Privacy Policy

• AccountEmail address (also used for sign-in links), handle, display name, Instagram handle, bio, city, styles, timezone.
• Business settingsDeposit type and amount, the payment handle clients should pay (Venmo, Cash App or PayPal), whether bookings are open, which weekdays you take bookings, your custom booking questions, your cancellation policy text, hourly rate, and the US state you work in (used to apply state rules for minors).
• Content you uploadProfile photo, portfolio images, guest-spot listings.
• BillingSubscription status and trial end date, plus the customer and subscription identifiers returned by our payment providers (Lemon Squeezy or PayPal). We never see or store your card or bank details — those stay with the provider.
• Private linksA calendar token that powers your private calendar feed, and an optional Instagram DM automation key if you connect that integration.

Clients do not create accounts. Everything below arrives through the artist’s booking page and is attached to a single booking, which the client can reopen with a private link.

• Booking requestName, email, optional phone number, tattoo style, placement, size, a free-text description, reference images and links, and the answers you give to the artist’s own questions. The artist can write any questions they like — if you type health details there, they are stored with the request.
• Health questionnaireBefore confirming, clients answer ten health questions (age, pregnancy or breastfeeding, blood-thinning medication, alcohol in the last 24 hours, allergies to latex, metals or pigment, skin conditions at the site, diabetes, heart conditions, immune disorders, keloid tendency) plus a free-text box for anything else the artist should know — which people often use for medication names or allergy details. Patch-test results (whether a test was done, when, where, the result and the pigment brand) are recorded the same way.
• Identity and ageDate of birth, a photo of a government-issued ID, and optionally a selfie used to compare against that ID. For clients under 18, the guardian’s name, relationship and signature.
• Consent signatureThe name you type as your signature, the time you signed, and the IP address and browser user-agent recorded at signing. Keep this in mind if you are signing from a shared or public network, since the IP address identifies the connection you used.
• DepositThe payment reference you enter (transaction ID, note, or last four digits) and a screenshot if you upload one. You pay the artist directly — see “Where your money goes” below.
• After the sessionHealed photos if you send them, reschedule requests, and the rating and comment if you leave a review.

The health questionnaire, patch-test records, date of birth and ID documents are the most sensitive data in the product. They exist for one purpose: so the artist can decide whether it is safe to tattoo you, and so they can show a health inspector what was checked.

ID photos, selfies and payment screenshots are kept in private storage buckets. Access is limited to the artist of that specific booking, and the files are only readable through time-limited links. They are never listed publicly.

Artists using Deposink may have their own legal obligations over this information — for example health-record rules in their state or country. Deposink provides the tool; the artist is the one responsible for their own records and notices to their clients.

Some data is public by design, because the whole point is that clients can check an artist before paying. Anyone can see:

• Your artist profile: handle, display name, Instagram handle, bio, city, styles, deposit amount and the payment handle clients pay to, hourly rate, policy text, availability, state, profile photo, portfolio and guest spots.
• Reviews, including the client name the reviewer entered alongside the rating and comment.
• The refund record on an artist’s booking page — how many deposits were refunded and how many disputes are unresolved.
• Reference images and healed photos are stored in a public bucket. Anyone who has the link can open them, and links can be shared or indexed. Do not upload anything you would not want a stranger to see. ID photos, selfies and payment screenshots are not in this bucket.
• If an artist shares their calendar feed link, anyone holding that link can read the appointment details in it (client names, styles, placements, times, deposit status).

We use a small number of service providers. They act on our instructions and are not allowed to use the data for their own purposes.

Because these providers operate in different countries, your data may be stored or processed outside the country you live in, including in the United States and China. We also disclose data if the law requires it, or to protect someone from harm.

When an artist marks a booking as a no-show, Deposink keeps a count against the client’s email address. That count is visible to other artists on Deposink when the same client requests a booking, so they can decide how much deposit to ask for. We tell you this plainly because it is unusual: your email address and your no-show count are shared between artists. Notes, reviews and everything else stay with the artist who collected them.

We set the cookies needed to keep an artist signed in. There are no advertising cookies, no third-party analytics and no tracking pixels. We count page views and which link brought a visitor to a booking page in our own database, without a third-party service.

We do not delete booking records automatically. A booking, including its health answers, consent signature and ID documents, stays until someone asks us to remove it — either the artist or the client. Health-related booking records are kept for no more than six years, and we will delete them earlier if you ask and the artist has no outstanding legal reason to keep them.

To ask us to delete a booking, an account, or an uploaded file, email hello@deposink.com. Deletion is handled by hand, so allow us a few days; we will confirm when it is done. If you are a client, we may tell the artist that you asked, since the record is part of their business.

Row-level security rules in the database mean an artist can only read their own bookings, and a client only their own through the private link. Identity documents and payment screenshots live in private storage. Still, no system is perfect — treat your booking link like a password, because anyone who has it can open your booking.

Deposink is for adults. Clients must be 18 or over, or book with the consent of a parent or guardian, whose name and signature are recorded. Some US states do not allow minors to be tattooed at all, and the booking flow blocks those requests.

If this policy changes in a way that matters, we will update the date at the top and, for significant changes, email artists. Questions, access requests and deletion requests all go to hello@deposink.com.