Privacy Notice

1. Who is responsible

INKaholic Tattoo Isla (“INKaholic”, “we”) is the party responsible for your personal data. This notice covers the website inkaholictattoo.com and the online services in it: booking, the shop and gift cards.

2. Personal data we collect

We only collect what each form or service needs. Depending on what you do on the site, that can be:

• Booking an appointment (Book Now and cart): name, phone / WhatsApp number, email, the date and time you choose, and for each service (up to 5 per booking): type (tattoo or piercing), session length, the description you write, optionally the name of the person it is for, and up to 3 reference images. Also the promo or gift card code if you use one, and the payment method you choose.
• Ordering from the shop: name, phone, email, the items you order, the pickup date and time, the payment method, and any promo or gift card code.
• Paying: with card or PayPal you type your payment details on the pages of Stripe or PayPal, not on ours. We do not receive or store card numbers; we only receive the confirmation that the payment was made or failed. With Zelle or Venmo you pay from your own bank or app to the account we show you and upload a screenshot of the confirmation, which may show your name, part of your account or card number and the amount.
• Buying a gift card: buyer’s name, email and phone; for each card (up to 5 per order) the amount, optionally the recipient’s name and email, a personal message (up to 90 characters) and the delivery date. The system generates a unique code for each card. When a code is used, we record the balance and the movement.
• Checking a gift card balance: the code you type.
• Contacting us: whatever you send us by WhatsApp, email, phone or social media, plus the contact details of that channel. When you choose to send your booking ticket to the studio by email or WhatsApp, the ticket image with the details you entered reaches our inbox or chat.
• At the studio: our team records clients in an internal system (name, phone, email and notes about appointments and sales) and can send you a ticket by email or WhatsApp.
• Technical data: your IP address is used to limit abusive or automated requests; it is kept in a hashed (scrambled) form and only briefly. Our hosting provider may also keep standard server logs (IP address, browser, pages requested) to run and secure the site.

Sensitive data

The site does not ask for health information. However, the description box and the reference images are free-form. If you choose to write or show something that reveals sensitive data (for example allergies, medical or skin conditions, medication, pregnancy, or photos of skin conditions or scars), you do it voluntarily and you give your express consent for us to use it only to evaluate your request and to carry out your service safely. If you prefer, leave it out and talk it through directly with your artist.

What we do not collect

We never ask for card numbers, security codes or bank passwords on this site.

3. What we use it for

Primary purposes (necessary for the service you ask for)

• Create, schedule and manage your booking, including deposits, assigning an artist and recording it on our appointment calendar.
• Process shop orders and payments, check Zelle or Venmo receipts, and send you receipts and tickets.
• Issue, deliver and honor gift cards: send the card to the recipient on the chosen date, check balances and redeem codes.
• Contact you about your booking, order or gift card (confirmations, changes, reminders, questions) by WhatsApp, phone or email.
• Answer your questions and requests.
• Keep the site secure, prevent fraud and abuse, and keep the site working.
• Keep business records and meet tax, accounting and other legal obligations, and defend ourselves if a claim arises.

Secondary purposes (optional)

• Send you news, promotions and offers from the studio by WhatsApp, email or phone.
• Ask for your opinion about our service.

We use your data for secondary purposes only if you agree (for example, by asking us to send you promotions). If you do not want your data used for these purposes, or you want to stop at any time, write to inkaholicislamujeres@gmail.com. Saying no never affects the services you request or your booking. If we ever want to use your data for a new purpose, we will ask you again first.

4. Who receives your data

We do not sell your personal data. We share it only with the providers below, and only as needed to give you the service:

• Supabase (cloud database, file storage and server functions): stores and processes the data and files you submit, such as bookings, orders, gift cards, reference images and payment receipts. Its servers may be outside Mexico.
• Hostinger (web hosting and outgoing email): runs the website and sends the emails and tickets you request from our domain.
• Stripe and PayPal (online payments): receive your payment details directly and handle them under their own privacy notices.
• Google: Google Fonts (your browser requests the site’s fonts from Google, which then sees your IP address), Google Maps on the Contact page, our appointment calendar (which holds the client’s name, the service, notes and price), and the studio’s Gmail mailbox.
• WhatsApp (Meta): when you message us or we send you a ticket or message through WhatsApp.
• Zelle, Venmo and your bank or app: when you choose these methods, the transfer goes through them; we see only what the payment confirmation shows.
• Cloudflare cdnjs: delivers a public code library used on the booking and gift card pages; your browser contacts it directly.
• Competent authorities, when the law requires it.
• The INKaholic team (artists and staff), who access only what they need for their role.

Transfers clause. Sharing data with these providers is necessary to deliver what you request (for example, a card payment cannot be processed without Stripe or PayPal). By using these services and sending us your data you accept these transfers and disclosures. If you do not accept a particular one, tell us at inkaholicislamujeres@gmail.com and we will explain whether we can still provide that service.

5. How long we keep it

We keep your data for as long as needed for the purposes in this notice and for the periods required by tax, accounting and other legal obligations, and to deal with any claims. Booking and sales records are kept as business records, together with the reference images and payment receipts attached to them. Gift cards are valid for 12 months from payment confirmation; we keep the record of the card after that. The counters we use to limit abusive requests are kept only briefly. When data is no longer needed, we delete or anonymize it.

6. How we protect it

We apply administrative and technical measures that fit the kind of data we handle:

• Encrypted (HTTPS) connections to the website.
• Data held in a managed cloud database with access rules, so the public site cannot read other people’s records.
• Individual staff accounts with roles: each person sees only what their job needs.
• Reference images and payment receipts are kept in private storage, not on public links.
• Card details are processed by Stripe or PayPal; we do not store them.
• Limits on repeated or automated requests.
• Confidentiality expected from everyone on the team who handles data.

No system is completely secure. If a breach seriously affects your property or personal rights, we will tell you as soon as possible so you can protect your interests.

7. Your rights (ARCO)

You have the right to Access your data and know how we use it, to Rectify it if it is wrong, to ask us to Cancel (delete) it, and to Oppose its use for specific purposes. You can also withdraw your consent or ask us to limit the use or disclosure of your data at any time.

How to ask

Email inkaholicislamujeres@gmail.com with the subject “Privacy request” and include:

• your full name and an email or phone number where we can answer you;
• a clear description of the data and the right you want to exercise (and, for rectification, the correct data);
• a copy of an official ID, or of the document proving that you act for the person concerned, so we can confirm your identity;
• anything that helps us find your data (for example the phone number or email you used, or the date of your booking).

We will reply within 20 days of receiving your request and, if it is approved, carry it out within 15 days after that. These periods can be extended once for the same length of time, and we will tell you if that happens. Exercising your rights is free; at most we may charge the cost of copies or shipping if you ask for them.

If you believe your rights were not respected, you can go to the Secretaría Anticorrupción y Buen Gobierno, the Mexican authority for data protection.

8. Minors

This website is meant for adults. As stated in our booking FAQ, we tattoo minors only in certain cases and only when they come with a parent or legal guardian who brings valid ID and documents proving the relationship. Bookings for a minor must be made by the parent or guardian, with their own details. We do not knowingly collect data directly from minors through the site. If you think a minor sent us data without a parent or guardian, write to us and we will delete it.

9. Cookies and browser storage

Our site does not use analytics or advertising cookies, tracking pixels or session recording. It uses your browser’s own storage for the following, and only on your device:

• Your cart (local storage, key inkaholic-carrito): the services and items you add, so they are still there when you change page or come back. It stays until you complete the purchase, remove the items or clear your browser data.
• Short-lived session data (session storage): the ticket shown after you return from the payment page. It disappears when you close the tab.

Third-party services you use on the site, such as Stripe or PayPal checkout, Google Maps and Google Fonts, may set their own cookies or identifiers under their own policies, which we do not control. You can clear or block storage in your browser settings; without it the cart may not work.

10. Gift cards

• The buyer’s name, email and phone are used to process the payment, issue the cards, send the receipt and a summary of the order with all the cards, and contact the buyer about the order.
• The recipient’s name and email (both optional) and the personal message are used to deliver the card on the date the buyer chooses. The recipient gets an email with the card: its code, the amount, the sender’s name and the message. If no recipient email is given, the buyer receives the card.
• If you enter someone else’s data, you confirm that you can share it with us for this purpose.
• Anyone with the card code can use its balance, so keep it private.
• Recipients can exercise their rights in the same way as everyone else (see section 7).

11. Changes to this notice

We may update this notice, for example if we change providers, services or the law changes. The new version is published on this page with its version number and date at the top. If a change means using your data for a new purpose that needs your consent, we will ask you again through the channel we have for you or with a visible notice on the site. This is version 1.0, the first version of this notice, and we may refine it soon.

Version 1.0 · October 23, 2026