This English text is a preliminary translation provided for convenience and has not yet been reviewed by legal counsel. The German version is the authoritative one and prevails in the event of any discrepancy.

Privacy Policy for INKLY

Last updated: January 2026

This policy describes how INKLY GmbH (hereinafter "INKLY", "we") collects, uses and protects your personal data when you use our platform (website, apps).

1. Who we are & contact details

The controller responsible for data processing is: INKLY GmbH, Im Aegler 3i, 8153 Rümlang, Switzerland E-mail for all matters (support & data protection): info@inkly.ch

2. Who does this policy apply to?

This policy applies to all users of our platform, in particular:

End customers who book appointments or seek information.
Partners (studios, artists) who use our management tools.

Important note: When a booking is made, the studio you select becomes the primary data controller for performing the service. INKLY then acts as a processor on behalf of the studio.

3. What data do we collect and why?

Purpose	Data categories	Legal basis (GDPR)
Account creation & login	Name, e-mail, password (encrypted)	Art. 6(1)(b) – performance of a contract
Appointment booking & management	Contact details, booking details (service, artist, time), communication history	Art. 6(1)(b) – performance of a contract
Payment processing (deposits)	Payment data (processed by Stripe)	Art. 6(1)(b) – performance of a contract
Improving the platform	Anonymised usage data, device information	Art. 6(1)(f) – legitimate interest
Processing of sensitive data	Health data (voluntary), body location, motif details	Art. 9(2)(a) – explicit consent

Special categories of data (Art. 9 GDPR)

Because tattoos or piercings may allow conclusions about your health or religious beliefs, we collect this data only with your explicit, separate consent during the booking process. This consent is voluntary and can be withdrawn at any time.

4. Cookies

INKLY uses strictly necessary cookies only. There are no analytics, advertising or tracking cookies, and we embed no third-party audience-measurement services.

Cookie	Purpose	Duration
__session	Keeps you signed in. Signing in is not possible without it.	Until sign-out, at most 5 days
NEXT_LOCALE	Remembers your chosen language for redirects from the start page.	1 year

Strictly necessary cookies do not require consent — they are a precondition for the service you requested to work at all. You can delete or block cookies in your browser settings at any time; signing in will then no longer work.

Should we introduce analytics or marketing cookies in future, we will obtain your consent beforehand and update this statement.

Cookieless audience measurement

We count how often individual pages are opened. No cookie is set, no identifier is assigned and no IP address is stored. All that is stored is a counter per day and per page in our own database in the EU; no third party receives this data. Two visits by the same person cannot be linked, and no profiles are created.

Because no personal data is involved, no consent is required. You can still switch the count off at any time — in the notice shown on your first visit, or under Account → Settings → Anonymous measurement. That choice is stored locally in your browser and is not transmitted to us. A “Do Not Track” or “Global Privacy Control” signal set in your browser is honoured automatically.

5. Sharing data with third parties

With the booked studio: to fulfil the service contract.
Processors:

Provider	Purpose	Location
Google Cloud (Firebase)	Hosting, database, authentication, file storage	EU / Switzerland
Stripe	Payment processing (deposits, gift cards, subscriptions)	USA (SCC)
Infomaniak	Sending transactional e-mail	Switzerland
Algolia	Search index for the studio and artist search	EU
OpenAI	Processing input to the AI features	USA (SCC)
Sentry	Error and stability monitoring	EU

No data is shared with other third parties without your consent.

Note on the AI features

What you enter into our AI tools – descriptions, reference and body images – is transmitted to OpenAI to generate the result and processed there. Do not upload anything you would not want to share with an external provider. The health details from your consent form are not transmitted to AI services.

6. International data transfers

When using service providers such as Stripe, data may be transferred to the USA. We ensure an adequate level of data protection through Standard Contractual Clauses.

7. Your rights

You have the right to: access, rectification, erasure, restriction of processing, data portability and objection. To exercise your rights, please contact us at info@inkly.ch.

8. Retention period

We store your data only for as long as the purpose requires or as statutory periods (e.g. 10 years for accounting records) prescribe.

9. Data security

We protect your data through modern technical and organisational measures (TOMs), such as SSL encryption and access controls.

10. Data Processing Agreement (DPA)

For our partner studios we provide a separate Data Processing Agreement.