BEFORE LAUNCH. The operator's legal entity name and registered address are marked in brackets below and must be filled in by the owner before this policy is relied on in production.

Inkslips Privacy Policy

Operator: [Operator legal entity and registered address] ("Inkslips," "we," "us," "our"). Effective Date: October 13, 2026 Version: 2.4

This policy explains what information Inkslips collects, how we use it, who we share it with, and the choices you have. It covers the website at inkslips.com, studio booking pages, the Inkslips apps and related services (the "Service").

---

1. Who This Policy Covers

• Studios — tattoo studios and independent artists who use Inkslips, and their staff, guest artists and booth renters.
• Clients — people who book with a Studio through Inkslips.

When a Client books with a Studio, the Studio decides how it uses that Client's information for its own business, and is responsible for that use. Inkslips processes the information to run the Service for the Studio.

2. Information We Collect

2.1 Information you give us

• Account details: name, email, phone number, studio name, address and role.
• Booking details: the service, artist, date and time, notes the Client adds, and reference images the Client chooses to upload.
• Forms: consent forms, waivers and intake answers a Studio asks Clients to complete, including signatures. Some Studios ask health questions; those answers stay in the form and are shown only to the Studio.
• Payments: card payments and deposits are handled by Stripe. Inkslips receives limited details (for example the last four digits, the amount and the status), never the full card number.
• Messages: texts and emails between a Studio and its Clients sent through Inkslips, and consent records for those messages.
• Photos: photos a Studio uploads, such as healed work, stored with the Client's photo consent where the Studio records it.

2.2 Information collected automatically

Device and browser information, IP address, pages viewed, and error and performance diagnostics, used to keep the Service secure and working.

2.3 The Sumi assistant (AI) and optional microphone input

Sumi is a text-first assistant for authorized Studio owners and staff. It does not answer phone calls, listen in the background, create a voiceprint, or produce audio replies. Microphone input is optional; you can always type instead.

1. You start each recording. Inkslips does not request microphone access or start recording until you select the microphone control, read an in-product notice, select Continue, and grant your device's permission. You can select Not now, deny or revoke permission, or cancel a recording and keep typing. Each recording is limited in length and size.
2. OpenAI transcribes the recording. The recording is sent through Inkslips's authenticated transcription route to OpenAI's speech-to-text API solely to produce text. Inkslips does not intentionally store raw audio in its database, file storage, conversation history, analytics or backups; audio exists only briefly in memory and in transit while it is transcribed.
3. You review before submitting. The transcript comes back as editable text. It is not sent to any AI model until you submit it, and you can edit or clear it first.
4. Anthropic may process text after submission. Submitting the composer — by selecting Send or another displayed submit action such as Enter — instructs Inkslips to store the text you reviewed and, where an answer or plan is needed, send Anthropic a minimized or redacted version of that text, a short window of recent conversation, and the Studio context needed to answer (for example matching appointment or client-name labels with short-lived references). Inkslips screens out client health details before any provider call. If Anthropic is unavailable, the same bounded request may be sent to OpenAI as a backup provider.
5. We keep bounded records. Submitted requests, reviewed transcripts and Sumi's text replies are stored as encrypted conversation content with a 30-day expiration. A separate transcription record keeps technical details (such as account and studio linkage, file size, duration, model and status) but no audio and no transcript text.

Provider practices. OpenAI currently states that API data is not used to train its models unless the customer opts in. Anthropic's commercial terms currently state that it does not train models on commercial customer content, and that standard API inputs and outputs are deleted within 30 days, subject to its policies. Inkslips enables Sumi only after the provider account terms and data-processing addenda for the Inkslips operator are in place.

Do not record another person, or submit another person's personal or health information, unless you have authority and every notice or consent the law requires. Some places, including California, require every party's consent to record a confidential conversation.

3. How We Use Information

• to run the Service: bookings, deposits, reminders, aftercare messages, forms, payments and the Studio dashboard;
• to provide Sumi when a Studio chooses to use it;
• to keep the Service secure, prevent fraud and abuse, and fix problems;
• to send account and service notices, and, where you agreed, product news (you can unsubscribe at any time);
• to meet legal obligations.

We do not sell personal information, and we do not use Client information to advertise to Clients for other businesses.

4. Text Messaging

Studios use Inkslips to send Clients transactional text messages: booking confirmations, appointment reminders and aftercare check-ins. A Studio may also send other appointment-related messages and, where a Client separately opted in, promotional messages.

• Consent. Clients opt in by ticking the text-message box when they book: "I agree to receive text messages about my appointments and aftercare from [studio name] at this number (optional)." Consent is not a condition of booking or buying anything.
• Message frequency. Message frequency varies with your appointments.
• Cost. Message and data rates may apply, billed by your mobile carrier.
• Opt-out. Reply STOP to any message to stop. You will get one confirmation and then no more messages unless you opt in again.
• Help. Reply HELP to any message, or email support@inkslips.com.
• Carriers are not liable for delayed or undelivered messages.

Mobile information sharing. No mobile information — including phone numbers and text-message opt-in or consent — is sold, rented or shared with third parties or affiliates for their marketing. Opt-in data and consent are used only to deliver the messages you asked for.

5. How We Share Information

5.1 With Studios

If you are a Client, the Studio you book with can see your booking details, contact information, the forms you completed (including any health answers the Studio asked for), photos you consented to, and your appointment history. Each Studio is responsible for how it uses that information.

5.2 With service providers

We share information with providers that help us run the Service, only for that purpose:

| Provider | Purpose | |---|---| | Supabase | Database hosting and storage | | Clerk | Sign-in and identity | | Stripe (including Stripe Connect) | Card payments, deposits, subscriptions and Studio payouts | | Vercel | Website and app hosting | | Twilio | Text messages | | Email delivery provider | Transactional email | | Upstash | Rate limits, safety switches and AI usage limits | | Inngest | Scheduled and background jobs | | Sentry | Error monitoring | | Anthropic | Sumi answers and plans after you submit a request. Receives minimized or redacted request text and bounded Studio context; never the raw recording. | | OpenAI | Optional speech-to-text for recordings you start, and backup processing of submitted Sumi requests when Anthropic is unavailable. Inkslips does not intentionally add your name, email, phone number or account IDs to the transcription request. | | Apple | App Store distribution (iOS app only) |

Providers may change; we will update this table when they do.

5.3 Business transfers and legal requirements

If the Service is sold or merged, information may transfer to the new operator under this policy. We may disclose information when the law requires it or to protect the safety and rights of people using the Service.

6. Retention

We keep account and Studio records while the account is active and as long as needed to provide the Service and meet legal, tax and accounting obligations. Sumi conversation content expires after 30 days. Signed forms are kept as long as the Studio needs them for its own legal record-keeping, which a Studio can export.

7. Your Choices and Rights

• You can access, correct, export or delete your information from your account settings, or by emailing support@inkslips.com. A Client can also ask the Studio directly.
• Depending on where you live (for example California, Colorado, Virginia, Canada or Quebec), you may have additional rights to know, delete, correct or limit the use of your information. We honor those requests as the law requires. We do not sell or share personal information for cross-context advertising.
• You can turn off marketing email and texts at any time; service messages about your bookings continue while you have appointments.

8. Children

The Service is for people 18 and older. We do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.

9. Security

We use encryption in transit, encrypted storage for sensitive content, access controls and monitoring. No system is perfectly secure; please keep your sign-in safe and tell us about any concern.

10. International Transfers

Inkslips and its providers may process information in the United States and other countries. Where the law requires it, we rely on appropriate safeguards for those transfers.

11. Changes to This Policy

We may update this policy. For material changes we will give notice by posting the new version at inkslips.com/privacy and, where appropriate, by email or in the app. Sumi requires acceptance of the current version before it can be used.

12. Contact

Privacy questions or requests: support@inkslips.com.