
• —Legal obligations: If required by South African law, court order, or regulatory authority (including the Information Regulator, SARS, or law enforcement).

4. Data Retention

We retain your data for as long as necessary to provide our services and comply with legal obligations:

• —Account data: retained while your account is active and for 2 years after account deletion
• —Booking records: retained for 5 years for financial compliance and dispute resolution purposes
• —Payment and payout records: retained for 7 years as required by South African Tax Administration Act
• —Design upload images (InkScan): deleted automatically within 24 hours of analysis completion
• —Marketing opt-out records: retained indefinitely to honour your preferences
• —Audit logs: retained for 3 years

Upon account deletion, we will anonymise or delete your personal information as described above, except where retention is required by law.

5. Your Rights Under POPIA

As a South African resident, you have the following rights:

• —Right of access: request a copy of the personal information we hold about you
• —Right to correction: request correction of inaccurate or incomplete information
• —Right to deletion: request deletion of your personal information (subject to legal retention requirements)
• —Right to object: object to the processing of your personal information
• —Right to data portability: receive your data in a structured, commonly used format
• —Right to complain: lodge a complaint with the Information Regulator of South Africa at inforeg@justice.gov.za or 012 406 4818

To exercise any of these rights, contact our Information Officer at dpo@inkdeposit.com. We will respond within 30 days as required by POPIA. For step-by-step instructions on deleting your account and data specifically, see our Data Deletion page.

6. Information Officer

Our designated Information Officer under POPIA is responsible for overseeing data protection compliance. Contact: dpo@inkdeposit.com

7. Security

We implement the following security measures:

• —TLS 1.2+ encryption for all data in transit
• —AES-256 encryption for data at rest in our database
• —Role-based access controls for staff access to user data
• —Regular security reviews and penetration testing
• —Supabase Auth for secure credential management
• —Rate limiting on authentication endpoints to prevent brute-force attacks

8. InkScan & AI Design Analysis

When you use InkScan, you upload an image of a tattoo design. This image is transmitted to OpenAI's GPT-4o model for analysis.

• —Images uploaded for InkScan analysis are transmitted securely to OpenAI's API
• —Uploaded images are not stored on INK.D servers after analysis is complete
• —OpenAI does not use images submitted via the InkScan API to train its models
• —We do not share your uploaded images with artists, clients, or any other third parties
• —Design images used for InkScan are retained by OpenAI in accordance with OpenAI's data policy
• —If you are uncomfortable with OpenAI processing your design images, do not use InkScan
• —You may request deletion of any data processed by OpenAI by contacting OpenAI directly

9. Cookies & Tracking

We use a small number of essential and functional cookies — no advertising cookies or third-party tracking pixels. See our full Cookie Policy for the complete list of cookies, their purpose, and how to control them in your browser.

10. Third-Party Links

Our platform may link to artist social media profiles (Instagram, WhatsApp), external portfolio sites, and third-party payment pages. We are not responsible for the privacy practices or content of these external sites.

11. Children's Privacy

INK.D is strictly for users aged 18 and over. We do not knowingly collect information from minors. Age verification occurs at registration. If you believe a minor has registered using false information, contact us immediately at dpo@inkdeposit.com.

12. International Data Transfers

Some of our service providers (OpenAI, Resend) may process data outside South Africa. We ensure that any international data transfer is conducted in accordance with POPIA Chapter 8 and any applicable data protection laws.

13. Changes to This Policy

We will notify you of material changes to this policy via email at least 14 days before they take effect. The "Effective" date at the top of this page reflects the current version.

14. Complaints

If you are unhappy with how we have handled your personal information, you have the right to complain directly to us at dpo@inkdeposit.com, or to the Information Regulator:

• —Email: inforeg@justice.gov.za
• —Phone: 012 406 4818
• —Post: Information Regulator, P.O. Box 31533, Braamfontein, Johannesburg 2017