Sign in Sign up

Inkfillers Privacy Policy

Inkfillers ApS is committed to protecting your personal information.

This Privacy Policy explains what personal data we collect when you use Inkfillers — our website, business portal and mobile apps (together, the "Service") — why we collect it, who we share it with, and the rights you have. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and Danish data protection law.

Last updated: July 5, 2026

1. Who we are

The data controller for your Inkfillers account is:

Inkfillers ApS (CVR 38109901)
Spurvevej 5
8700 Horsens, Denmark
support@inkfillers.com

We are not required to appoint a Data Protection Officer (DPO). Privacy questions can be sent to the address above.

2. Our two roles: controller and processor

Inkfillers has two different roles depending on whose data is involved:

  • Inkfillers as data controller. For your Inkfillers account, our website and apps, our own communications and our business relationship with studios, we decide how and why data is processed. This policy describes that processing.
  • Inkfillers as data processor. Studios use Inkfillers to manage their own customer data — for example customer records, bookings, consent forms and messages. For that data, the studio is the data controller and we process it only on the studio's behalf. If you have questions about how a studio uses your data, please contact the studio directly; we will assist them in answering. See also section 14.

3. What personal data we process

Depending on how you use the Service, we process:

  • Account data: name, email address, phone number, address, nationality, date of birth, profile picture and account settings.
  • Booking and session data: your bookings, session requests and agreements with studios on the Service, including consent forms you sign with a studio. Consent forms may include health-related information (for example allergies or skin conditions) — the studio decides the content of its forms and is the controller of your answers; we store them securely on the studio's behalf.
  • Payment data: payments are processed by Stripe, and we never store your full card details. We keep transaction records such as amounts, dates, gift cards, invoices and payment status.
  • Content: images, videos, posts and portfolio material you upload, together with the visibility settings you choose.
  • Communications: SMS, email and push messages sent through the Service (including delivery logs), and your correspondence with our support.
  • Technical data: IP address, device and browser information, log data, cookies and usage statistics (see section 10), and push notification tokens if you use our apps.
  • Business User data: if you represent a studio — business name and CVR, staff and access rights, subscription and billing records, SMS usage, payment and payout records, ink registration and inventory data, and guest spot applications (including files applicants upload).

We only collect the data we need. Most of it comes directly from you; some may be provided by a studio you interact with (for example when a studio creates a booking for you).

4. Why we process your data, and on what legal basis

  • To provide the Service — creating and running your account, bookings, payments, content hosting, messages about your sessions, and support. Legal basis: performance of a contract (GDPR art. 6(1)(b)).
  • To keep the Service safe and improve it — security, fraud prevention, abuse and spam prevention, debugging, and aggregated product analytics. Legal basis: our legitimate interests (GDPR art. 6(1)(f)).
  • To comply with the law — bookkeeping, accounting and responding to lawful requests from authorities. Legal basis: legal obligation (GDPR art. 6(1)(c)).
  • Marketing and non-essential cookies — newsletters, marketing messages and analytics/advertising cookies are only used with your consent, which you can withdraw at any time. Legal basis: consent (GDPR art. 6(1)(a)).

5. Who we share your data with

We never sell your personal data. We share it only as described here:

  • Studios you interact with. When you book a session or otherwise engage with a studio, the studio sees the information needed for that relationship — your name and your booking details, plus any information you choose to give them (for example in a consent form).
  • Other users. Content and profile information is visible to others according to the visibility settings you choose (public, friends or private).
  • Our processors. Trusted providers that process data on our behalf under data processing agreements:
    • Microsoft Azure — hosting, databases and file storage (EU data centers)
    • Stripe — payment processing
    • Twilio — SMS delivery
    • Twilio SendGrid — email delivery
    • Google — analytics (Google Analytics via Google Tag Manager) and push notifications for our apps
    • Apple and Google — app distribution and push notification delivery on their platforms
  • Authorities. Where we are legally required to do so, or to establish, exercise or defend legal claims.

Our employees are bound by confidentiality, and internal access to personal data is restricted, logged and protected by additional safeguards such as multi-factor authentication.

We do not share your uploaded images or videos with third parties for AI training, and we actively work to block AI crawlers from harvesting content on the Service.

6. Transfers outside the EU/EEA

Your data is primarily stored on servers in the EU. Some of our processors (for example Stripe, Twilio, SendGrid and Google) may process data in the United States or other countries outside the EU/EEA. Where that happens, the transfer is protected by a valid transfer mechanism — the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses. Public media files may additionally be cached on content delivery nodes outside the EU to improve performance.

7. How long we keep your data

  • Account data and content: until you delete it or your account, or after 3 years of account inactivity, after which the account and its data are deleted.
  • Bookkeeping records (invoices, payment records): 5 years from the end of the financial year, as required by the Danish Bookkeeping Act.
  • Message and delivery logs: kept only as long as needed for delivery, billing and abuse prevention.
  • Data we process for studios (customer records, consent forms): retained according to the studio's instructions and the studio's legal obligations.

8. How we protect your data

All data is stored encrypted on servers in the EU. Data is encrypted in transit, sensitive fields are encrypted or masked at rest, and access is limited to a small number of authorized employees protected by additional security measures, including multi-factor authentication. We monitor the Service for abuse and security events.

9. Images and video

When you upload images or videos, they are shown to other users according to the visibility setting you choose. Content you mark as public may also be featured by Inkfillers, for example in newsletters or on our social media channels. If you do not want this, you can mark content as private or friends-only, or delete it, at any time.

10. Cookies, diagnostics and analytics

On our websites, we use cookies and similar technologies for three purposes:

  • Necessary cookies — required for the site to work, for example your login session. These cannot be switched off.
  • Analytics — we use Google Analytics (loaded via Google Tag Manager) to understand how the Service is used so we can improve it.
  • Marketing cookies — used only with your consent, which you can give or withdraw in the cookie banner.

You can also delete or block cookies in your browser settings; parts of the Service may not work without necessary cookies.

In our mobile apps, Sentry crash and performance diagnostics remain disabled until you accept analytics in the app. Facebook App Events used for advertising measurement remain disabled until you accept marketing; on iOS, they also remain disabled unless you authorize tracking in Apple's system prompt. Choosing Facebook as a sign-in method is a separate, user-initiated authentication request and does not by itself enable advertising measurement. You can withdraw the optional app consents from the app's privacy settings.

11. SMS, email and push notifications

We and the studios you interact with send you messages about your bookings and sessions — confirmations, reminders, changes, aftercare information and payment requests. These transactional messages are part of the Service. Marketing messages are only sent with your consent, and every marketing message includes a way to opt out (an unsubscribe link in emails, reply STOP for SMS where available, or your account settings). Push notifications can be managed in the app or your device settings.

12. Your rights

Under the GDPR you have the right to:

  • access the personal data we hold about you (art. 15);
  • have inaccurate data corrected (art. 16);
  • have your data deleted where it is no longer needed (art. 17);
  • restrict processing (art. 18);
  • receive your data in a structured, commonly used, machine-readable format (art. 20);
  • object to processing based on legitimate interests, and object at any time — unconditionally — to processing for direct marketing (art. 21);
  • withdraw a consent at any time, without affecting the lawfulness of processing carried out before withdrawal (art. 7(3)).

You can exercise most of these rights directly in your account settings, or by contacting us at support@inkfillers.com. Conditions and limitations may apply to some rights depending on the circumstances. Note that for data a studio controls (section 2), your request should be directed to the studio; we will assist them in fulfilling it.

You can always lodge a complaint with the Danish Data Protection Agency:
Datatilsynet
Carl Jacobsens Vej 35
2500 Valby, Denmark
Tel. +45 33 19 32 00
dt@datatilsynet.dk

13. Age limit

The Service is for users aged 18 and over. We do not knowingly process data about anyone under 18; accounts found to belong to minors are terminated and their data deleted. See our Child Safety (CSAE) Policy.

14. Information for studios — Inkfillers as data processor

For personal data that a studio collects and manages about its customers through the Service, the studio is the data controller and Inkfillers is the data processor. As processor, we:

  • process the studio's customer data only to provide the Service and on the studio's documented instructions;
  • keep the data confidential and apply the security measures described in section 8;
  • use only the sub-processors listed in section 5 and inform Business Users of changes to that list;
  • assist the studio, insofar as possible, in responding to data subject requests and meeting its GDPR obligations;
  • notify the studio without undue delay after becoming aware of a personal data breach affecting its data;
  • delete or return the studio's customer data when the subscription ends, unless retention is required by law.

These processor terms form part of our Terms of Service for Business Users. Studios remain responsible for having a valid legal basis for the data they collect — including any health information in consent forms — and for their own privacy notices to their customers.

15. Changes to this policy

We may update this Privacy Policy from time to time. If a change is material, we will notify you — for example by email or in the Service — before it takes effect. The date of the latest revision is shown at the top of this page.

16. Contact

Questions about this policy or how we handle your data? Contact us at support@inkfillers.com.