Privacy Policy

What SyncTattoo is today

This website (synctattoo.com) is the presentation and waitlist page for SyncTattoo, a management system for tattoo artists and studios. The management application (app.synctattoo.com) is available to studios using it in early access. This policy explains how we process the data of people who visit this website, join the waitlist or ask us for information. The section "SyncTattoo as data processor" explains what we do with the data studios store about their clients in the application.

What data we collect

The only form on this website is the waitlist form, which comes in three versions (short, full and studio). Depending on the version, it collects:

• Email (required in every version): we store it as a contact with our email provider, Resend, in the waitlist for artists or the one for studios.
• Number of artists (required in the full and studio versions), studio name (required in the studio version) and what you use today to manage your bookings (required in the full version).
• City (optional, in the full version) and whether you want to give feedback during the beta (optional checkbox, in the full version).
• Where this data ends up: the number of artists, city, studio name and the tool you use today are not stored in your Resend contact, but they are used to personalize the welcome email, which we send through Resend. In addition, all the form data reaches us in an internal notification email to hola@synctattoo.com, where it is kept for the periods set out in "Data retention".

What we use your data for

• Waitlist: sending you the welcome email, letting you know when you get access to SyncTattoo and writing to you occasionally about the launch and early access. The legal basis is taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR).
• Following up on your request: if you ask us for information or sign up for the trial of the application, we follow up on that request commercially (see "Following up on requests (Attio)"). We never cold-contact anyone who has not asked us to.
• Commercial communications (news, offers, newsletter): we only send them to people who have expressly accepted them through a dedicated checkbox, separate from joining the waitlist and never pre-ticked, and who have then confirmed it through the link we email them (double opt-in). The legal basis is your consent (Art. 6(1)(a) GDPR and Art. 21 of the Spanish LSSI). Joining the waitlist does not mean accepting commercial communications. You can withdraw your consent at any time through the unsubscribe link in each email or by writing to us.
• We do not use your data for advertising or share it with third parties for commercial purposes.

Following up on requests (Attio)

To follow up on the studios and artists who ask us for information or sign up for the trial of the application, we use Attio, a sales CRM provided by Attio Ltd (United Kingdom), which acts as a data processor.

• What data: name, email, studio name, city, number of artists, the tool you use today, where you came to us from (the link's source and UTM campaign) and, if you have already signed up for the application, a pseudonymous identifier of your studio.
• What for: answering your request, helping you get started with the trial and knowing where each conversation stands. We do not use it to prospect people who have not written to us.
• Legal basis: taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in following up on a request you made to us (Art. 6(1)(f) GDPR). You can object at any time by writing to us.
• Transfer: Attio may host the data outside the European Economic Area (see "International transfers").

Cookies

This landing page does not use analytics or advertising cookies. We have not detected any tracking-cookie usage in the site's current code.

Third parties we share data with

We work with providers who process data on our behalf:

Data retention

We keep your email on the waitlist until the product launches or until you request removal, whichever comes first. The internal notifications with the form data are kept for the same period and deleted at the same time. If you accepted commercial communications, we keep your email for that purpose until you withdraw your consent, together with the record of when you gave and confirmed it. If you withdraw your consent, that record is kept blocked for 3 years, the limitation period for data protection infringements (art. 78 LOPDGDD), only so we can prove it in case of a complaint, and then erased. Sales follow-up data in Attio is kept while you remain interested and for no more than 12 months after you last confirmed your interest (a reply, a call or using the trial). After that, or earlier if you object or ask for erasure, we delete it. If you object, we keep only your email on an internal suppression list so we never contact you again. If you sign up for SyncTattoo, your data is then governed by the account retention periods described below.

Your rights (GDPR / LOPDGDD)

You may exercise your rights of access, rectification, erasure, objection, restriction of processing, and data portability at any time by writing to the contact address below. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) if you believe the processing of your data does not comply with the regulations.

International transfers

Resend and Vercel may process data outside the European Economic Area. When this happens, they rely on standard contractual clauses or other transfer mechanisms recognized under GDPR. Attio is a UK company and does not guarantee that data is hosted in the European Union: the transfer to the United Kingdom relies on the European Commission's adequacy decision, and any onward transfer from there to other countries (for example, to its own providers) relies on standard contractual clauses.

Minors

This website is not directed at minors under 16 and we do not knowingly collect data from minors.

Security

This website is served exclusively over HTTPS. This website has no user accounts or passwords, so it stores no access credentials that could be leaked.

SyncTattoo as data processor (studios' clients' data)

Studios and tattoo artists using the SyncTattoo application store data about their own clients in it: contact details, appointments, projects, payments, which other client of the studio referred them and, if the studio chooses, date of birth. Each studio is the controller of its clients' data and is responsible for informing them and handling their rights. SyncTattoo acts as data processor (Art. 28 GDPR): we process that data only to provide the service to the studio, on its instructions and under the data processing agreement included in the terms of service. We do not use it for our own purposes, we do not disclose it to third parties except the technical providers needed to provide the service (sub-processors), and we do not use it for advertising.

Date of birth. This field is optional and is used for two purposes:

• Checking legal age. The application tells the studio when a client is a minor, so it can obtain authorisation from the client's parent or legal guardian before booking, taking a deposit or tattooing. The legal basis is taking pre-contractual steps and performing the contract with the client (Art. 6(1)(b) GDPR) and, where regional law requires it, compliance with a legal obligation (Art. 6(1)(c) GDPR).
• Birthday reminders. This is an internal reminder for the studio itself. The legal basis is the studio's legitimate interest in maintaining the relationship with its client (Art. 6(1)(f) GDPR). The client may object at any time. If the studio wants to send birthday greetings with offers or promotions, it needs the client's consent.

The application only shows what is needed: the "Minor" notice and the day and month of the birthday. The date of birth is erased when the studio deletes the client or stops using SyncTattoo, and disappears from backups when the backups containing it expire.

Calendar import. Each tattoo artist can bring their own appointments into their SyncTattoo agenda from Google Calendar (with read-only access) or from an .ics file or link. Those appointments usually contain data about their clients, so the studio remains the controller and SyncTattoo the processor:

• What we read: only the events from the calendars and the date range the artist chooses (title, description, date, time and duration), once and only when they ask for it.
• What for: moving those appointments, their clients, projects and absences into their SyncTattoo agenda. Nothing is saved in the studio's data until the artist reviews the events and confirms the import, and they can undo it for 30 days.
• Classification with artificial intelligence: to tell appointments, absences and other events apart and extract their details, we send the title and a trimmed excerpt of the description of each event to Mistral AI (a company based in France, in the European Union), which acts as a sub-processor. Before sending them, we replace with placeholders phone numbers, emails and Instagram usernames (written with «@» or in the usual username format), delete DNI or NIE numbers, remove the sentences that mention health information and hide the names of children under 14. The rest of the event's text, such as first names, is sent as written. Mistral AI processes this data only to return the classification to us, under its data processing agreement, and does not use it to train its models: we have that option turned off.
• What we do not keep: neither the .ics file, nor the link, nor the access permission (token) to Google Calendar.
• How long we keep it: the events read are kept separately while the artist reviews them. If the import is not confirmed, they are deleted after 7 days. If it is confirmed, the appointments become normal studio data and, once the 30 days to undo it are over, we delete the original text and the masked text of the imported events.
• Learning within the studio: when the artist corrects a classification, we keep the already masked text of that event and the correction (at most the latest 500 per studio, without free-text notes or names of minors) to get the next imports of that same studio right. It is not shared with other studios or used to train general artificial intelligence models.
• Technical import metrics: so that importing takes less time and costs less, we record how long each step takes, how many events there are and of what type, how many questions and corrections are needed, the cost of the classification and the type of device, system and browser (not the full browser identification). They do not include the contents of the events or client data. We send them to PostHog (servers in the European Union) with a pseudonymous studio identifier, without cookies and without creating a person profile, on the basis of our legitimate interest in improving the service (art. 6.1.f GDPR).

We use these sub-processors to provide the application. They may process data outside the European Economic Area and, when they do, they rely on standard contractual clauses or other transfer mechanisms recognised by the GDPR:

• Convex: the application's database and server.
• Clerk: sign-in for studio users.
• Vercel: hosting of the application.
• PostHog (servers in the EU): usage analytics, session recordings with all text hidden and application errors, only for users who accept it; and the technical metrics of the calendar import, without personal data.
• Mistral AI (France, EU): classification of the events' text, already masked and without health information, when an artist imports their calendar.

If you are a studio's client and wish to exercise your rights (access, rectification, erasure, objection, restriction or portability), please contact the studio. If you write to us, we will forward your request to the studio and help it respond. You may also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

App accounts and Sign in with Google

To use the application (app.synctattoo.com), each tattoo artist or studio creates an account. SyncTattoo is the data controller for that account data. You can sign up with email and password or with your Google account.

What data we receive from Google. If you choose "Continue with Google", Google shares with us, with your permission, only your basic profile data: first and last name, (verified) email address and profile picture. We do not request access to your Gmail, Drive, contacts or any other Google data or service, and we never receive your Google password. Only if you decide to import your calendar from Google Calendar do we also ask for read-only permission to see the list of your calendars and their events (see "Calendar import" in the previous section).

• What we use it for: creating your account and signing you in, filling in your name when you set up your studio, and showing your name and picture inside the application to the people in your studio. The legal basis is the performance of the service agreement (Art. 6(1)(b) GDPR).
• Who we share it with: only the technical providers that run the service (Clerk, which handles sign-in; Convex, the database; Vercel, hosting; only if you accept analytics, PostHog; and, only for product news, Resend). We do not sell it, do not disclose it to third parties for commercial purposes, and do not use it for advertising or to train artificial intelligence models.
• How you heard about us: when you set up your studio we ask, optionally, how you heard about SyncTattoo (for example Instagram, another tattoo artist or Google) and, if you choose “Other”, a short text. We store it with your studio's data to learn which channels work, based on our legitimate interest (Art. 6(1)(f) GDPR). If you accept analytics, PostHog only receives the option you chose, never the text you type. You can skip the question.
• Product news: when you set up your studio you can, if you want, turn on “Get product news by email”, which is off by default and separate from the rest of the sign-up. We store your answer (yes or no) and the date you gave it as proof of consent (Art. 6(1)(a) GDPR and Art. 21 of the Spanish LSSI). If you turn it on, we store your email as a contact with our email provider, Resend, together with your answer and its date; if you turn it off and you were already a contact (for example, from the waitlist), we mark it as unsubscribed, and if you never turned it on we create no contact. We only email you news if you turned it on, and you can withdraw your consent at any time from “Account” in your user menu inside the app, from the unsubscribe link in each email or by writing to hola@synctattoo.com.
• How long we keep it: while your account is active. If you delete your account or ask us to erase it at hola@synctattoo.com, we delete or anonymise your account data within 30 days at most.
• Google Calendar data: we use it only for the import you request. We do not use it for advertising or to train general artificial intelligence models, we do not sell it, and we share it only with the sub-processors that provide the service: Convex, where it is stored, and Mistral AI, which classifies its already masked text.
• How to revoke access: you can revoke SyncTattoo's access to your Google account at any time at myaccount.google.com/permissions.

SyncTattoo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Usage analytics in the application

In the application (app.synctattoo.com) we use PostHog, with servers in the European Union, to understand how the application is used, view session recordings and detect errors, in order to improve it.

• Only with your consent: the first time you sign in we ask whether you accept analytics. Until you answer, or if you reject it, we only make an anonymous count of visits without cookies or storage in your browser, without recordings and without linking it to your account.
• If you accept: PostHog uses its own analytics cookies, records your sessions and links the activity to your account and your studio. In the recordings all on-screen text and everything you type is hidden: no names, phone numbers, notes or other data of yours or your clients can be seen. The content of network requests is not stored.
• Legal basis: your consent (art. 6.1.a GDPR).
• Changing your mind: you can change your choice at any time from the user menu, under «Preferencias de analítica».
• How long we keep it: recordings, 30 days; usage events, 1 year at most.

The application also sends PostHog technical browser security reports (Content Security Policy), which contain no cookies and identify no one.

Help and feedback in the application

From the user menu you can ask us for help («Ayuda») or send us feedback («Enviar comentarios»). If you accepted analytics, a PostHog support chat and a short survey open (servers in the European Union); otherwise, an email to hola@synctattoo.com opens.

• What data we process: what you write to us, your account (name and email) and, to understand the problem, the session recording and related errors, with all text hidden as in every other recording. Do not send us your clients' data through the chat.
• What for: answering your request and improving the application.
• Legal basis: performance of the service contract (art. 6.1.b GDPR) to handle your requests, and our legitimate interest in improving the application (art. 6.1.f GDPR) for feedback.
• How long we keep it: conversations, while your account is active and at most 1 year after they are closed; survey answers, 1 year at most.

Future changes

This policy will expand when SyncTattoo adds new features, such as digitally signed informed consents and payments via Stripe Connect. We will notify you when the policy is updated. When SyncTattoo is incorporated as a company, this policy will be updated to reflect the new data controller.

Contact

For any questions about this policy or to exercise your rights, write to us at hola@synctattoo.com.