Privacy Policy

Tattoo Point is a custom tattoo studio in Costa Mesa, California. This policy explains how we handle personal information in the private studio platform at tattoopointoc.com (the “Platform”), which only authorized Tattoo Point staff can sign in to, and in the booking requests clients send us.

Information we collect

• Staff accounts: name, email address, role and sign-in activity. Passwords are handled by our authentication provider and are never stored in readable form.
• Client and appointment information entered by staff or sent to us through our booking form: name, phone number, email address, appointment details, tattoo request details (such as placement, size, style and description) and reference images.
• Check-in and consent: consent forms and identification photos that clients provide when checking in for an appointment.
• Payments: records of deposits and payments received. The Platform does not process card payments.
• Messages: appointment-related text messages sent to and received from clients.
• Usage information: basic page-view analytics and the technical logs our hosting provider keeps to operate the service.

How we use information

We use this information only to run the studio: scheduling and managing appointments, keeping client and consent records, sending appointment confirmations and reminders, and controlling which staff members can access what. We do not sell personal information and do not use it for advertising.

Service providers

We rely on a small number of providers who process information on our behalf, only to operate the Platform:

• Supabase: database, sign-in and file storage.
• Vercel: hosting and page-view analytics.
• Quo: appointment text messages.
• Google: Google Calendar, only if a staff member connects a Google account (see below).

Google Calendar and Google user data

This section applies only when a Google account has been connected to the Platform. Connecting Google Calendar is optional: it is done by an owner or admin for the studio’s Google account, or by an artist for their own. If no Google account is connected, the Platform does not access any Google user data. To connect, you sign in with Google and grant the Platform these permissions:

• Your Google account email address (openid, email), to show which account is connected.
• Calendars created by this app (calendar.app.created): the Platform creates one dedicated “Tattoo Point” calendar in your account and adds, updates and removes appointment events only in that calendar. It cannot read or change your other calendars or events.
• Free/busy availability (calendar.freebusy): the Platform reads only the busy and free time ranges of your primary calendar, so those times are not booked. It never reads the titles, descriptions, attendees or other details of your events.

What we write to Google. While a Google account is connected, the Platform keeps an event there for each relevant appointment. Each event is marked private and contains the service, the artist, the date and time, the client’s first name and last initial, tattoo placement, size and style, the client’s booking description (with phone numbers, email addresses and links removed) and a link to the appointment in the Platform. Events never contain phone numbers, email addresses, full client names, internal notes, consent information, payment information or files. An artist’s calendar receives only that artist’s appointments.

What we store. For each connected Google account: the account’s email address, the ID and name of the dedicated calendar, the IDs of the events we created, the busy time ranges we read (start and end times only), and a long-lived refresh token, which is encrypted and stored only on our servers. Short-lived access tokens are requested from Google when needed and are not stored. Tokens are never sent to anyone’s browser or shown to other users.

One direction only. Changes made in Google Calendar never change appointments in the Platform; only busy times are read back.

Disconnecting. Disconnecting in the Platform revokes our access with Google and deletes the stored token, connection details and imported busy times. Events already created stay in your Google Calendar until you delete them, for example by deleting the “Tattoo Point” calendar. You can also remove access at any time at myaccount.google.com/permissions.

Limited Use. Tattoo Point’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide the calendar features described above. We do not sell it, use it for advertising, or use it to develop, improve or train generalized AI or machine-learning models, and people do not read it except where needed for security, to comply with the law, or with your permission.

Sharing

We share information only with the service providers listed above, to operate the Platform, or when required by law. We do not sell or rent personal information.

Security

The Platform uses encrypted (HTTPS) connections, role-based access so staff see only what their role allows, and encryption for stored Google tokens. No system can be guaranteed to be completely secure, but we work to protect the information we hold.

Keeping and deleting information

We keep information for as long as we need it to run the studio and meet our legal obligations. To ask for a copy of your information, a correction or deletion, contact us at the address below. You can stop appointment text messages at any time by replying STOP.

Changes to this policy

If we change how we handle information, we will update this page and the date at the top.

Contact

Questions about this policy or your information: tattoopointca@gmail.com